38 ms·

MEGAChat now includes end-to-end encryption

135 points by ponyous 11y ago

iofj 11y ago
Powered by code that you download every time you use it, and that therefore can leak your keys and conversations at any time, just as centralized chat can.
- vortico 11y ago
  Hopefully you can download the web client. The mobile apps do not have this problem.
  - jimktrains2 11y ago
    But mobile apps can still wrap web views. Also, if you can't inspect the source, you can't even be reasonably certain keys are handled properly.
mtgx 11y ago
Didn't Kim Dotcom say you can't trust Mega anymore? http://www.wired.co.uk/news/archive/2015-07/31/kim-dotcom-mega-3 http://www.wired.co.uk/news/archive/2015-07/31/kim-dotcom-me...
- runn1ng 11y ago
  I frankly never trusted Mega in the first place. Their claims were always grandiose and absurd and their business model (back as Megaupload) was always a bit sketchy. When I want secure chat, I use Signal from WhisperSystems. Yeah it has usability issues, but it's obvious it's hard to do really secure and secret chat.
- aw3c2 11y ago
  If Kim Dotcom says you can't trust something does that mean you can? https://de.wikipedia.org/wiki/Kim_Dotcom#Werdegang https://de.wikipedia.org/wiki/Kim_Dotcom#Werdegang
  - junto 11y ago
    Nice! For those that don't know, Kim Schmitz / Kimble(now Dotcom), sold out his fellow warez peers to the copyright lawyer Günter Freiherr von Gravenreuth. Like the wild West he was supposedly paid per head. http://www.forbes.com/sites/andygreenberg/2013/04/17/where-kim-dotcom-got-his-start-the-house-of-coolness/#2c0ff577c134 http://www.forbes.com/sites/andygreenberg/2013/04/17/where-k... Not mentioned in the article is his involvement in the AT&T calling card fraud conspiracy (estimated losses $20 million) in the early '90's. It is that case that put him on the US Secret Service's radar and he's been on it ever since.
    - DyslexicAtheist 11y ago
      not to mention having made most of his cash with insider trading in Germany.
      - Kristine1975 11y ago
        Which wasn't illegal at that point, though.
        DyslexicAtheist 11y ago
        yepp indeed. that just made me think ... a lot of things weren't ... such as bribing gov officials when participating in tenders (example Siemens and others learned the hard way). Lot of things seemed to have become illegal in Germany just over the past 20 years. Now they're even trying to curb our creativity when writing software for exhaust emmissions test /s
    - bascule 11y ago
      See also his Security Charlatans page on Attrition.org: http://attrition.org/errata/charlatan/kimble/ http://attrition.org/errata/charlatan/kimble/
- aduitsis 11y ago
  Author of the Wired article seems to think that Anonymous Coward is an actual Slashdot user :)
jpgvm 11y ago
It sounds reasonable? If anything this highlights the problem with all the new encrypted communications options, even highly technical people can't really know how good it is from a cursory look. Just because it says end to end encryption and uses some nice ciphers it doesn't mean the implementation is not critically flawed. I use Signal right now (from Moxie Marlinspike/Whisper Systems) and would only really consider alternatives if they were endorsed by other cryptographers I know because I really just don't have a strong enough grasp of how all the machinery interacts.
- treenyc 11y ago
  It is great that Whisper Systems/Signal implement cryptography properly. However, the NEWER versions of Signal requires access to your contact to work. For many users that is a show stopper. Implement a way for user to search by User ID and allow user to find each other by ID in addition to phone number.
  - Tepix 11y ago
    Not on iOS. It's not Signal's fault that Android permissions are a mess. Google has no interest in providing good privacy to their customers. They only want to appear to provide privacy. In reality, they want to know everything there is to know about everything and everyone. To improve their service, of course...
    - lelf 11y ago
      > Not on iOS Tried just now. It does require it and doesn't work without it. Sorry! Signal requires access to your contacts. We do not store your contacts on our servers. [Give access]
  - Freak_NL 11y ago
    The requirement of a phone number is strange and disconcerting from a privacy standpoint. It is a red flag for me. A well-designed encrypted chat-protocol should work on any modern networked computing device, not just smartphones or computing devices linked to a smartphone.
lampe3 11y ago
when i try to go on the page with the latests firefox nightly: http://i.imgur.com/FsLiIz8.png http://i.imgur.com/FsLiIz8.png
- dchest 11y ago
  Firefox bug: https://bugzilla.mozilla.org/show_bug.cgi?id=1238354 https://bugzilla.mozilla.org/show_bug.cgi?id=1238354
Freak_NL 11y ago
It's great that there is such a strong interest in secure communication, but all of the solutions that keep getting placed in the limelight in recent years are either centralised or exclusively available for use with a smartphone (because of the phone number requirement), often both! I'm sure that these solutions are a lot more secure than completely unprotected alternatives, but am I wrong in assuming that if you want secure and private communications, the following principles must be met at the least? * The protocol used must be open, standardized and implementable by others * Widely endorsed by cryptography experts * An implementation must be available and developed as free and open source software * End-to-end encryption is used for the contents of the conversations, private keys do not leave the user's computing device * The protocol must not have any technological barriers that prevent an implementation from working on any modern operating system (i.e., a phone number is not required) * The protocol must allow for a complete communications network (clients and servers) to be implemented without the need for centralised third-party services (The last point probably implies federation.) For e-mail, OpenPGP meets these requirements. For chat, XMPP has Off-The-Record messaging. Some of the above points are hostile towards any party that creates secure communications tools with the intent of growing a large user base for economic purposes. Call me a sceptic, but this is probably why use of these protocols and principals is limited to security experts and software developers who understand these principles — for anyone betting on creating the next WhatsApp in one of the mobile walled gardens embracing the whole list means risking losing your potential advertising eyeballs to alternatives. Of course, there is also the matter of infrastructure. A lot of people expect to be able to use these tools for free, but that implies that someone is paying for the hosting of (relay) servers.
