5 ms·

Since no one else has explicitly brought this up: https://tonyarcieri.com/whats-wrong-with-webcrypto https://tonyarcieri.com/whats-wrong-with-webcrypto (also se

by buu700 11y ago

Since no one else has explicitly brought this up: https://tonyarcieri.com/whats-wrong-with-webcrypto https://tonyarcieri.com/whats-wrong-with-webcrypto (also see Matasano's "JavaScript Cryptography Considered Harmful", etc.). There is nothing that a service like this will protect you from that you don't already get while using TLS in just about every insecure/non-E2EE chat service. If you're looking for actually secure communication that runs as a Web app, my startup Cyph (cyph.com) is the only option that exists. This is because we put in the time to build it correctly; the root page of our application is a permanently pinned (TOFU) bootstrap that validates/executes signed application packages, and the scheme to accomplish this was rigorously vetted in a 12-day audit. Edits: * Here's how it works: https://www.reddit.com/r/encryption/comments/4027ci/how_2_spacex_alums_are_using_encryption_for_good/cyywmc8 https://www.reddit.com/r/encryption/comments/4027ci/how_2_sp... * Here's Cure53's audit report: http://cyph.team/cure53report http://cyph.team/cure53report

jvehent 11y ago
> the scheme to accomplish this was rigorously vetted in a 12-day audit. Vetted by whom? It would help build trust if there was a public report on the strength of your implementation available somewhere.
- buu700 11y ago
  Cure53. The report is public on both their website and ours: http://cyph.team/cure53report http://cyph.team/cure53report. (That link contains a page of additional context to explain the findings, e.g. some were pre-production.)
  - eganist 11y ago
    And the original, for anyone who wants it straight from Cure53: https://cure53.de/pentest-report_cyph.pdf https://cure53.de/pentest-report_cyph.pdf
mike-cardwell 11y ago
I don't know what you mean by, "permanently pinned (TOFU) bootstrap", but the fact that it "validates/executes signed application packages" doesn't sound like it protects the end user from you sending them a "signed application package" which contains something to steal their keys/messages... If you could post a link explaining how this tech works, I would be very interested in reading about it...
- buu700 11y ago
  It doesn't protect users from that yet (neither does Signal or any other alternative), but we are about to implement reproducible builds to help mitigate that by allowing users to independently verify that the deployed production build matches up with our source code on GitHub. That having been said, my cofounder and I are the only two people with the keys to sign releases (and as long Cyph exists they'll only ever be held by either ourselves or an equally small set of individuals deemed worthy to trust with our lives) — so you shouldn't ever expect that kind of deliberate backdoor, even if I end up in prison for refusing. We're also maintaining a strong focus on OpSec of these keys, e.g. we're about to migrate the release signing off of our (full disk encrypted) personal laptops to a dedicated air gapped environment. As far as how the tech works, we don't have a great explanation on the website yet, so this reddit comment will have to do for now: https://www.reddit.com/r/encryption/comments/4027ci/how_2_spacex_alums_are_using_encryption_for_good/cyywmc8 https://www.reddit.com/r/encryption/comments/4027ci/how_2_sp.... There's also a visualisation in http://cyph.team/producthandout http://cyph.team/producthandout, if that's helpful.
  - e12e 11y ago
    Nice to hear that you say you have nothing up your sleeves. I believe you don't, but if you were an agent for a covert agency you would make the same claims, so they mean nothing. As for opsec on keys... the only thing making key extraction remotely difficult by a state actor is probably some form of hsm - but recalling the xbox 1 crack, I don't know how well even those stand up in practice. For everything else, I assume you're just a sneak-and-peak warrant and some cameras/listening-devices away from sharing your passphrase. Don't get me wrong, I think it's great that people are working on secure chat applications. I just think one needs to be very careful making claims that end up on the side of being secure against state actors.
yaur 11y ago
From your site (attributed to cure53): "Cyph provides security from a broad range of cryptographic attacks" From the actual conclusion: "Cyph claims to provide security from a broad range of cryptographic attacks" Whats the deal here?
