Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

'Hush,' anonymous messaging app from developers in Myanmar

globalpost.com

Post reply on HN
Print view View original

31–40 of 51 posts

Re: 'Hush,' anonymous messaging app from developers in Myanmar

#31

Post by zmanian »

13 wrote: post #27
zmanian wrote: post #15

Earlier quoted context omitted.

The minimum I would consider responsible is 1. Use a hashcash style proof of work mechanism to register account. The server send a challenge and have the client compute a nonce under the difficulty. This could be turned to take an average of seconds to minutes on your median users device. This isn't a long term solution because eventually an attacker will realize that they can use more powerful machines to create syb…

Hashcash is broken for any situation like this. The amount of hashcash time needed to thwart spam is higher than any user is willing to wait for, doing proof of work on a phone. Plus, spammers normally have their own Cloud Computing to resort to, and it's cheaper than Amazon AWS. https://en.wikipedia.org/wiki/Botnet

Just proposed as interim solution that is easy to implement and escapes the PII collection model.

Blind signed auth tokens are way better but much more resource intensive to implement

Re: 'Hush,' anonymous messaging app from developers in Myanmar

#32

Post by mc808 »

derpleplex wrote: post #25
tyho wrote: post #17

Earlier quoted context omitted.

This worries me. What exactly do you mean by encrypted in the DB? If you actually mean hashed using a one-way function, it would be very easy to hash every possible phone number (there are not that many) to build a lookup table to deanonymise your users instantly. Even if you individually salt each hash it would not take very long at all to find the phone number for each entry. If you do mean encrypted, then authorit…

Perfect security does not currently exist. A trusted source must store the information somewhere, to authorize and validate users without spreading that information elsewhere. You can't get around this problem unless you invent magic psychic computers. What is the point in finding every possible flaw with security here? There is a gradient of complexity, the time it takes to break these things. Currently, everything…

So it sounds like messages are associated with accounts, and accounts are linked to phone numbers, and those phone numbers are easily recoverable from a centralized database. If htat's accurate then it's not simply imperfect anonymity. It's not even pseudo-anonymous. It's about as not-anonymous as it gets, which is fine for a casual messaging/chat app where no anonymity is expected. But users should not be misled into thinking it's safe to use it for anything they wouldn't say to a government official's face.

Re: 'Hush,' anonymous messaging app from developers in Myanmar

#33

Post by patcon »

13 wrote: post #27
zmanian wrote: post #15

Earlier quoted context omitted.

The minimum I would consider responsible is 1. Use a hashcash style proof of work mechanism to register account. The server send a challenge and have the client compute a nonce under the difficulty. This could be turned to take an average of seconds to minutes on your median users device. This isn't a long term solution because eventually an attacker will realize that they can use more powerful machines to create syb…

Hashcash is broken for any situation like this. The amount of hashcash time needed to thwart spam is higher than any user is willing to wait for, doing proof of work on a phone. Plus, spammers normally have their own Cloud Computing to resort to, and it's cheaper than Amazon AWS. https://en.wikipedia.org/wiki/Botnet

Interesting observation. I wonder if you could hide this work behind an approval period, much like waiting for a beta invite. When framed like this, it just builds anticipation, and the users doesn't necessarily need to know.

But of course, this would most obviously involve a client-side component with access to system resources. Workable for a native android app, but perhaps not for desktop/browser...

Re: 'Hush,' anonymous messaging app from developers in Myanmar

#35

Post by jlebar »

derpleplex wrote: post #25
tyho wrote: post #17

Earlier quoted context omitted.

This worries me. What exactly do you mean by encrypted in the DB? If you actually mean hashed using a one-way function, it would be very easy to hash every possible phone number (there are not that many) to build a lookup table to deanonymise your users instantly. Even if you individually salt each hash it would not take very long at all to find the phone number for each entry. If you do mean encrypted, then authorit…

Perfect security does not currently exist. A trusted source must store the information somewhere, to authorize and validate users without spreading that information elsewhere. You can't get around this problem unless you invent magic psychic computers. What is the point in finding every possible flaw with security here? There is a gradient of complexity, the time it takes to break these things. Currently, everything…

> What is the point in finding every possible flaw with security here?

Because security is only as good as its weakest link, and an adversary who wants your sensitive data won't choose not to break in because your security is "mostly OK".

At the risk of being overly negative, if you have this attitude, you're not building a secure system, and, for your users' sakes, you shouldn't say that you are.

Re: 'Hush,' anonymous messaging app from developers in Myanmar

#36

Post by xnull6guest »

derpleplex wrote: post #25
tyho wrote: post #17

Earlier quoted context omitted.

This worries me. What exactly do you mean by encrypted in the DB? If you actually mean hashed using a one-way function, it would be very easy to hash every possible phone number (there are not that many) to build a lookup table to deanonymise your users instantly. Even if you individually salt each hash it would not take very long at all to find the phone number for each entry. If you do mean encrypted, then authorit…

Perfect security does not currently exist. A trusted source must store the information somewhere, to authorize and validate users without spreading that information elsewhere. You can't get around this problem unless you invent magic psychic computers. What is the point in finding every possible flaw with security here? There is a gradient of complexity, the time it takes to break these things. Currently, everything…

The OP probably was replying to the fact that larger nations are able and willing to lean on service providers to extract personal information and deanonymize private conversation. This is a normal mode of analysis for citizens trying to secure their conversations from the US government, for example.