- DanBC 11y ago
  > Call me a sceptic, but this is probably why use of these protocols and principals is limited to security experts and software developers who understand these principals OpenPGP is impossible for most email users to get working correctly. Remember that most people don't even know the difference between CC and BCC. Here's an example of de-anonymising anonymous messages, supossedly from clueful users: https://ritter.vg/blog-deanonymizing_amm.html https://ritter.vg/blog-deanonymizing_amm.html
DyslexicAtheist 11y ago
alternative title for this post: "rolling your won crypto and smoking it too"
- lindx 11y ago
  The "don't roll your own crypto" mantra was created by the NSA to make people afraid to develop and deploy cryptography. See here: http://www.youtube.com/watch?v=fwcl17Q0bpk http://www.youtube.com/watch?v=fwcl17Q0bpk
  - DyslexicAtheist 11y ago
    oh wow that is awesome background context. thanks!!
buu700 11y ago
Since no one else has explicitly brought this up: https://tonyarcieri.com/whats-wrong-with-webcrypto https://tonyarcieri.com/whats-wrong-with-webcrypto (also see Matasano's "JavaScript Cryptography Considered Harmful", etc.). There is nothing that a service like this will protect you from that you don't already get while using TLS in just about every insecure/non-E2EE chat service. If you're looking for actually secure communication that runs as a Web app, my startup Cyph (cyph.com) is the only option that exists. This is because we put in the time to build it correctly; the root page of our application is a permanently pinned (TOFU) bootstrap that validates/executes signed application packages, and the scheme to accomplish this was rigorously vetted in a 12-day audit. Edits: * Here's how it works: https://www.reddit.com/r/encryption/comments/4027ci/how_2_spacex_alums_are_using_encryption_for_good/cyywmc8 https://www.reddit.com/r/encryption/comments/4027ci/how_2_sp... * Here's Cure53's audit report: http://cyph.team/cure53report http://cyph.team/cure53report
- jvehent 11y ago
  > the scheme to accomplish this was rigorously vetted in a 12-day audit. Vetted by whom? It would help build trust if there was a public report on the strength of your implementation available somewhere.
  - buu700 11y ago
    Cure53. The report is public on both their website and ours: http://cyph.team/cure53report http://cyph.team/cure53report. (That link contains a page of additional context to explain the findings, e.g. some were pre-production.)
    - eganist 11y ago
      And the original, for anyone who wants it straight from Cure53: https://cure53.de/pentest-report_cyph.pdf https://cure53.de/pentest-report_cyph.pdf
- mike-cardwell 11y ago
  I don't know what you mean by, "permanently pinned (TOFU) bootstrap", but the fact that it "validates/executes signed application packages" doesn't sound like it protects the end user from you sending them a "signed application package" which contains something to steal their keys/messages... If you could post a link explaining how this tech works, I would be very interested in reading about it...
infinity0 11y ago
Note in particular that the current system does not have forward secrecy. Near the end of the post: > Then we plan to launch a 'Whisper Mode' for additional protection when in instant messaging sessions (e.g. message transcript/order consistency, delivery assurance, forward secrecy, and some others). This is what I was working on at MEGA, but recently they decided to stop funding me, and I'm under the strong impression that nobody else there is working on this. So it's unclear that they have a concrete time frame for it. The source code and docs are here though: https://github.com/meganz/mpenc_js https://github.com/meganz/mpenc_js https://github.com/meganz/mpenc_doc https://github.com/meganz/mpenc_doc https://docs.mega.nz/chat/mpenc/ https://docs.mega.nz/chat/mpenc/ If anyone wants to continue funding this work, feel free to drop me a line.
- eganist 11y ago
  Scroll down to buu700's comments. They're likely relevant to your background and probably in a better position to embrace what you've got so far.
merpnderp 11y ago
How does this compare to something like cryptocat?
- tptacek 11y ago
  It is basically cryptocat.
  - garrettr_ 11y ago
    Have you taken a look at Cyph (mentioned elsewhere in this thread)? Their app is also basically cryptocat, but they've taken the time to engineer an interesting solution [0] to the "Trust on Every Use" problem that secure web applications have. Of course, you still have the problem of deploying a secure application within the attack surface minefield of a web browser, but that's a separate issue. [0]: https://docs.google.com/document/d/1PGS50eZB9Ud7wVKmrc0HU_FDygZkyuFjmTRrukAz3sw/edit https://docs.google.com/document/d/1PGS50eZB9Ud7wVKmrc0HU_FD...
    - tptacek 11y ago
      Secure messaging has to work. All the time. If your threat model is criminals, Gchat will protect you just fine. You use encrypted messaging to prevent governments from reading your messages. Look at the Telegram/Iran fiasco for an example of this. So: my recommendation is, never use any secure messaging system that boots off a web page. No matter what they claim to do to mitigate the risk. I'm actually, for a bunch of specific reasons, not super comfortable with browser extension applications either. But at least the browser tries to protect an extension you have to explicitly install and explicitly run.
doomrobo 11y ago
Somewhat off topic, but does anybody remember when MEGASync (a MEGA desktop sync client) came out and the Linux source code was "on its way?" It's been over a year (maybe 2?) and I've seen nothing. I have no reason to trust the security of the file storage backend until then.

