Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Darpa wants to make a better, more secure, version of WhatsApp

trustedreviews.com

Post reply on HN
Print view View original

51–60 of 100 posts

Re: Darpa wants to make a better, more secure, version of WhatsApp

#51

Post by AmericanChopper »

YeahSureWhyNot wrote: post #14

Aside from the typical encryption worries here are some features I would love to see being offered on a alternative messenger app -ability to give out your alias or username to people to reach you on whatsapp instead of a phone number, something you can change later after banning the contact. -transcribe voice messages to enable search among them. -ability to hide the fact that i have listened to their voice message.…

>save my chat history in the cloud so that i dont lose everything when i move from iOS to Android or vise versa.

Implementing this could make key management either less secure, or more difficult for users. If the user still had access to both devices, it wouldn’t be too bad. But if you want the users to be able to ‘recover’ their message history on any device, then you’d need to use something like the mnemonic seed phrase, which isn’t an improvement in UX, or security.

The audio transcribing sounds difficult too, as you’d have to do it all client side if you wanted to preserve the security model.

Re: Darpa wants to make a better, more secure, version of WhatsApp

#52

Post by vel0city »

chipperyman573 wrote: post #43
IshKebab wrote: post #26

Earlier quoted context omitted.

Signal relies on an authoritative third party to exactly the same extent that WhatsApp does as far as I know.

Isn't signal peer to peer? How can there be an authoritative 3rd party, unless they get rid of all the advantages of using p2p? I don't know anything about signal, I just assumed it was exclusively p2p based on 30 seconds of googling. But assuming it is all p2p, my above statement should be correct.

Its end to end encrypted and ciphertexts aren't stored long term on Signal's servers, but Signal isn't truly p2p. To send a message a user encrypts the message using the keys for the user, sends them to Signal's servers to be queued, Signal delivers the encrypted message to the receiving user, the receiving user decrypts it. Phone calls would probably be the closest thing to p2p, but it still uses Signal's servers as a broker for connecting the two parties instead of some other form of discovery.

Signal also does not allow for third-party clients to connect to their hosted Signal servers. This further makes them an authoritative 3rd party, as you need to run the code approved by Signal to connect to Signal's servers to send messages to Signal users. Not that I am complaining about this structure, just sharing knowledge.

Re: Darpa wants to make a better, more secure, version of WhatsApp

#53

Post by mrguyorama »

sdinsn wrote: post #21
ralph84 wrote: post #4

Trust us, this totally isn't another Dual_EC_DRBG

DARPA's not doing this for shits and giggles; they want to use it (or later iterations of it) for military communication. They also want to open source it.

It's exactly how Tor came about.

Re: Darpa wants to make a better, more secure, version of WhatsApp

#54

Post by meruru »

AmericanChopper wrote: post #51
YeahSureWhyNot wrote: post #14

Aside from the typical encryption worries here are some features I would love to see being offered on a alternative messenger app -ability to give out your alias or username to people to reach you on whatsapp instead of a phone number, something you can change later after banning the contact. -transcribe voice messages to enable search among them. -ability to hide the fact that i have listened to their voice message.…

>save my chat history in the cloud so that i dont lose everything when i move from iOS to Android or vise versa. Implementing this could make key management either less secure, or more difficult for users. If the user still had access to both devices, it wouldn’t be too bad. But if you want the users to be able to ‘recover’ their message history on any device, then you’d need to use something like the mnemonic seed p…

Is there any issue with the Automatic Key Backup feature in Riot?

>Once enabled, your device will maintain a secure copy of its keys on your server. To ensure those keys can only ever be accessed by you, they are encrypted on your device, with a key that you either store yourself or secure with a passphrase and upload to your server. It is important to understand that to protect your privacy your keys will never touch the servers unencrypted. https://medium.com/@RiotChat/the-big-1-0-68fa7c6050be

Re: Darpa wants to make a better, more secure, version of WhatsApp

#55

Post by chipperyman573 »

vel0city wrote: post #52
chipperyman573 wrote: post #43

Earlier quoted context omitted.

Isn't signal peer to peer? How can there be an authoritative 3rd party, unless they get rid of all the advantages of using p2p? I don't know anything about signal, I just assumed it was exclusively p2p based on 30 seconds of googling. But assuming it is all p2p, my above statement should be correct.

Its end to end encrypted and ciphertexts aren't stored long term on Signal's servers, but Signal isn't truly p2p. To send a message a user encrypts the message using the keys for the user, sends them to Signal's servers to be queued, Signal delivers the encrypted message to the receiving user, the receiving user decrypts it. Phone calls would probably be the closest thing to p2p, but it still uses Signal's servers as…

Interesting, but wouldn't this method would still have its own set unsolvable of problems? For example I don't know if it would be possible to search on the server, since all messages are encrypted.

