Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bonchat - client-side encrypted web chat for the truly paranoid

bonchat.org

Post reply on HN
Print view View original

31–40 of 51 posts

Re: Bonchat - client-side encrypted web chat for the truly paranoid

#31

Post by nickbw »

tptacek wrote: post #27
nickbw wrote: post #17

Earlier quoted context omitted.

Transparently? Without anyone being the wiser? The javascript is there for the auditing. The server-side code is not, but you're completely free to analyze the client-side code to verify that it never sends your password to the server. I've avoided minifying any of it (save jquery.js, which you can diff against the official release to make sure I haven't modified it) to make it more auditable. It's true that you prob…

"The javascript is there for the auditing" doesn't mean anything. Javascript is the worst possible environment for running crypto code: it's accepting and running code delivered over a network from untrusted hosts bound in all sorts of unpredictable ways to an extremely complicated markup format optimized for display, and , on top of that, almost every single feature in the language can be overridden from the code. E…

Your objections seem to boil down to a superstitious distrust of javascript. The web may be a messy platform, but javascript is not a particularly difficult language to read, and (if I may say so) the relevant chunks of bonchat are written in a pretty plain style.

I'm not making any promises of 100% perfect security with no effort and no room for attacks. Bonchat is merely an experiment in securing content against servers as well as network snoops.

I trust Linux more than Windows. I haven't personally audited all the code on my Linux box, and I don't know any one person who even has the skill to do so. But the code is there to be audited, which gives me more confidence than when I use a opaque operating system. The same applies here. Bonchat isn't perfect, it's just trying to be easier to keep honest than a normal web app.

Re: Bonchat - client-side encrypted web chat for the truly paranoid

#32

Post by tptacek »

nickbw wrote: post #31
tptacek wrote: post #27

Earlier quoted context omitted.

"The javascript is there for the auditing" doesn't mean anything. Javascript is the worst possible environment for running crypto code: it's accepting and running code delivered over a network from untrusted hosts bound in all sorts of unpredictable ways to an extremely complicated markup format optimized for display, and , on top of that, almost every single feature in the language can be overridden from the code. E…

Your objections seem to boil down to a superstitious distrust of javascript. The web may be a messy platform, but javascript is not a particularly difficult language to read, and (if I may say so) the relevant chunks of bonchat are written in a pretty plain style. I'm not making any promises of 100% perfect security with no effort and no room for attacks. Bonchat is merely an experiment in securing content against se…

You say "po-TAY-to", I say "po-TAH-to".

You say "to-MAY-to", I say "no thank you".

You say "supersititious distrust of Javascript", I say "a day job finding, breaking, and fixing the horrible things people try to get away with doing in Javascript". (Or, less charitably: "knowing how Javascript works in browsers.")

Trust me on this one. It's a cool little hack. It's even useful if you get rid of the vanity crypto. But you are asking for someone to write a really mean blog post about you and your actual understanding of how crypto works. That's drama you don't need. Don't bother with the AES stuff.

Re: Bonchat - client-side encrypted web chat for the truly paranoid

#33

Post by celoyd »

tptacek wrote: post #25
celoyd wrote: post #16

Earlier quoted context omitted.

No. Assuming it’s correctly implemented, it’s more secure than an identical app that sends the password over SSL to the server. This is not an innovation in cryptographic theory, but it’s something you don’t usually see in a web app.

It's something you don't see in web apps because the idea has been roundly rejected. Because in almost every setting where you could possibly implement crypto in JS, you have to run the app over HTTPS anyways, you gain only epsilon more security than if you would without added crypto --- and that's if you get everything right .

Sure. As this is designed now, HTTPS’s prevention of malicious JS insertion is the big weak point I see. But it’s implicitly asking what you could do if you found ways of getting around that, for example by using client-side caches of the code after a strict initial check.

The real wow for me here is that JS is fast enough to do AES-128 at comfortable chat speed. That’s really suggestive. It’s an epsilon, but it’s a fertile and interesting epsilon.

Re: Bonchat - client-side encrypted web chat for the truly paranoid

#34

Post by nickbw »

tptacek wrote: post #32
nickbw wrote: post #31

Earlier quoted context omitted.

Your objections seem to boil down to a superstitious distrust of javascript. The web may be a messy platform, but javascript is not a particularly difficult language to read, and (if I may say so) the relevant chunks of bonchat are written in a pretty plain style. I'm not making any promises of 100% perfect security with no effort and no room for attacks. Bonchat is merely an experiment in securing content against se…

You say "po-TAY-to", I say "po-TAH-to". You say "to-MAY-to", I say "no thank you". You say "supersititious distrust of Javascript", I say "a day job finding, breaking, and fixing the horrible things people try to get away with doing in Javascript". (Or, less charitably: "knowing how Javascript works in browsers.") Trust me on this one. It's a cool little hack. It's even useful if you get rid of the vanity crypto. But…

If you would like to propose improved crypto code, I would love it. Honestly.

