Valid Signal privacy issues shrugged off while patches quietly rolled out • Hacker News Board

Re: Valid Signal privacy issues shrugged off while patches quietly rolled out

#31

Post by goodpoint » Sat, Jun 05, 2021, 6:40 PM UTC

LurkersWillLurk wrote: post #15

tptacek wrote: post #11

Am I misreading this, or is this the Signal version of the bug bounty classic "user impersonation vulnerability: if I steal this session token, I can impersonate the user who it belongs to"?

No, you're absolutely right. The author complains that with physical possession of the device that it's possible to transfer Signal's private key material to a new device, leaving the old safety number intact. The author apparently expects the safety number to change in order to alert the person on the other end that there "might be a hostage situation," evidently not realizing that the attacker could just, well, use…

No, the author is right.

There are many cases where an attacker can access a device for a short time and/or without the owner realizing that the phone was tampered with.

Re: Valid Signal privacy issues shrugged off while patches quietly rolled out

#32

Post by UncleMeat » Sat, Jun 05, 2021, 6:44 PM UTC

pennyintheslot wrote: post #18

LurkersWillLurk wrote: post #15

Earlier quoted context omitted.

No, you're absolutely right. The author complains that with physical possession of the device that it's possible to transfer Signal's private key material to a new device, leaving the old safety number intact. The author apparently expects the safety number to change in order to alert the person on the other end that there "might be a hostage situation," evidently not realizing that the attacker could just, well, use…

Well, if I assume that I just got temporary access to someone’s unlocked device, then it would probably be a lot more convenient for me to quickly transfer the account to one of my own devices and then access it from there instead of accessing it from my targets device which I might lose access to any moment. So from that point of view it would be legitimate to argue that I might want to get notified if one of my con…

Configurable security posture is the sort of thing that got RSA into trouble. For the huge majority of users, opinionated security is a much better approach, even ignoring the maintenance problems of having special features.

The temporary access threat model is a common criticism that people use, but it is largely incoherent. Once you are making human judgements like "enough time to transfer a signal account but not enough time to install a rootkit" things quickly break down into meaninglessness.

Re: Valid Signal privacy issues shrugged off while patches quietly rolled out

#33

Post by staticassertion » Sat, Jun 05, 2021, 6:46 PM UTC

goodpoint wrote: post #31

LurkersWillLurk wrote: post #15

Earlier quoted context omitted.

No, you're absolutely right. The author complains that with physical possession of the device that it's possible to transfer Signal's private key material to a new device, leaving the old safety number intact. The author apparently expects the safety number to change in order to alert the person on the other end that there "might be a hostage situation," evidently not realizing that the attacker could just, well, use…

No, the author is right. There are many cases where an attacker can access a device for a short time and/or without the owner realizing that the phone was tampered with.

Just because that's possible doesn't mean that it's within Signal's threat model.

Re: Valid Signal privacy issues shrugged off while patches quietly rolled out

#34

Post by lucb1e » Sat, Jun 05, 2021, 6:56 PM UTC

seanieb wrote: post #6

All that text for a feature that no one, including the author uses correctly. Messaging your mates to reassure them everything is correct via Signal after you update your device and your safety number changes is pointless. The main function of safety numbers is to theoretically prevent mass mitm of Signal.

Or targeted, for that matter. But yeah, either way.

Re: Valid Signal privacy issues shrugged off while patches quietly rolled out

#35

Post by jimio » Sat, Jun 05, 2021, 7:01 PM UTC

tptacek wrote: post #11

Am I misreading this, or is this the Signal version of the bug bounty classic "user impersonation vulnerability: if I steal this session token, I can impersonate the user who it belongs to"?

no session tokens involved here; we talk about the crypto behind device-to-device transfer in this blog post (https://signal.org/blog/ios-device-transfer/)

and the concepts and UX research surrounding Safety Numbers (what they are, how they're represented, and how we found they bring the most utility to the platform) in these 2016 & 2017 blog posts:

https://signal.org/blog/safety-number-updates/ https://signal.org/blog/verified-safety-number-updates/

Re: Valid Signal privacy issues shrugged off while patches quietly rolled out

#36

Post by lucb1e » Sat, Jun 05, 2021, 7:08 PM UTC

RL_Quine wrote: post #7

nosmokewhereiam wrote: post #2

Does the safety number count as a sort of hash in this case? Or is it absolutely nothing like an MD-5?

The "safety number" also encodes both participants phone numbers (the verifier and the person to be verified). So you would be a little foolish to publish it in say, a blog post if you weren't intending those phone numbers to be public information. I'm also very amused that the author censored part of the QR code, but not the human readable text below it containing the exact same data.

> The "safety number" also encodes both participants' phone numbers

Um, not that I know of. A quick check, though, the QR code is a bunch of binary data, so I dove into the source code: https://github.com/signalapp/libsignal-client/blob/4446b648f...

