3 ms·

The server code is available, people can and do run their own. Several other parties not affiliated with Whisper have written compatible clients. Lots of people

by Canada 11y ago

The server code is available, people can and do run their own. Several other parties not affiliated with Whisper have written compatible clients. Lots of people are actively looking at and contributing to the official clients. It really is private end to end. The server is merely a router and keyserver.

acqq 11y ago
If I understand, somehow the server delivers the initial keys to clients ("to make the process easier"). What happens if some evildoer takes control of Text Secure servers? Can the evildoer read all the communication from that point on, provided he can also capture the encrypted traffic (which is reasonable to assume)? The protocol "safe from the server turning malicious" would also be good even if I'd run my own server to prevent Text Secure servers getting all the contacts.
- Canada 11y ago
  The server has the keys in roughly the same way a PGP keyserver has the keys. They're all public keys, and they would be sent in the clear anyway, however storing them with the server enables senders to send to recipients who are offline. The server can't make use of them to read any communication. It's possible for the server to hand out the wrong key for a user, but the clients detect that. There are other ways for users to mount impersonation attacks without server cooperation anyway. The server also knows who talks to who, when, how big those messages are, and the number of attachments and their sizes. An adversary who can passively watch the server's encrypted traffic will also be able to determine some of these things, but not as easily or precisely. All the TextSecure server is really trusted to do is a good job of confirming a user who purports to have a certain phone number really does control that number at registration time.
  - acqq 11y ago
    So if the server is under the control of the attacker and I use TextSecure expecting to "just work" (not already having the private key of my contact) I can actually communicate with the attacker instead of with my contact? And if I already have the private key of my contact, why do I need the TextSecure server at all?
    - Canada 11y ago
      You never have the private key of your contact. Private keys are private. But I get what you're saying. The system is trust on first use, so your client will accept whatever the server gives you as the identity. But that's how it is with any system. Even with PKI you're just trusting a different server. At least it's possible for you to check your contact's fingerprint out of band if you're really concerned. You need the TextSecure server because without it you're not going to be able to connect to your contact at all. When everyone's moving between different connections to the internet and is almost always behind NAT then communication is only practical with a server. There's nothing stopping anyone from exchanging messages directly over TCP sockets. It would totally work. But how practical is that? How will anyone initiate a connection to your cell phone?

by Canada 11y ago

acqq 11y ago

If I understand, somehow the server delivers the initial keys to clients ("to make the process easier"). What happens if some evildoer takes control of Text Secure servers? Can the evildoer read all the communication from that point on, provided he can also capture the encrypted traffic (which is reasonable to assume)? The protocol "safe from the server turning malicious" would also be good even if I'd run my own server to prevent Text Secure servers getting all the contacts.

Canada 11y ago
The server has the keys in roughly the same way a PGP keyserver has the keys. They're all public keys, and they would be sent in the clear anyway, however storing them with the server enables senders to send to recipients who are offline. The server can't make use of them to read any communication. It's possible for the server to hand out the wrong key for a user, but the clients detect that. There are other ways for users to mount impersonation attacks without server cooperation anyway. The server also knows who talks to who, when, how big those messages are, and the number of attachments and their sizes. An adversary who can passively watch the server's encrypted traffic will also be able to determine some of these things, but not as easily or precisely. All the TextSecure server is really trusted to do is a good job of confirming a user who purports to have a certain phone number really does control that number at registration time.
- acqq 11y ago
  So if the server is under the control of the attacker and I use TextSecure expecting to "just work" (not already having the private key of my contact) I can actually communicate with the attacker instead of with my contact? And if I already have the private key of my contact, why do I need the TextSecure server at all?
  - Canada 11y ago
    You never have the private key of your contact. Private keys are private. But I get what you're saying. The system is trust on first use, so your client will accept whatever the server gives you as the identity. But that's how it is with any system. Even with PKI you're just trusting a different server. At least it's possible for you to check your contact's fingerprint out of band if you're really concerned. You need the TextSecure server because without it you're not going to be able to connect to your contact at all. When everyone's moving between different connections to the internet and is almost always behind NAT then communication is only practical with a server. There's nothing stopping anyone from exchanging messages directly over TCP sockets. It would totally work. But how practical is that? How will anyone initiate a connection to your cell phone?