which application should I use if I have an iphone? (and do not want to change the iphone)
what program would you recommend?
thank you very much
TextSecure's Private Group Messaging
81–90 of 109 posts
Re: TextSecure's Private Group Messaging
#82Earlier quoted context omitted.
I don't know, but I would have guessed that Google needs to know when it should deliver a message and where it should go, no? That is metadata in my definition.
GCM payloads are fully encrypted. Google would be able to tell that you are a TextSecure user who is receiving a message, but they cannot tell who the message is coming from nor can they look at its contents (obviously).
But crucially, this will still be vulnerable to timing attacks, if I'm not mistaken.
Re: TextSecure's Private Group Messaging
#83Earlier quoted context omitted.
Afaik TextSecures server infrastructure consists mainly of Google Play Services which comes at no financial costs for them but with the downside of depending on Google to temporary store encrypted text.
This isn't entirely true. A detailed explanation is available in the Open WhisperSystems Support Center [1] and several solutions are in the works. Google's GCM push messaging framework is used only for message delivery; the TextSecure server itself is open source [2]. [1] http://support.whispersystems.org/customer/portal/articles/1... [2] https://github.com/WhisperSystems/TextSecure-Server
It's true currently. At the support page you link first it is promised that it will be eventually changed but now: "Outside of Google's GCM, the fact is that there are no alternative push messaging frameworks for Android that can scale to the millions of users that TextSecure has. GCM requires Google Play."
Note, the page confirms: Google Play still has to be installed to use TextSecure on Android. That is the current state. Google has practically the root access to the every Android device which runs TextSecure.
Re: TextSecure's Private Group Messaging
#84I'm a big fan of TextSecure and recommended it to all my friends, both those in IT and 'normal' people. Usually, I managed to convince them that the open source nature of TextSecure and the crypto experts behind it (e.g. Moxie) make it more secure than Threema/... . However, the more sceptical ones among my friends always asked two questions, which I didn't have a good answer for: 1. What is TextSecure's business mod…
> 1. What is TextSecure's business model? Who pays for the server infrastructure? It's a good question. TextSecure is not a business, so we don't really have a business model in the traditional sense. Open Whisper Systems is a collective project made up of volunteers and a growing number of contributors, who are sometimes paid by donations ( https://whispersystems.org/blog/bithub/ ) and grants. Thus far, we've been a…
If it's not for profit, why don't you open source the server-side code too? Then those that are interested can rely on their own infrastructure.
Re: TextSecure's Private Group Messaging
#85Earlier quoted context omitted.
GCM payloads are fully encrypted. Google would be able to tell that you are a TextSecure user who is receiving a message, but they cannot tell who the message is coming from nor can they look at its contents (obviously).
But crucially, this will still be vulnerable to timing attacks, if I'm not mistaken.
What's the specific timing attack you're considering here?
Re: TextSecure's Private Group Messaging
#86which application should I use if I have an iphone? (and do not want to change the iphone) what program would you recommend? thank you very much
I think TextSecure is coming to iPhone soon, so just wait.
Re: TextSecure's Private Group Messaging
#87Earlier quoted context omitted.
> 1. What is TextSecure's business model? Who pays for the server infrastructure? It's a good question. TextSecure is not a business, so we don't really have a business model in the traditional sense. Open Whisper Systems is a collective project made up of volunteers and a growing number of contributors, who are sometimes paid by donations ( https://whispersystems.org/blog/bithub/ ) and grants. Thus far, we've been a…
If it's not for profit, why don't you open source the server-side code too? Then those that are interested can rely on their own infrastructure.
I think they do https://github.com/WhisperSystems/TextSecure-Server
Re: TextSecure's Private Group Messaging
#88This is great! And I love TextSecure.
But I wish it didn't send my contact list to its servers and store them in perpetuity [1]. Has it be considered to use:
1. text message history with a contact to derive a key between two contacts?
2. adding metadata to text messages to discover the sender uses TextSecure?
By (1), I mean Alice and Bob may already have exchanged several messages. I believe there is a lot of entropy in text messages. That should be leveraged during the key exchange. In addition, you'd also use WhisperSystems's servers as another channel, so the mere possession of the text history doesn't allow an attacker to guess the key.
(2) would only be useful when Alice sends her first text to Bob. She would for example hash(text_message + "I use TextSecure"), then append the encoded hash to the text and finally send it. The encoding could be white spaces for 0 and tabulations for 1. The size of the hash could be as small as 8 bits, because adding 8 trailing spaces/tabs to a text is so rare in real life. Once Bob receives the text, he can reasonably assume Alice uses TextSecure and then start the regular key exchange.
Re: TextSecure's Private Group Messaging
#89If it were to be HIPPA compliant, like Medigram, then it potentially could be useful for health practitioners as well.
Re: TextSecure's Private Group Messaging
#90The fact that transcript consistency is waved aside, despite being an essential property of a messaging protocol especially in a group context, is problematic, from my perspective. Consider a group chat between Alice, Bob, and Carol. With this protocol, Alice can selectively send different messages to Bob and Carol with both of them thinking they got the same message. For example, Alice can tell Bob "The funds were t…
This post says that TextSecure implements transcript consistency in the protocol, and in a fashion objectively superior to that of mpOTR: the TextSecure protocol can provide continuous consistency checks, while mpOTR can do so only when the session is torn down. What the TextSecure client does not yet do is provide a UI for that feature of the protocol. Further, it's hard to understand how transcript consistency coul…
The post only says that TextSecure have begun implementing this. The hash-parent-pointers is a good start and enables more functionality in this direction, but it doesn't mention other strategies that actually ensure the user's confidence in consistency. For example, checking for others' acknowledgements, heartbeats, or resending a potentially-inconsistent situation. None of this is that hard, but the post is missing important chunks, yet you are waving this over.
I will also say that whoever has been down-voting all of Nadim's votes (and it seems there's multiple people) ought to be ashamed of themselves. This is ridiculous.