135 points by ponyous 11y ago

iofj 11y ago

Powered by code that you download every time you use it, and that therefore can leak your keys and conversations at any time, just as centralized chat can.

vortico 11y ago
Hopefully you can download the web client. The mobile apps do not have this problem.
- jimktrains2 11y ago
  But mobile apps can still wrap web views. Also, if you can't inspect the source, you can't even be reasonably certain keys are handled properly.

mtgx 11y ago

Didn't Kim Dotcom say you can't trust Mega anymore? http://www.wired.co.uk/news/archive/2015-07/31/kim-dotcom-mega-3 http://www.wired.co.uk/news/archive/2015-07/31/kim-dotcom-me...

runn1ng 11y ago
I frankly never trusted Mega in the first place. Their claims were always grandiose and absurd and their business model (back as Megaupload) was always a bit sketchy. When I want secure chat, I use Signal from WhisperSystems. Yeah it has usability issues, but it's obvious it's hard to do really secure and secret chat.
aw3c2 11y ago
If Kim Dotcom says you can't trust something does that mean you can? https://de.wikipedia.org/wiki/Kim_Dotcom#Werdegang https://de.wikipedia.org/wiki/Kim_Dotcom#Werdegang
- junto 11y ago
  Nice! For those that don't know, Kim Schmitz / Kimble(now Dotcom), sold out his fellow warez peers to the copyright lawyer Günter Freiherr von Gravenreuth. Like the wild West he was supposedly paid per head. http://www.forbes.com/sites/andygreenberg/2013/04/17/where-kim-dotcom-got-his-start-the-house-of-coolness/#2c0ff577c134 http://www.forbes.com/sites/andygreenberg/2013/04/17/where-k... Not mentioned in the article is his involvement in the AT&T calling card fraud conspiracy (estimated losses $20 million) in the early '90's. It is that case that put him on the US Secret Service's radar and he's been on it ever since.
  - DyslexicAtheist 11y ago
    not to mention having made most of his cash with insider trading in Germany.
    - Kristine1975 11y ago
      Which wasn't illegal at that point, though.
      - DyslexicAtheist 11y ago
        yepp indeed. that just made me think ... a lot of things weren't ... such as bribing gov officials when participating in tenders (example Siemens and others learned the hard way). Lot of things seemed to have become illegal in Germany just over the past 20 years. Now they're even trying to curb our creativity when writing software for exhaust emmissions test /s
  - bascule 11y ago
    See also his Security Charlatans page on Attrition.org: http://attrition.org/errata/charlatan/kimble/ http://attrition.org/errata/charlatan/kimble/
aduitsis 11y ago
Author of the Wired article seems to think that Anonymous Coward is an actual Slashdot user :)