- eganist 11y ago
  Good catch. Mario actually provided a marketable quote via email (signed and all). Although that quote is intended as a one-sentence summary of Mario's report, it's not strictly a quote out of the report as much as it is strictly a quote from Mario. Therefore, the source on the quote might more accurately be attributed as "Mario Heiderich in summarizing the Cure53 pentest report." The thinking there was that there wasn't a good way to quote any single part of the report without introducing unnecessary and/or fishy ellipses, because although the point of the rest of the conclusion is that it confirms the claim made by Cyph, there wasn't a readily available standalone sentence in there which could go on the front page. Background: I advised Cyph on AppSec topics on behalf of Mach37 as a mentor, and I helped coordinate the Cure53 pentest. I'm the one who sourced the quote. Give me a few moments (or days; we'll see) for me to find a good way to publicly and non-repudiably present the exact source of the quote. Edit: Signed statement: http://pastebin.com/HcL5bneg http://pastebin.com/HcL5bneg Key: https://keybase.io/cure53 https://keybase.io/cure53 Hat tip to Mario (https://twitter.com/0x6d6172696f https://twitter.com/0x6d6172696f)
tptacek 11y ago
I don't think it's a good idea to provide secure messaging services that boot from a web page, under any circumstances. This stuff has to work. The adversary for secure messaging is world governments. If all you're worried about is criminals, Gchat will do a fine job of protecting you. For a vivid example of what I'm talking about, see the Telegram/Iran fiasco. It's hard enough building secure messaging in a native application; there are lots of details that are not easy to get right (as Cure53 demonstrated to your team). Bluntly: I feel that it's irresponsible to add to that portfolio of difficulties the added attack surface of content-controlled Javascript. The reason people build services like this is that users will prefer them to (more secure) native app alternatives. It's easy to see why. The common response to this observation is: "but users won't install an app". They won't install an app because people keep luring the away with insecure web-page based secure messengers.
- eganist 11y ago
  There are plenty of casual users who want the capability to have one-off conversations without worrying about who might be intercepting and storing the conversations, let alone without having to install anything new and try to convince their friends to use it too. This is made with them in mind. I see where you're coming from with the added attack surface argument, though I'd counter that browser sandboxing actually makes a web application safer for this use compared to creating a native application on the basis that if the native application is exploited, all user-mode data is now at risk. At least with the containment of the browser, the only things at risk are (potentially) your messages assuming successful XSS. So long as the proper mitigations are in place, it really makes no difference. The largest future improvement for Cyph in the future would be to incorporate one of the CSP2 changes for more safely allowing inlining, notably hash-src. However, since CSP2 adoption isn't all that widespread quite yet, it's better to hold off until the implementation details between the largest browsers are equalized. Edit to address your last paragraph: "[Users] won't install an app because people keep luring the away with insecure web-page based secure messengers." Native encrypted messaging apps have been around for a while and haven't really caught on unless integrated into existing apps a la iMessage. That's where the need for in-browser apps is coming from. My 2 cents. I'm likely entirely wrong; you've got more experience in general AppSec than I do, so my assumption of risks here might be off-base.
Veratyr 11y ago
Cyph looks great but there are a number of secure applications that only work on desktop or only work on mobile and I'm yet to see one that does both. Cyph of course runs in a mobile browser but unless I missed something, it doesn't support notifications, which are important. Is there any chance of Cyph supporting push notifications on mobile devices in the future?
- buu700 11y ago
  Which browser are you using? I'll have to test to confirm in iOS Safari, but the notifications at least work fine for me in Chrome and Firefox on Android. However, native mobile apps are definitely on the roadmap.

