Messenger systems compared by security, privacy, compatibility, and features • Hacker News Board

Re: Messenger systems compared by security, privacy, compatibility, and features

#161

Post by lrvick » Tue, Oct 16, 2018, 7:50 PM UTC

lvh wrote: post #146

lrvick wrote: post #115

Earlier quoted context omitted.

Please make comments on individual cells for improvements to be seen/added more easily. This is obviously big research undertaking that got thrown together last weekend :) > Another example: "open server" and "on-premise" says nothing about whether or not you really want to run one of those instances. It just says that hypothetically one could. I know a number of people that run matrix.org servers for personal use an…

In order to comment on individual cells, we appear to first have to have an argument about how audits work. You say WhatsApp can only "claim" certain features as a consequence of it being closed source, but that's because of a misunderstanding about how audits work. In a backchannel, as a consequence of this HN article, someone (names withheld to protect the guilty, they can identify themselves if they'd like) starte…

Even if they release all their code at this moment to a dozen third party code auditing firms, they can then undermine all the verified security with the next closed binary they release.

I will never use Signal with their current direction and don't recommend anyone use it, but they get credit where it is due. They actually offer source code for their walled garden and allow that their basic crypto can -generally- be verified except for extreme cases like my other comment.

Allo, Whatsapp and other closed systems that give you no reason to trust them other than faith in the people advocating them and that their engineers got it 100% right. Their claims can't be verified so they can only be marked as just that, claims.

Sure, plenty of obvious flaws can be spotted without source code access, but many are hard to find even if you -do- have source code to the point they would probably have never been found were they not open to allow the right set of eyes to eventually read the right section of code (Heartbleed etc).

I found random number generation flaws in Terraform I would of -never- found without source code access. It is for this reason I trust Terraform and Hashicorp quite a bit. They normally get it right, but are not afraid to have other people audit and point out flaws because they don't have this arrogant idea their engineers will get everything right 100% of the time.

Security is -hard- and anyone that thinks they can get it right with a SPOF closed source approach is more interested in marketshare than security.

Trust, but verify. Likewise if you are not even allowed to verify, you should instantly distrust.

Re: Messenger systems compared by security, privacy, compatibility, and features

#162

Post by lvh » Tue, Oct 16, 2018, 7:54 PM UTC

lrvick wrote: post #161

lvh wrote: post #146

Earlier quoted context omitted.

In order to comment on individual cells, we appear to first have to have an argument about how audits work. You say WhatsApp can only "claim" certain features as a consequence of it being closed source, but that's because of a misunderstanding about how audits work. In a backchannel, as a consequence of this HN article, someone (names withheld to protect the guilty, they can identify themselves if they'd like) starte…

Even if they release all their code at this moment to a dozen third party code auditing firms, they can then undermine all the verified security with the next closed binary they release. I will never use Signal with their current direction and don't recommend anyone use it, but they get credit where it is due. They actually offer source code for their walled garden and allow that their basic crypto can -generally- be…

> Allo, whatsapp and other closed systems that give you no resaon to trust them other than faith in the people shilling them. Their claims can't be verified so they can only be marked as just that, claims.

I have repeatedly refuted that point and you have repeatedly ignored it.

> Sure, plenty of obvious flaws can be spotted without source code access, but many are hard to find even if you -do- have source code to the point they would probably have never been found were they not open to allow the right set of eyes to eventually read the right section of code (Heartbleed etc).

You are implying that no source code prevents you from finding obvious flaws, and I have given you two counterexamples in a messaging service that came up in this thread that I had never heard of before. That was casual peeking, not even a serious audit.

> I found random number generation flaws in Terraform I would of -never- found without source code access.

Do you professionally audit software? The fact that you can't find a bug without source does not mean that no-one can. Project Zero finds bugs in Windows and Edge every other day that are a lot more complicated than figuring out what RNG Terraform uses and how Terraform uses it.

> Security is -hard- and anyone that thinks they can get it right with a SPOF closed source approach is more interested in marketshare than security.

Since you've impugned my motives in two separate places in that post (referring to me as a "shill"), I am no longer interested in discussing this with you. I'm sure people can make up their minds from the thread.