jpgvm 11y ago

It sounds reasonable? If anything this highlights the problem with all the new encrypted communications options, even highly technical people can't really know how good it is from a cursory look. Just because it says end to end encryption and uses some nice ciphers it doesn't mean the implementation is not critically flawed. I use Signal right now (from Moxie Marlinspike/Whisper Systems) and would only really consider alternatives if they were endorsed by other cryptographers I know because I really just don't have a strong enough grasp of how all the machinery interacts.

treenyc 11y ago
It is great that Whisper Systems/Signal implement cryptography properly. However, the NEWER versions of Signal requires access to your contact to work. For many users that is a show stopper. Implement a way for user to search by User ID and allow user to find each other by ID in addition to phone number.
- Tepix 11y ago
  Not on iOS. It's not Signal's fault that Android permissions are a mess. Google has no interest in providing good privacy to their customers. They only want to appear to provide privacy. In reality, they want to know everything there is to know about everything and everyone. To improve their service, of course...
  - lelf 11y ago
    > Not on iOS Tried just now. It does require it and doesn't work without it. Sorry! Signal requires access to your contacts. We do not store your contacts on our servers. [Give access]
- Freak_NL 11y ago
  The requirement of a phone number is strange and disconcerting from a privacy standpoint. It is a red flag for me. A well-designed encrypted chat-protocol should work on any modern networked computing device, not just smartphones or computing devices linked to a smartphone.

lampe3 11y ago

when i try to go on the page with the latests firefox nightly: http://i.imgur.com/FsLiIz8.png http://i.imgur.com/FsLiIz8.png

dchest 11y ago
Firefox bug: https://bugzilla.mozilla.org/show_bug.cgi?id=1238354 https://bugzilla.mozilla.org/show_bug.cgi?id=1238354

Freak_NL 11y ago

It's great that there is such a strong interest in secure communication, but all of the solutions that keep getting placed in the limelight in recent years are either centralised or exclusively available for use with a smartphone (because of the phone number requirement), often both! I'm sure that these solutions are a lot more secure than completely unprotected alternatives, but am I wrong in assuming that if you want secure and private communications, the following principles must be met at the least? * The protocol used must be open, standardized and implementable by others * Widely endorsed by cryptography experts * An implementation must be available and developed as free and open source software * End-to-end encryption is used for the contents of the conversations, private keys do not leave the user's computing device * The protocol must not have any technological barriers that prevent an implementation from working on any modern operating system (i.e., a phone number is not required) * The protocol must allow for a complete communications network (clients and servers) to be implemented without the need for centralised third-party services (The last point probably implies federation.) For e-mail, OpenPGP meets these requirements. For chat, XMPP has Off-The-Record messaging. Some of the above points are hostile towards any party that creates secure communications tools with the intent of growing a large user base for economic purposes. Call me a sceptic, but this is probably why use of these protocols and principals is limited to security experts and software developers who understand these principles — for anyone betting on creating the next WhatsApp in one of the mobile walled gardens embracing the whole list means risking losing your potential advertising eyeballs to alternatives. Of course, there is also the matter of infrastructure. A lot of people expect to be able to use these tools for free, but that implies that someone is paying for the hosting of (relay) servers.

DanBC 11y ago
> Call me a sceptic, but this is probably why use of these protocols and principals is limited to security experts and software developers who understand these principals OpenPGP is impossible for most email users to get working correctly. Remember that most people don't even know the difference between CC and BCC. Here's an example of de-anonymising anonymous messages, supossedly from clueful users: https://ritter.vg/blog-deanonymizing_amm.html https://ritter.vg/blog-deanonymizing_amm.html

DyslexicAtheist 11y ago

alternative title for this post: "rolling your won crypto and smoking it too"

lindx 11y ago
The "don't roll your own crypto" mantra was created by the NSA to make people afraid to develop and deploy cryptography. See here: http://www.youtube.com/watch?v=fwcl17Q0bpk http://www.youtube.com/watch?v=fwcl17Q0bpk
- DyslexicAtheist 11y ago
  oh wow that is awesome background context. thanks!!

