Subrosa – An encrypted communication platform
1–10 of 50 posts
Re: Subrosa – An encrypted communication platform
#2Matasano's "Javascript Cryptography Considered Harmful" is yet again applicable. http://matasano.com/articles/javascript-cryptography/
These statements are mutually exclusive:
End to end encrypted: Nobody, not even us, can read or listen into your conversations.
Works everywhere: Visit subrosa.io from any computer. No download or install needed.
Re: Subrosa – An encrypted communication platform
#3First impression:
- There is no demo, i can only guess that this is a "browser-based skype". I hate when i can't try it but it's free.
- Open-source, but no git repo?
Btw I had the same idea before (I posted it to an Idea Sunday thread) but I dropped the idea because i realized that no one needs this level of security, NSA is not interested in your chat with family and friends...
Re: Subrosa – An encrypted communication platform
#4Unless they're using a browser extension, there's no way a user can trust this application. It's a web app. At any moment the developer or a malicious third party with unauthorized server access can remotely modify the JavaScript files to dump all data in plaintext to the NSA.
Re: Subrosa – An encrypted communication platform
#5In the description of the key exchange mechanism (section 'Conversation Keys' under 'Security') it sounds like they're using one symmetric key for both directions of a two-way channel. If true, this is a pretty serious security flaw. Anyone from Subrosa care to comment?
Re: Subrosa – An encrypted communication platform
#6In the description of the key exchange mechanism (section 'Conversation Keys' under 'Security') it sounds like they're using one symmetric key for both directions of a two-way channel. If true, this is a pretty serious security flaw. Anyone from Subrosa care to comment?
Not really, from what I understand. Seems they are exchanging a symmetric key via RSA to facilitate two-way encrypted communication. This is pretty standard, browsers do this via TLS.
Re: Subrosa – An encrypted communication platform
#7In the description of the key exchange mechanism (section 'Conversation Keys' under 'Security') it sounds like they're using one symmetric key for both directions of a two-way channel. If true, this is a pretty serious security flaw. Anyone from Subrosa care to comment?
Not really, from what I understand. Seems they are exchanging a symmetric key via RSA to facilitate two-way encrypted communication. This is pretty standard, browsers do this via TLS.
TLS does not use a single symmetric key for bidirectional comms. It establishes keys per direction.
Re: Subrosa – An encrypted communication platform
#8Matasano's "Javascript Cryptography Considered Harmful" is yet again applicable. http://matasano.com/articles/javascript-cryptography/ These statements are mutually exclusive: End to end encrypted: Nobody, not even us, can read or listen into your conversations. Works everywhere: Visit subrosa.io from any computer. No download or install needed.
That is such a good article and I cannot believe that I am just reading it for the first time now. Thank you so much for posting the article and your explanation of the two mutually exclusive statements. Crypto is just about the coolest thing I have ever heard of and I love learning about different types of attacks!
Re: Subrosa – An encrypted communication platform
#9"Nobody, not even us, can read or listen into your conversations."
This cannot possibly be true, given they are the root of trust for establishing the recipient's authentic public key.
Also, minified javascript really does not count as a source code release.
Re: Subrosa – An encrypted communication platform
#10First impression: - There is no demo, i can only guess that this is a "browser-based skype". I hate when i can't try it but it's free. - Open-source, but no git repo? Btw I had the same idea before (I posted it to an Idea Sunday thread) but I dropped the idea because i realized that no one needs this level of security, NSA is not interested in your chat with family and friends...
"There is no demo" -- just make an account quickly and try it out. I did this and it was easy.
"Open-source, but no git repo" -- Open-source does not always entail git or Github.
"I dropped the idea because i realized that no one needs this level of security, NSA is not interested in your chat with family and friends..." -- I'm glad you dropped the idea because someone who doesn't understand why privacy is important shouldn't be making privacy applications. The NSA doesn't care about your chat with family and friends, until suddenly they DO start caring and everything you've said can be manipulated and transformed against you, whether your conversations were innocent or not.