The Coder Who Encrypted Your Texts • Hacker News Board

Re: The Coder Who Encrypted Your Texts

#181

Post by abalone » Fri, Jul 10, 2015, 7:51 PM UTC

tzakrajs wrote: post #144

juhanima wrote: post #111

Earlier quoted context omitted.

> the browser has no idea when you are supposed to be > operating on a secure channel (HTTPS) Agree about the sentiment, but there are some ways to help this. The server can for instance tell the client to always require https: https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security Doesn't help if the client hasn't yet connected to the right server at least once, though.

Also, the browser can opt into HTTPS by using a plugin such as HTTPS Everywhere.

All HTTPS all the time is the only real solution. Both those band aids rely on distributing rules to browsers describing when to use HTTPS with what sites. That is totally unscalable, not to mention only as secure as the ruleset distribution channel.

Re: The Coder Who Encrypted Your Texts

#182

Post by totony » Fri, Jul 10, 2015, 8:11 PM UTC

jackgavigan wrote: post #153

sergiotapia wrote: post #39

>Unfortunately, if Mr. Marlinspike’s encryption scheme can be applied to imagery, then childporn collectors thank him too. And there we go, highest voted comment on the article: a strawman about child pornography. Think of the keeeds

FFS. Any encryption scheme can be applied to imagery. AES is approved by the NSA. Does that mean childporn collectors are thanking the NSA too?

HEADLINE: "NSA supports the pedophiles! Should we be alarmed?"

Re: The Coder Who Encrypted Your Texts

#183

Post by stouset » Fri, Jul 10, 2015, 8:35 PM UTC

mightybyte wrote: post #172

davisr wrote: post #45

Earlier quoted context omitted.

"Absolutely no way"? I'm sorry to be impolite about it, but that's a bit of an exaggeration: one could jailbreak their phone, pull the binary into their computer, decompile it, and inspect it for implementation structures that would be coherent with how the two or three most popular encryption algorithms are commonly implemented. The expertise to be able to accomplish it doesn't come cheap, but it's certainly in the…

> one could jailbreak their phone, pull the binary into their computer, decompile it, and inspect it for implementation structures that would be coherent with how the two or three most popular encryption algorithms are commonly implemented. There's a much easier way. Turn off your phone's cellular connection, but turn on wifi and connect it to a wifi network you control. Then just sniff the packets.

Not unless you have discovered a novel technique for distinguishing between good crypto and bad crypto over the wire.

Re: The Coder Who Encrypted Your Texts

#184

Post by n_siddharth » Fri, Jul 10, 2015, 9:00 PM UTC

mo92 wrote: post #140

n_siddharth wrote: post #47

Earlier quoted context omitted.

I remember being in an applied crypto class with you at CMU taught by Virgil Gligor if I am not mistaken and was thoroughly impressed with your knowledge of cryptosystems. I am happy for you! Way to go.

He went to CMU?

He attended a class there. I am not sure if he was enrolled as a full time student.

Re: The Coder Who Encrypted Your Texts

#185

Post by jnbiche » Fri, Jul 10, 2015, 10:57 PM UTC

sj4nz wrote: post #159

jnbiche wrote: post #133

Earlier quoted context omitted.

For those of us who don't do YouTube, is there anywhere else we can read about Moxie's "bundling"?

Watched it last night. The very short summary is "bundling" is a kind of inside out Trojan Horse, the example Moxie used was "Google Analytics" which has some functionality that is undesirable to some users, enough so that it was blocked by some privacy extensions. Over time, Google started adding "useful" features to the GA code for websites, arguably because "you're already loading GA, why not get some utilities fo…

Thank you for that summary, I really appreciate it.

Re: The Coder Who Encrypted Your Texts

#186

Post by btczeus » Fri, Jul 10, 2015, 10:58 PM UTC

lorenzhs wrote: post #109

btczeus wrote: post #78

Earlier quoted context omitted.

From https://github.com/WhisperSystems/TextSecure/issues/53 Moxie: "I'd like to avoid distributing APKs outside of the Play Store" Why give a single entity the power to push a malicious update anytime?

that's not how the Play store (or Android) works. Moxie signs the APK, phones will only install updates that are signed with the same certificate as the version they already have. Google cannot modify apps. Edit: In contrast, the F-Droid builds were built and signed by F-Droid, so they could at any time include any code they wanted. Whom do you trust more, the developer or some alternate app store?

I am talking about Moxie ond OpenWhisperSystems. They _might_ be good guys but that is not enough reason to completely rely your security on them.

Re: The Coder Who Encrypted Your Texts

#187

Post by btczeus » Fri, Jul 10, 2015, 11:00 PM UTC

Where's the authentication process in TextSegure? Totally MITM'able. Not secure at all.

Re: The Coder Who Encrypted Your Texts

#188

Post by btczeus » Sat, Jul 11, 2015, 12:28 AM UTC

lorenzhs wrote: post #151

Nutomic wrote: post #143

Earlier quoted context omitted.

Google could also distribute a differently signed apk to selected users. And there's no way for users to check the signature of an apk (if they didn't have it installed before). And I certainly trust an open source project much more than a US company.

But that angle of attack only works if they target you from the moment you first install the app. It would be much easier to just push a modified Google application update to your phone if that is what they wanted. What it boils down to is that with the Play store, you can be sure that you're not getting malicious updates from some intermediary, as each developer signs their own APKs, and Google doesn't have the keys…

You can set up your own repo.

Re: The Coder Who Encrypted Your Texts

#189

Post by ytdht » Sat, Jul 11, 2015, 2:57 AM UTC

jMyles wrote: post #177

drcross wrote: post #66

Earlier quoted context omitted.

No. How do you propose that it would?

I don't really know much about what kind of network chatter Android generates generally, but I imagine that, even if its encrypted, you can detect that there's suddenly network traffic to Google? And then, depending on how silly the eavesdropping is, repeating the same message might cause the same encrypted payload to be transmitted?

traffic to Google is probably very common... and to be sure that you get the whole picture, you would probably need to intercept wireless signals going to the cellphone company which are also encrypted

Re: The Coder Who Encrypted Your Texts

#190

Post by NotSammyHagar » Sat, Jul 11, 2015, 5:06 AM UTC

hlru wrote: post #80

higherpurpose wrote: post #72

Earlier quoted context omitted.

Moxie, the progress on TextSecure/Signal integration seems to have slowed down quite a bit (at least as seen from the outside). I think it's been almost a year since Signal for iOS came out - yet still no word on Signal for Android. What is taking so long, if you don't mind me asking? Is there some sort of Signal 3.0 overhaul planned for all the platforms along with a big launch? Also, I think you've been quite retre…

I used to be a "fan" of TextSecure, but have become disillusioned lately. The development have always been slow. Very few people use it, even among my geek friends. Convincing people to use it is hard as well. Confusion over what it does, having to give out their phone number and no desktop client doesn't help. When I'm actually in need of encryption it doesn't even work, since Google Play services are blocked in Chi…

There are too many different encrypted texting apps and no market winner. How does text secure compare to Bleep by the bitorrent people, for example?

For there to be enough users, we need public proclamations of support from Bruce Schneier or and maybe Moxie, celebs like that. Maybe interoperability.