Live data from Hacker News

RFC 9420 a.k.a. Messaging Layer Security

blog.phnx.im

21–30 of 35 posts

Re: RFC 9420 a.k.a. Messaging Layer Security

#21

At the risk of falling afoul of the site guidelines, can I complain about an un common annoyance? Apparently this blog pulls a Facebook, or more precisely a fbclid, and adds ref=blog.phnx.im as a query parameter to every link. This seems less than fitting for a post on a privacy technology, and actually breaks the link to the IETF BoF minutes[1]. [1] https://datatracker.ietf.org/meeting/101/materials/minutes-1...

That's something ghost.org does by default. I unknowingly ran into the same issue for my blog.

Re: RFC 9420 a.k.a. Messaging Layer Security

#22
post #12
post #8

Earlier quoted context omitted.

I wonder how Google would actually implement that, given that "Google Messages", as far as I can tell, isn't really a "platform" (as stated in the linked article) but rather a client for RCS, which needs mobile operator support to work on Android, and to my knowledge does not work at all on iOS.

Yeah no. Google Messages (almost) always go through Google services, not carriers. They are definitely their own platform.

That's a vast oversimplification and is not really telling the whole story

Re: RFC 9420 a.k.a. Messaging Layer Security

#23
post #4

Full standard: https://datatracker.ietf.org/doc/html/rfc9420 With the EU's DMA requirements coming up, this is a major candidate for a standard protocol for messenger interoperability. There's no legal requirement to support it, but implementing an existing standard that supports end-to-end encryption seems like a much cheaper and safer method than building your own. Of course actual interoperability will depend on M…

Thanks. I would have give with the original link.

Re: RFC 9420 a.k.a. Messaging Layer Security

#24
post #20
post #9

What is the difference with the Matrix protocol? Matrix is already open-source, there are libraries publicly available that implement it, both for clients and serves, in different languages. Why not just adopting it?

One big difference is that the authors of this protocol have probably spent a lot of time at IETF meetings

You said that like it’s a bad thing?

Re: RFC 9420 a.k.a. Messaging Layer Security

#25

At the risk of falling afoul of the site guidelines, can I complain about an un common annoyance? Apparently this blog pulls a Facebook, or more precisely a fbclid, and adds ref=blog.phnx.im as a query parameter to every link. This seems less than fitting for a post on a privacy technology, and actually breaks the link to the IETF BoF minutes[1]. [1] https://datatracker.ietf.org/meeting/101/materials/minutes-1...

[deleted]

Re: RFC 9420 a.k.a. Messaging Layer Security

#26
post #9

What is the difference with the Matrix protocol? Matrix is already open-source, there are libraries publicly available that implement it, both for clients and serves, in different languages. Why not just adopting it?

The Matrix spec defines everything about how communication should happen—port discovery, federation, transport, wire formats, encodings, schemas, addresses for people, group membership, reconciliation of parallel histories, ..., and, yes, end-to-end cryptography. MLS is just the end-to-end cryptography part, how to turn it into bits, and a general idea of where the underlying network should deliver those bits. Nothin…

You can have a global clock courtesy of the US space force.

Re: RFC 9420 a.k.a. Messaging Layer Security

#27

At the risk of falling afoul of the site guidelines, can I complain about an un common annoyance? Apparently this blog pulls a Facebook, or more precisely a fbclid, and adds ref=blog.phnx.im as a query parameter to every link. This seems less than fitting for a post on a privacy technology, and actually breaks the link to the IETF BoF minutes[1]. [1] https://datatracker.ietf.org/meeting/101/materials/minutes-1...

Thank you for bringing this up! It appears ghost has this turned on by default, and I turned it off now. Sorry for any inconvenience. For context, we had an internal debate whether we should host the blog ourselves, but ultimately decided to use ghost. It ticked a few boxes, being open-source and run by a non-profit. The fact that it would do outbound link tagging by default really comes as a surprise, so thanks again for bringing it up.

Re: RFC 9420 a.k.a. Messaging Layer Security

#28
post #2

Does anyone know the status with respect to support for deniability / repudiation? I can't tell where they landed, and they seem to have deleted the paragraph from prior drafts that mostly left me more confused. https://datatracker.ietf.org/doc/html/draft-ietf-mls-archite... Previously, their designs had explicitly lacked this feature, and they said they actively didn't want it, citing "terrorism", resulting in argum…

MLS and blog author here. I've been a proponent of deniability within the MLS WG and there have been quite a few online and offline discussion about it. Personal opinions aside, deniability remains a divisive property. Some people think it is important, many people do not care about it, and a few even think it is harmful. That sets it apart from properties like say confidentiality that is far more appealing to most people. It also remains largely theoretical, in that the lack of deniability hasn't had tangible negative consequences so far (the DKIM case aside, but that doesn't translate 1:1 to messaging). Deniability is also used as a colloquial term, when there is much more nuance to it (what exactly is deniable? what capabilities does the attacker have? etc.). Finally, deniability in protocols like Signal clearly have limitations and can be circumvented with moderate effort as explained in [1]. So the reason why deniability didn't make it into core MLS is rather banal: there was not enough traction.

That being said, there has been a low key effort to come up with an extension to MLS to introduce some notion of deniability. It is not published yet, but I will probably talk more about it at the upcoming MLS session at IETF117.

[1] https://asokan.org/asokan/research/deniability.pdf

Re: RFC 9420 a.k.a. Messaging Layer Security

#29
post #21

At the risk of falling afoul of the site guidelines, can I complain about an un common annoyance? Apparently this blog pulls a Facebook, or more precisely a fbclid, and adds ref=blog.phnx.im as a query parameter to every link. This seems less than fitting for a post on a privacy technology, and actually breaks the link to the IETF BoF minutes[1]. [1] https://datatracker.ietf.org/meeting/101/materials/minutes-1...

That's something ghost.org does by default. I unknowingly ran into the same issue for my blog.

How does one turn this off?

Re: RFC 9420 a.k.a. Messaging Layer Security

#30
I was recently shocked to discover media attachments sent on Signal are uploaded to either Google Cloud Storage or some other service sitting behind CloudFlare. The recipient device(s) fetch the uploaded keys to access the images. The net effect is that there is almost certainly a log file somewhere that correlates the IP addresses/user agents of conversation participants for a very large subset of all Signal users

The point is mostly there are plenty of security issues with existing systems that probably aren't easily fixed with another layer of crypto woowoo, and it makes me uncomfortable that crypto is used to justify marketing these systems as secure. How do you explain to a user that the JPEG compression implementation on their particular phone with their particular photograph has a unique on-the-wire transfer size that may already be enough to correlate them with their recipient? etc

Post reply on HN