Re: Darpa wants to make a better, more secure, version of WhatsApp

#56

Post by jammygit »

77ko wrote: post #24
neonhat wrote: post #12

Earlier quoted context omitted.

How is Signal inferior to WhatsApp "in terms of functionality and usability"?

Just a few things: - Signal is a lot less "polished" - FB has spent tons more resources on making a slick streamlined easy to use interface. Even though signal looks similar its missing all the little things. - there is no easy to use backup. Whatsapp can backup to google drive or icloud and restore it on another phone. Signal you have to figure out how to deal with and transfer your backup file[1]. This isn't easy f…

Personally, I don't want backups. I don't want to worry whether some joke I made 10 years ago would look bad in a future data dump. If messages could self destruct after three years that would be lovely

Re: Darpa wants to make a better, more secure, version of WhatsApp

#57

Post by abalone »

This makes it sound like DARPA wants to take some commercially developed tech and adapt it to the military, but just for the record that grossly misstates the relationship and the general history of Silicon Valley.

Ever wonder how Siri got her name? From SRI International, a research org largely funded by the DoD.[1] DARPA is the origin of much of the tech, including secure Internet tech. Just one recent example: Tor[2]. It's developed at taxpayer expense and either given away to private industry or "transferred" for a pittance.

[1] https://en.wikipedia.org/wiki/SRI_International#Employees_an...

[2] https://www.onion-router.net/Sponsors.html

Re: Darpa wants to make a better, more secure, version of WhatsApp

#58

Post by AmericanChopper »

meruru wrote: post #54
AmericanChopper wrote: post #51

Earlier quoted context omitted.

>save my chat history in the cloud so that i dont lose everything when i move from iOS to Android or vise versa. Implementing this could make key management either less secure, or more difficult for users. If the user still had access to both devices, it wouldn’t be too bad. But if you want the users to be able to ‘recover’ their message history on any device, then you’d need to use something like the mnemonic seed p…

Is there any issue with the Automatic Key Backup feature in Riot? >Once enabled, your device will maintain a secure copy of its keys on your server. To ensure those keys can only ever be accessed by you, they are encrypted on your device, with a key that you either store yourself or secure with a passphrase and upload to your server. It is important to understand that to protect your privacy your keys will never touc…

This is probably the most elegant solution to achieve that functionality, but it still has a few security downgrades.

To back up the keys, you either need to manage a server yourself, or store them with a 3rd party that you trust.

To protect the backed up keys, you either need to manage another key, which just kicks the can down the road, or use a passphrase. If you give your users the option to protect their keys with a passphrase or with a mnemonic word list, a lot of them will pick the passphrase because it’s easier. It’s also less secure, especially if your users choose a weak passphrase, which a lot of them will.

I really like the whatsapp solution, because it has all the security under the hood and doesn’t let the users revert to less secure behaviour. It has an obvious UX tradeoff (with lost message history), but the alternative is to downgrade the key management UX to that of managing a cryptocurrency wallet.

Re: Darpa wants to make a better, more secure, version of WhatsApp

#59

Post by hutzlibu »

snazz wrote: post #22
Zhenya wrote: post #20

Earlier quoted context omitted.

A few points that I hope dont come off snarky 1) It's open source, so if you can code and have time, you can help. 2) Some small friction adders seem like a small price to pay to not have a facebook product installed on my phone and suck all my metadata down.

You’re right and I agree with you, but as to point 1, they don’t really act like a proper open source project and it seems more like a “source dump” than anything. It’s hard to compile on your own and they don’t like forks connecting to official servers either.

"and they don’t like forks connecting to official servers either"

Don't like? Well, nice words for activ blocking.

Re: Darpa wants to make a better, more secure, version of WhatsApp

#60

Post by truncate »

neonhat wrote: post #12
YeahSureWhyNot wrote: post #7

Earlier quoted context omitted.

I tried signal, much more inferior to WhatsApp in terms of functionality and usability

How is Signal inferior to WhatsApp "in terms of functionality and usability"?

My main complain is that whenever I start the desktop client after few days, it takes forever to load the old messages. I'm not sure, but I think it tries to download all messages and attachments before showing the UI, which can be potentially made faster by first trying to get the messages from person I'm trying to talk to and downloading attachments after text messages (Not sure about implication to security protocol here).
Post reply on HN