Re: Messenger systems compared by security, privacy, compatibility, and features

#163

Post by egypturnash » Tue, Oct 16, 2018, 8:06 PM UTC

So many competing, incompatible protocols. So, so many.

Also this is lacking a column for "stickers". Seriously they are one of the things that has my and my crowd using Telegram, especially since it's really easy to make your own custom sets instead of relying on whatever they pay someone to draw for you.

Re: Messenger systems compared by security, privacy, compatibility, and features

#164

Post by craftyguy » Tue, Oct 16, 2018, 8:11 PM UTC

lvh wrote: post #153

craftyguy wrote: post #120

Earlier quoted context omitted.

That argument goes for every floss app. If you download their binaries from a play store (that is not f-droid), there's no guarantee that what you get is the same as what the source code would produce. f-droid is not a 100% guarantee either (e.g. not all apps support reproducible builds), but it's certainly better than the mainstream play stores.

As I've mentioned elsewhere: this is why you audit the apk, not the claimed source.

This is why you only use app stores that support reproducible builds.

Re: Messenger systems compared by security, privacy, compatibility, and features

#165

Post by lrvick » Tue, Oct 16, 2018, 8:12 PM UTC

lvh wrote: post #162

lrvick wrote: post #161

Earlier quoted context omitted.

Even if they release all their code at this moment to a dozen third party code auditing firms, they can then undermine all the verified security with the next closed binary they release. I will never use Signal with their current direction and don't recommend anyone use it, but they get credit where it is due. They actually offer source code for their walled garden and allow that their basic crypto can -generally- be…

> Allo, whatsapp and other closed systems that give you no resaon to trust them other than faith in the people shilling them. Their claims can't be verified so they can only be marked as just that, claims. I have repeatedly refuted that point and you have repeatedly ignored it. > Sure, plenty of obvious flaws can be spotted without source code access, but many are hard to find even if you -do- have source code to the…

I changed the word "shill" in an edit right after I posted as that was unfair/unhelpful and realized you might think it was directed at you. It was not. I welcome this type of debate personally.

> Do you professionally audit software?

I do as a matter of fact. I'll be honest it is normally much easier in closed products as I know what to look for. It is generally much harder to find flaws in popular open source systems as someone else has usally long beaten me to the low hanging fruit in critical codepaths.

I have been burned and seen others burned so many times by closed software and teams that ship security regressions that I now personally use only open tools I can audit at some level, or can audit the auditing and reproducible build process. I have seen "security" companies cut corners too many times in order to feature farm to trust anything that won't let me see the source code.

I have even professionally audited multiple systems on the spreadsheet myself, some of which I am aware of vulnerabilities for currently under embargo.

So far you have cited examples which I not only didn't ignore but responded to in the form of counter examples.

This is however turning into a open source vs closed source debate with subjective evidence, which in the end always boils down to if you have blind faith in a small group of people or not.

In the spreadsheet I tried to only include things that could be fairly objective, but when we get into concepts of trust of binaries and their authors, it gets muddy to be sure, and we will end up choosing paths based on our own threat profiles and experience.

This is why I tried to include -everything- in the spreadsheet I am aware of, so people with threat profiles different than mine can make informed choices.

Re: Messenger systems compared by security, privacy, compatibility, and features

#166

Post by lvh » Tue, Oct 16, 2018, 8:14 PM UTC

craftyguy wrote: post #164

lvh wrote: post #153

Earlier quoted context omitted.

As I've mentioned elsewhere: this is why you audit the apk, not the claimed source.

This is why you only use app stores that support reproducible builds.

That only works if you trust the store, and you somehow only know how to audit from source. Neither is true for professional audits: you'd generally start from the APK anyway, even if it's minified, and in many cases you'd actually get the source (which is an optimization only, e.g. to make bug descriptions better/faster).

Re: Messenger systems compared by security, privacy, compatibility, and features

#167

Post by lrvick » Tue, Oct 16, 2018, 8:29 PM UTC

lvh wrote: post #159

lrvick wrote: post #155

Earlier quoted context omitted.