The Burmeses government however is not likely to be able to perform something like this, especially if the authors are not in Myanmar. In fact, there's a reasonable chance that the authors of the software are CSOs sponsored by other governments that would like to see changes in the regime in Myanmar (like the CIA's ZunZuneo app in Cuba) - in this case it is not likely that the government there will be able to play effective whack-a-mole.

The danger here is that the government will ban phones or create some sort of licensing for them if this becomes a large enough civil unrest problem. But it's equally likely that other countries would then raise sanctions and human rights violations against the regime on account of principles of 'freedom'.

Re: 'Hush,' anonymous messaging app from developers in Myanmar

#37

Post by derpleplex »

jlebar wrote: post #35
derpleplex wrote: post #25

Earlier quoted context omitted.

Perfect security does not currently exist. A trusted source must store the information somewhere, to authorize and validate users without spreading that information elsewhere. You can't get around this problem unless you invent magic psychic computers. What is the point in finding every possible flaw with security here? There is a gradient of complexity, the time it takes to break these things. Currently, everything…

> What is the point in finding every possible flaw with security here? Because security is only as good as its weakest link, and an adversary who wants your sensitive data won't choose not to break in because your security is "mostly OK". At the risk of being overly negative, if you have this attitude, you're not building a secure system, and, for your users' sakes, you shouldn't say that you are.

That was not my point, I over-reacted to a pattern of argument that bothers me when my own mind repeats it.

I agree that security should be taken seriously, with care and caution, and that users who ethically need to be aware of potentially fallacious assumptions about the usage of a device should have the capacity to easily find that information.

Re: 'Hush,' anonymous messaging app from developers in Myanmar

#38

Post by [deleted] »

mc808 wrote: post #32
derpleplex wrote: post #25

Earlier quoted context omitted.

Perfect security does not currently exist. A trusted source must store the information somewhere, to authorize and validate users without spreading that information elsewhere. You can't get around this problem unless you invent magic psychic computers. What is the point in finding every possible flaw with security here? There is a gradient of complexity, the time it takes to break these things. Currently, everything…

So it sounds like messages are associated with accounts, and accounts are linked to phone numbers, and those phone numbers are easily recoverable from a centralized database. If htat's accurate then it's not simply imperfect anonymity. It's not even pseudo-anonymous. It's about as not-anonymous as it gets, which is fine for a casual messaging/chat app where no anonymity is expected. But users should not be misled int…

[deleted]

Re: 'Hush,' anonymous messaging app from developers in Myanmar

#39

Post by derpleplex »

mc808 wrote: post #32
derpleplex wrote: post #25

Earlier quoted context omitted.

Perfect security does not currently exist. A trusted source must store the information somewhere, to authorize and validate users without spreading that information elsewhere. You can't get around this problem unless you invent magic psychic computers. What is the point in finding every possible flaw with security here? There is a gradient of complexity, the time it takes to break these things. Currently, everything…

So it sounds like messages are associated with accounts, and accounts are linked to phone numbers, and those phone numbers are easily recoverable from a centralized database. If htat's accurate then it's not simply imperfect anonymity. It's not even pseudo-anonymous. It's about as not-anonymous as it gets, which is fine for a casual messaging/chat app where no anonymity is expected. But users should not be misled int…

You are right, I was reacting to a pattern of argument, which is not the point that I should have been focused on. That creates more noise over more important issues.

Re: 'Hush,' anonymous messaging app from developers in Myanmar

#40

Post by jlebar »

derpleplex wrote: post #37
jlebar wrote: post #35

Earlier quoted context omitted.

> What is the point in finding every possible flaw with security here? Because security is only as good as its weakest link, and an adversary who wants your sensitive data won't choose not to break in because your security is "mostly OK". At the risk of being overly negative, if you have this attitude, you're not building a secure system, and, for your users' sakes, you shouldn't say that you are.

That was not my point, I over-reacted to a pattern of argument that bothers me when my own mind repeats it. I agree that security should be taken seriously, with care and caution, and that users who ethically need to be aware of potentially fallacious assumptions about the usage of a device should have the capacity to easily find that information.

Obviously there exist people who believe that the things they say in this app, which claims to provide "anonymous" communication in a country with a history of repression of free speech, aren't tracable back to themselves. We've established here that this isn't true.

It's fine if you think this is an unreasonable conclusion to draw based on the evidence; you're entitled to your opinion. But the question is, do you feel comfortable with the possibility of people going to jail or dying because they didn't understand the security tradeoffs that this app makes? I think it's because some of us see this as an extremely real possibility -- particularly given the frankly ineffective security practices described here -- that you're seeing so much backlash.

Post reply on HN