> very amused that the author censored part of the QR code, but not the human readable text below it containing the exact same data

So what is it now, does it contain the phone numbers or not? Am I allowed to be 'very amused' at you for also not knowing what's in the QR code? :-)

Any phone numbers are censored in the screenshots, only the safety number is not. But the QR code doesn't contain the phone number, as you just saw in the source code (assuming I correctly identified the relevant part, I just looked for uses of qr codes, found getScannableFingerprint and followed the trail through libsignal from there).

Strictly speaking, though, the QR is not the same as the text below: the safety number below doesn't appear to include a version number (same file, lines 14-16). But that's just a technicality.

Either way, I was also amused as my understanding was also that the QR code is the same as the 'safety number' shown below. What confuses me is that the author knows what a CVE is and knows all the right channels to do responsible disclosure, but is apparently confounded by the situation that no key change is shown when they key didn't change. I am rather happy that you can keep your key material: I'd go insane if I had to reverify everyone who adds a new device legitimately (try Wire if you want that experience), I'd certainly stop doing it for any but the most stable and important of contacts. I'd also somehow need to establish a second encrypted channel to exchange the new key material because I don't meet most people in real life these days.

Re: Valid Signal privacy issues shrugged off while patches quietly rolled out

#37

Post by lucb1e » Sat, Jun 05, 2021, 7:18 PM UTC

woodruffw wrote: post #3

nosmokewhereiam wrote: post #2

Does the safety number count as a sort of hash in this case? Or is it absolutely nothing like an MD-5?

I don’t know if it’s actually a hash, but it’s probably some kind of diffuse one-way function: it would need to be impossible to pre-image or reproduce from a different input in order to serve its purpose. Edit: Signal’s blog refers to it as a hash[1]. It’s apparently essentially just a hash of the contact’s public key, so rotating that causes the hash change. [1]: https://signal.org/blog/safety-number-updates/

> essentially just a hash of the contact’s public key

and yours*. They're concatenated with deterministic sorting such that they are the same on both devices.

Which is a big pain because that means I can't simply tell everyone my public key, I have to explain that half the number is their own key and that they can ignore the non-matching part, which is dangerous advice... it could have been so simple but moxie is moxie

Re: Valid Signal privacy issues shrugged off while patches quietly rolled out

#38

Post by mindslight » Sat, Jun 05, 2021, 7:24 PM UTC

UncleMeat wrote: post #32

pennyintheslot wrote: post #18

Earlier quoted context omitted.

Well, if I assume that I just got temporary access to someone’s unlocked device, then it would probably be a lot more convenient for me to quickly transfer the account to one of my own devices and then access it from there instead of accessing it from my targets device which I might lose access to any moment. So from that point of view it would be legitimate to argue that I might want to get notified if one of my con…

Configurable security posture is the sort of thing that got RSA into trouble. For the huge majority of users, opinionated security is a much better approach, even ignoring the maintenance problems of having special features. The temporary access threat model is a common criticism that people use, but it is largely incoherent. Once you are making human judgements like "enough time to transfer a signal account but not…

I don't really like trusted computing, but it is part of the mobile security model. There's a distinction between Signal deliberately facilitating extraction of the keys, and having to break a device's security to do so.

Re: Valid Signal privacy issues shrugged off while patches quietly rolled out

#39

Post by lucb1e » Sat, Jun 05, 2021, 7:27 PM UTC

edent wrote: post #10

I raised a similar issue 4 years ago - https://github.com/signalapp/Signal-Android/issues/6703 Signal used to silently fail if you changed device. I guess not much has changed.

That looks to be an entirely different issue: you're reporting an error that says the client is unable to decrypt a message, not that the key wasn't rotated upon reinstallation or device transfer. Ctrl+f "safe"(ty number) does not even appear on the page.

Re: Valid Signal privacy issues shrugged off while patches quietly rolled out

#40

Post by upofadown » Sat, Jun 05, 2021, 7:47 PM UTC

sneak wrote: post #28

thebeardisred wrote: post #4

Earlier quoted context omitted.

My understanding was that it was a fingerprint of the public key, much like an SSH fingerprint.

It's specific to the two public keys involved in that conversation. It was renamed from "fingerprint" because to those unfamiliar with cryptography, "fingerprints" are things used when a crime has been committed. There was a study out some years ago that illustrated that most of the crypto jargon in use is not helpful in conveying mental models to laypeople.

As much as I support the fight against crypto jargon, I don't think the term "safety number" really works for this. You don't risk a broken leg if you don't verify your safety numbers. The term "safety" is already one metaphor away from the actual issue.

At least "fingerprint" directly maps to the idea of an aspect of something that relates to the identity of someone.

I dunno, could you call this a "serial number"? The root problem here is that our culture does not have the idea of a cryptographic identity in the first place.