by buu700 11y ago

jvehent 11y ago

> the scheme to accomplish this was rigorously vetted in a 12-day audit. Vetted by whom? It would help build trust if there was a public report on the strength of your implementation available somewhere.

buu700 11y ago
Cure53. The report is public on both their website and ours: http://cyph.team/cure53report http://cyph.team/cure53report. (That link contains a page of additional context to explain the findings, e.g. some were pre-production.)
- eganist 11y ago
  And the original, for anyone who wants it straight from Cure53: https://cure53.de/pentest-report_cyph.pdf https://cure53.de/pentest-report_cyph.pdf

mike-cardwell 11y ago

I don't know what you mean by, "permanently pinned (TOFU) bootstrap", but the fact that it "validates/executes signed application packages" doesn't sound like it protects the end user from you sending them a "signed application package" which contains something to steal their keys/messages... If you could post a link explaining how this tech works, I would be very interested in reading about it...

buu700 11y ago
It doesn't protect users from that yet (neither does Signal or any other alternative), but we are about to implement reproducible builds to help mitigate that by allowing users to independently verify that the deployed production build matches up with our source code on GitHub. That having been said, my cofounder and I are the only two people with the keys to sign releases (and as long Cyph exists they'll only ever be held by either ourselves or an equally small set of individuals deemed worthy to trust with our lives) — so you shouldn't ever expect that kind of deliberate backdoor, even if I end up in prison for refusing. We're also maintaining a strong focus on OpSec of these keys, e.g. we're about to migrate the release signing off of our (full disk encrypted) personal laptops to a dedicated air gapped environment. As far as how the tech works, we don't have a great explanation on the website yet, so this reddit comment will have to do for now: https://www.reddit.com/r/encryption/comments/4027ci/how_2_spacex_alums_are_using_encryption_for_good/cyywmc8 https://www.reddit.com/r/encryption/comments/4027ci/how_2_sp.... There's also a visualisation in http://cyph.team/producthandout http://cyph.team/producthandout, if that's helpful.
- e12e 11y ago
  Nice to hear that you say you have nothing up your sleeves. I believe you don't, but if you were an agent for a covert agency you would make the same claims, so they mean nothing. As for opsec on keys... the only thing making key extraction remotely difficult by a state actor is probably some form of hsm - but recalling the xbox 1 crack, I don't know how well even those stand up in practice. For everything else, I assume you're just a sneak-and-peak warrant and some cameras/listening-devices away from sharing your passphrase. Don't get me wrong, I think it's great that people are working on secure chat applications. I just think one needs to be very careful making claims that end up on the side of being secure against state actors.

yaur 11y ago

From your site (attributed to cure53): "Cyph provides security from a broad range of cryptographic attacks" From the actual conclusion: "Cyph claims to provide security from a broad range of cryptographic attacks" Whats the deal here?

eganist 11y ago
Good catch. Mario actually provided a marketable quote via email (signed and all). Although that quote is intended as a one-sentence summary of Mario's report, it's not strictly a quote out of the report as much as it is strictly a quote from Mario. Therefore, the source on the quote might more accurately be attributed as "Mario Heiderich in summarizing the Cure53 pentest report." The thinking there was that there wasn't a good way to quote any single part of the report without introducing unnecessary and/or fishy ellipses, because although the point of the rest of the conclusion is that it confirms the claim made by Cyph, there wasn't a readily available standalone sentence in there which could go on the front page. Background: I advised Cyph on AppSec topics on behalf of Mach37 as a mentor, and I helped coordinate the Cure53 pentest. I'm the one who sourced the quote. Give me a few moments (or days; we'll see) for me to find a good way to publicly and non-repudiably present the exact source of the quote. Edit: Signed statement: http://pastebin.com/HcL5bneg http://pastebin.com/HcL5bneg Key: https://keybase.io/cure53 https://keybase.io/cure53 Hat tip to Mario (https://twitter.com/0x6d6172696f https://twitter.com/0x6d6172696f)

tptacek 11y ago

I don't think it's a good idea to provide secure messaging services that boot from a web page, under any circumstances. This stuff has to work. The adversary for secure messaging is world governments. If all you're worried about is criminals, Gchat will do a fine job of protecting you. For a vivid example of what I'm talking about, see the Telegram/Iran fiasco. It's hard enough building secure messaging in a native application; there are lots of details that are not easy to get right (as Cure53 demonstrated to your team). Bluntly: I feel that it's irresponsible to add to that portfolio of difficulties the added attack surface of content-controlled Javascript. The reason people build services like this is that users will prefer them to (more secure) native app alternatives. It's easy to see why. The common response to this observation is: "but users won't install an app". They won't install an app because people keep luring the away with insecure web-page based secure messengers.

eganist 11y ago
There are plenty of casual users who want the capability to have one-off conversations without worrying about who might be intercepting and storing the conversations, let alone without having to install anything new and try to convince their friends to use it too. This is made with them in mind. I see where you're coming from with the added attack surface argument, though I'd counter that browser sandboxing actually makes a web application safer for this use compared to creating a native application on the basis that if the native application is exploited, all user-mode data is now at risk. At least with the containment of the browser, the only things at risk are (potentially) your messages assuming successful XSS. So long as the proper mitigations are in place, it really makes no difference. The largest future improvement for Cyph in the future would be to incorporate one of the CSP2 changes for more safely allowing inlining, notably hash-src. However, since CSP2 adoption isn't all that widespread quite yet, it's better to hold off until the implementation details between the largest browsers are equalized. Edit to address your last paragraph: "[Users] won't install an app because people keep luring the away with insecure web-page based secure messengers." Native encrypted messaging apps have been around for a while and haven't really caught on unless integrated into existing apps a la iMessage. That's where the need for in-browser apps is coming from. My 2 cents. I'm likely entirely wrong; you've got more experience in general AppSec than I do, so my assumption of risks here might be off-base.

Veratyr 11y ago

Cyph looks great but there are a number of secure applications that only work on desktop or only work on mobile and I'm yet to see one that does both. Cyph of course runs in a mobile browser but unless I missed something, it doesn't support notifications, which are important. Is there any chance of Cyph supporting push notifications on mobile devices in the future?

buu700 11y ago
Which browser are you using? I'll have to test to confirm in iOS Safari, but the notifications at least work fine for me in Chrome and Firefox on Android. However, native mobile apps are definitely on the roadmap.