These are problems other tools have solved, without having to resort to a walled garden network or having a SPOF. Sure, maybe Signal has done some useful technicality -legal- protections for now for US citizens, but what happens when a state actor threatens to kill the family of a Signal employee if they don't ship a very subtle compromise in how their binaries source random numbers, or if they don't sell the metadat…

You asked "what valuable thing has Signal done" and offered to track them, and I responded with two examples. "What if someone threatens a Signal employee" is a moved goalpost. Who else has solved private contact discovery? Conversely: who else has solved Mossad as a threat model? I have repeatedly pointed out the Signal subpoena elsewhere, which is responsive to a number of your comments. If your threat model includ…

I will look closer into private contact discovery across messengers, sorry for rushing over that point.

I did try to respond to the sopoena comment in that that is only of limited value. A blackhat will proably have an easier time getting to servers than a lawyer with Signals setup, and I do credit them with providing a substantially better assurances than say Whatsapp... but still not good enough for my particular threat profile.

Personally I don't like using permanant non anonymous identifiers like phone numbers so I would not use the feature as they have implemented it, but that doesn't mean it does not have some value for some use cases worh exploring.

That is at least something that can be looked at objectivly in the scope of the spreadsheet.

Re: Messenger systems compared by security, privacy, compatibility, and features

#168

Post by lrvick » Tue, Oct 16, 2018, 8:34 PM UTC

pvg wrote: post #160

lrvick wrote: post #155

Earlier quoted context omitted.

These are problems other tools have solved, without having to resort to a walled garden network or having a SPOF. Sure, maybe Signal has done some useful technicality -legal- protections for now for US citizens, but what happens when a state actor threatens to kill the family of a Signal employee if they don't ship a very subtle compromise in how their binaries source random numbers, or if they don't sell the metadat…

but what happens when a state actor threatens to kill the family [...] No messenger system protects you against that. You seem to be going through the full sequence of well-known poor ways to evaluate the security of something like an instant messenger, starting with the feature matrix, going through 'it can't be secure if it's not open source/self-hosted/federated' and reaching the Mossad. Which is a worthwhile and…

I actually think it is.

Journalists covering sensitive topics in sensitive areas -must- care about these questions.

If you are using something anonymous, fully end to end encrypted with open source reproducible verified builds on decentralized servers, you can greatly limit the risk of having a central third party that can be compelled to act against your interests.

Maybe in the US we don't think we need those sorts of protections, but we should consider the worst cases when designing security systems, and ensure no one single compromised person has the ability to backdoor thousands or millions of people.

Not everyone cares about this sort of thing though, and there are 70+ other options listed with various tradeoffs.

Re: Messenger systems compared by security, privacy, compatibility, and features

#169

Post by mahemm » Tue, Oct 16, 2018, 8:40 PM UTC

proaralyst wrote: post #2

I would like to use Riot/Matrix but its UI (at least on Android) is terrible. I can't convince non-technical friends & family to switch. Part of the problem is the inability to assign nicknames to contacts, so you have to remember everyone's Matrix ID.

Why not use Signal? Better privacy guarantees and the same underlying protocol.

Re: Messenger systems compared by security, privacy, compatibility, and features

#170

Post by vader1 » Tue, Oct 16, 2018, 8:41 PM UTC

lvh wrote: post #154

vader1 wrote: post #151

Earlier quoted context omitted.

The difference of course being that WhatsApp is closed source, and they can push any kind of change without anyone noticing. If the client is open source, you can verify exactly what it does. Compile the app yourself or download it from F-Droid and you can be sure that the binary you get matches those sources. Sure you can argue this all the way down to "Trusting Trust", but that doesn't really make sense when compar…

As I've mentioned elsewhere: you do not need the source code to verify what something does, that's not generally how you'd audit this. Audits may be source-assisted, but you'd still bang at it from the actual binary. If you're more comfortable reading source and compiling from scratch then fine, do that: but we should not pretend that Conversations on the Play Store is generally more trustworthy than anything else be…

I didn't say that Conversations from the Play Store is significantly more trustworthy in this regard than WhatsApp from the Play Store. I said that an app - such as Conversations - that you can build from source or download from F-Droid is more trustworthy than the Play Store version.

WhatsApp is a proprietary app and as such it's only available on the Play Store. Conversations is open source so you can download it from the Play Store, or from F-Droid, or compile it from source. So if you care, you can be significantly more sure that your version of Conversations "does what it says" than you can be of WhatsApp.