But "javascript is a messy language" is not inherently an attack. You can obfuscate just about any language. Do you actually have an attack in mind based on the fact that it's implemented in the browser?

It's true I don't have a deep understanding of the AES algorithms, and the AES code, as stated in the attribution, isn't even mine. Again, I'd love improved code. But you have yet to make any rational argument that javascript in the browser is inherently unsuited to encryption.

I completely agree that the many attempts to make SSL irrelevant by doing all the encryption in JS (and usually horribly naive JS) are foolish. That's not the point. Bonchat isn't a shopping cart or a mail reader. SSL is for securing communication to the server. Bonchat is an experiment in securing communication against the server. Do you have a better way than client-side encryption?

Re: Bonchat - client-side encrypted web chat for the truly paranoid

#35

Post by sweis »

nickbw wrote: post #30
sweis wrote: post #26

This is insecure. It is using Unix time as a nonce for CTR mode: https://bonchat.org/js/aes.js Clients may send messages encrypted with the same keys and overlapping counters. This could allow the server to recover information on the message contents. There's also no authentication on the encrypted messages. A corrupt server can alter messages sent to a valid client without detection. This is trivial to do in counter…

It's using millisecond precision time for the nonce, yes. Nonce collisions in a normal volume chat are unlikely. If you'd like to suggest improved counter code, however, I'm all ears. :) A corrupted server could alter messages without the key if it had both the plain and encrypted versions of a text. But to get that, the javascript would have to be compromise, and at that point the server might as well just steal the…

It's not just two messages colliding on the exact millisecond. They can collide on subsequent blocks. So if Alice sends a 10 block message that starts at T_0 and Bob sends a 5 block message that starts at T_5, then the server learns information about half of Alice's plaintext and all of Bob's. Each client should use an independently-chosen and unpredictable IV.

You are incorrect on your statement that the corrupted server needs both the plain and encrypted versions of a message to send bogus messages. Without authentication, the server can flip arbitrary bits of a CTR message. This opens up several types of attacks. You should apply a MAC to the ciphertext.

I think that the encryption needs to happen entirely in the client and you can't rely on code downloaded from an untrusted server.

Re: Bonchat - client-side encrypted web chat for the truly paranoid

#37

Post by SamReidHughes »

nickbw wrote: post #34
tptacek wrote: post #32

Earlier quoted context omitted.

You say "po-TAY-to", I say "po-TAH-to". You say "to-MAY-to", I say "no thank you". You say "supersititious distrust of Javascript", I say "a day job finding, breaking, and fixing the horrible things people try to get away with doing in Javascript". (Or, less charitably: "knowing how Javascript works in browsers.") Trust me on this one. It's a cool little hack. It's even useful if you get rid of the vanity crypto. But…

If you would like to propose improved crypto code, I would love it . Honestly. But "javascript is a messy language" is not inherently an attack. You can obfuscate just about any language. Do you actually have an attack in mind based on the fact that it's implemented in the browser ? It's true I don't have a deep understanding of the AES algorithms, and the AES code, as stated in the attribution, isn't even mine. Agai…

Do you actually have an attack in mind based on the fact that it's implemented in the browser?

You, the owner of the server, change the code. That's the attack. There's no way for me to tell my friend Charlie that he can use the service and get secure communication, unless he installs a plugin for his browser to verify that the server has not changed the data it sends the user from the time when I verified the correctness of the code. And if he has to install a plugin to safely use this service, which is now never permitted to change its code, he might as well just install a plugin that has the code, or install a separate application for this purpose.

Re: Bonchat - client-side encrypted web chat for the truly paranoid

#38

Post by Rhapso »

JoshCole wrote: post #21

https://bonchat.org/cb9d007ac6e12605 pass: hacker news

as long as I am logged in, the password "new_pass" will also allow you to join this chat (abet with a messed up user list, but all text is readable) This is done by adding javascript to my username that changes the password in all those who log in normally.

Re: Bonchat - client-side encrypted web chat for the truly paranoid

#40

Post by nickbw »

Rhapso wrote: post #38
JoshCole wrote: post #21

https://bonchat.org/cb9d007ac6e12605 pass: hacker news

as long as I am logged in, the password "new_pass" will also allow you to join this chat (abet with a messed up user list, but all text is readable) This is done by adding javascript to my username that changes the password in all those who log in normally.

Heehee. Nice!
Post reply on HN