4 ms·

Hey Thomas, thanks for the comment; I'd been wanting a chance to get your thoughts on WebSign for ages! While our audit demonstrates that this scheme shouldn't

by buu700 11y ago

Hey Thomas, thanks for the comment; I'd been wanting a chance to get your thoughts on WebSign for ages! While our audit demonstrates that this scheme shouldn't be expected to be cracked without a critical vulnerability making its way into your browser, it does introduce some odd dependency relationships that certainly introduce new attack vectors not seen in the TOFU property of regular standalone apps. For example, given that the NSA can be assumed to be indiscriminately passively logging all HTTPS traffic, imagine that one day they gain the capability to break 4096-bit RSA: in a targeted attack scenario, suddenly they can now go back through their traffic logs, find whichever public key is pinned in a particular Cyph user's browser, compute the associated private key, and undo method #2 as descried in the linked reddit comment (the "permanent offline" trick), which gets them half of the way toward completely breaking that user's TOFU. That having been said, I consider it a perfectly acceptable and pretty neat solution to the problem. Is there something else you're seeing that makes you object to it? Edit: If your objection isn't to WebSign but to the Web / JS as an execution environment in general, I'll throw in a link to this note on how we're mitigating those traditional risks while also benefitting from the sophisticated sandboxing of modern browsers: https://www.reddit.com/r/encryption/comments/4027ci/how_2_spacex_alums_are_using_encryption_for_good/cyybn23 https://www.reddit.com/r/encryption/comments/4027ci/how_2_sp...

sdevlin 11y ago
Cure53's report details a complete bypass of WebSign as implemented, as well as stern warnings against relying on a non-security feature for security.
- buu700 11y ago
  Not denying the increased attack surface, but that bypass was immediately fixed and verified by Cure53 (so no known vulnerabilities exist); furthermore, as you'll see in both our foreword to that report and the linked reddit comment, the current version of WebSign actually no longer has that general flaw. Breaking WebSign would require defeating TLS public key pinning (which is a security feature), thanks to the technique that an email I just received so perfectly referred to as "HPKP suicide".
tptacek 11y ago
Am I understanding correctly that you consider your adversary to be the National Security Agency, the world's best funded, best equipped, best staffed SIGINT agency, and that you think they're limited to passive observation? Again: I just think this is a bad idea. I'm sure you're great people, but cryptographic security is hard enough for native apps, without trying to deploy it in the jungle gym of some random browser runtime. You should stop deploying this app from a web page. Altogether. And soon. Port it instead to be a Chrome extension that users install. I'm sure you're not hurting anyone right now. But you've built the kind of application that will, if it ever gets to be very successful, probably get people hurt. Better instead to work on something that will help people more as it gets more popular.
- buu700 11y ago
  Am I understanding correctly that you consider your adversary to be the National Security Agency, the world's best funded, best equipped, best staffed SIGINT agency, and that you think they're limited to passive observation? No, you aren't; the example was to illustrate an entirely different point. Again: I just think this is a bad idea. I'm sure you're great people, but cryptographic security is hard enough for native apps, without trying to deploy it in the jungle gym of some random browser runtime. Do you have a specific criticism, or is your argument more of a general point that solving multiple hard problems is more difficult to do correctly? If that is what you're getting at, it seems like it would be effectively addressed by frequent audits of the Cyph source code.
  - tptacek 11y ago
    There are very specific concerns I have about implementing secure cryptography in a browser runtime. I wrote an article about this a while back. I don't love that article and never did, but one complaint I've heard about it is that it's "dated". In fact: I think the last few years have made it harder to securely deploy crypto in a browser. So one short answer is, for a bunch of fiddly reasons, I think you're building one of next year's Black Hat Briefings talks. But the broader concern is, in fact, that by offering people a secure messenger, you're accepting some responsibility for securing traffic that can jeopardize lives if you're compromised. You have, I think, a moral responsibility to be as conservative as you possibly can be. When someone gets hurt because this system is flawed --- assuming you ever learn about it --- I think you're going to be surprised by where it happened. People with causes you've never even considered will use this thing in ways that, if you knew about, you'd say "fuck! stop! i like my application but i can't let you bet your life on it!". It's great that you paid for an audit, but audits aren't magic feathers. If you got audited again by a strong team, they'd find other things you missed. As it stands, the team that audited you found devastating crypto flaws; for instance, you repeated nonces! Crypto is hard even on the "easy" setting. You've got the difficulty setting dialed all the way to "nightmare". Dial it back down.

by buu700 11y ago

sdevlin 11y ago

Cure53's report details a complete bypass of WebSign as implemented, as well as stern warnings against relying on a non-security feature for security.

buu700 11y ago
Not denying the increased attack surface, but that bypass was immediately fixed and verified by Cure53 (so no known vulnerabilities exist); furthermore, as you'll see in both our foreword to that report and the linked reddit comment, the current version of WebSign actually no longer has that general flaw. Breaking WebSign would require defeating TLS public key pinning (which is a security feature), thanks to the technique that an email I just received so perfectly referred to as "HPKP suicide".

tptacek 11y ago

Am I understanding correctly that you consider your adversary to be the National Security Agency, the world's best funded, best equipped, best staffed SIGINT agency, and that you think they're limited to passive observation? Again: I just think this is a bad idea. I'm sure you're great people, but cryptographic security is hard enough for native apps, without trying to deploy it in the jungle gym of some random browser runtime. You should stop deploying this app from a web page. Altogether. And soon. Port it instead to be a Chrome extension that users install. I'm sure you're not hurting anyone right now. But you've built the kind of application that will, if it ever gets to be very successful, probably get people hurt. Better instead to work on something that will help people more as it gets more popular.

buu700 11y ago
Am I understanding correctly that you consider your adversary to be the National Security Agency, the world's best funded, best equipped, best staffed SIGINT agency, and that you think they're limited to passive observation? No, you aren't; the example was to illustrate an entirely different point. Again: I just think this is a bad idea. I'm sure you're great people, but cryptographic security is hard enough for native apps, without trying to deploy it in the jungle gym of some random browser runtime. Do you have a specific criticism, or is your argument more of a general point that solving multiple hard problems is more difficult to do correctly? If that is what you're getting at, it seems like it would be effectively addressed by frequent audits of the Cyph source code.
- tptacek 11y ago
  There are very specific concerns I have about implementing secure cryptography in a browser runtime. I wrote an article about this a while back. I don't love that article and never did, but one complaint I've heard about it is that it's "dated". In fact: I think the last few years have made it harder to securely deploy crypto in a browser. So one short answer is, for a bunch of fiddly reasons, I think you're building one of next year's Black Hat Briefings talks. But the broader concern is, in fact, that by offering people a secure messenger, you're accepting some responsibility for securing traffic that can jeopardize lives if you're compromised. You have, I think, a moral responsibility to be as conservative as you possibly can be. When someone gets hurt because this system is flawed --- assuming you ever learn about it --- I think you're going to be surprised by where it happened. People with causes you've never even considered will use this thing in ways that, if you knew about, you'd say "fuck! stop! i like my application but i can't let you bet your life on it!". It's great that you paid for an audit, but audits aren't magic feathers. If you got audited again by a strong team, they'd find other things you missed. As it stands, the team that audited you found devastating crypto flaws; for instance, you repeated nonces! Crypto is hard even on the "easy" setting. You've got the difficulty setting dialed all the way to "nightmare". Dial it back down.