buu700 11y ago

Since no one else has explicitly brought this up: https://tonyarcieri.com/whats-wrong-with-webcrypto https://tonyarcieri.com/whats-wrong-with-webcrypto (also see Matasano's "JavaScript Cryptography Considered Harmful", etc.). There is nothing that a service like this will protect you from that you don't already get while using TLS in just about every insecure/non-E2EE chat service. If you're looking for actually secure communication that runs as a Web app, my startup Cyph (cyph.com) is the only option that exists. This is because we put in the time to build it correctly; the root page of our application is a permanently pinned (TOFU) bootstrap that validates/executes signed application packages, and the scheme to accomplish this was rigorously vetted in a 12-day audit. Edits: * Here's how it works: https://www.reddit.com/r/encryption/comments/4027ci/how_2_spacex_alums_are_using_encryption_for_good/cyywmc8 https://www.reddit.com/r/encryption/comments/4027ci/how_2_sp... * Here's Cure53's audit report: http://cyph.team/cure53report http://cyph.team/cure53report

jvehent 11y ago
> the scheme to accomplish this was rigorously vetted in a 12-day audit. Vetted by whom? It would help build trust if there was a public report on the strength of your implementation available somewhere.
- buu700 11y ago
  Cure53. The report is public on both their website and ours: http://cyph.team/cure53report http://cyph.team/cure53report. (That link contains a page of additional context to explain the findings, e.g. some were pre-production.)
  - eganist 11y ago
    And the original, for anyone who wants it straight from Cure53: https://cure53.de/pentest-report_cyph.pdf https://cure53.de/pentest-report_cyph.pdf
mike-cardwell 11y ago
I don't know what you mean by, "permanently pinned (TOFU) bootstrap", but the fact that it "validates/executes signed application packages" doesn't sound like it protects the end user from you sending them a "signed application package" which contains something to steal their keys/messages... If you could post a link explaining how this tech works, I would be very interested in reading about it...

infinity0 11y ago

Note in particular that the current system does not have forward secrecy. Near the end of the post: > Then we plan to launch a 'Whisper Mode' for additional protection when in instant messaging sessions (e.g. message transcript/order consistency, delivery assurance, forward secrecy, and some others). This is what I was working on at MEGA, but recently they decided to stop funding me, and I'm under the strong impression that nobody else there is working on this. So it's unclear that they have a concrete time frame for it. The source code and docs are here though: https://github.com/meganz/mpenc_js https://github.com/meganz/mpenc_js https://github.com/meganz/mpenc_doc https://github.com/meganz/mpenc_doc https://docs.mega.nz/chat/mpenc/ https://docs.mega.nz/chat/mpenc/ If anyone wants to continue funding this work, feel free to drop me a line.

eganist 11y ago
Scroll down to buu700's comments. They're likely relevant to your background and probably in a better position to embrace what you've got so far.

merpnderp 11y ago

How does this compare to something like cryptocat?

tptacek 11y ago
It is basically cryptocat.
- garrettr_ 11y ago
  Have you taken a look at Cyph (mentioned elsewhere in this thread)? Their app is also basically cryptocat, but they've taken the time to engineer an interesting solution [0] to the "Trust on Every Use" problem that secure web applications have. Of course, you still have the problem of deploying a secure application within the attack surface minefield of a web browser, but that's a separate issue. [0]: https://docs.google.com/document/d/1PGS50eZB9Ud7wVKmrc0HU_FDygZkyuFjmTRrukAz3sw/edit https://docs.google.com/document/d/1PGS50eZB9Ud7wVKmrc0HU_FD...
  - tptacek 11y ago
    Secure messaging has to work. All the time. If your threat model is criminals, Gchat will protect you just fine. You use encrypted messaging to prevent governments from reading your messages. Look at the Telegram/Iran fiasco for an example of this. So: my recommendation is, never use any secure messaging system that boots off a web page. No matter what they claim to do to mitigate the risk. I'm actually, for a bunch of specific reasons, not super comfortable with browser extension applications either. But at least the browser tries to protect an extension you have to explicitly install and explicitly run.

doomrobo 11y ago

Somewhat off topic, but does anybody remember when MEGASync (a MEGA desktop sync client) came out and the Linux source code was "on its way?" It's been over a year (maybe 2?) and I've seen nothing. I have no reason to trust the security of the file storage backend until then.