3 ms·

Sure, "zero", except the researchers who actually audited it and concluded exactly that: http://pastebin.com/HcL5bneg http://pastebin.com/HcL5bneg Every reply

by buu700 11y ago

Sure, "zero", except the researchers who actually audited it and concluded exactly that: http://pastebin.com/HcL5bneg http://pastebin.com/HcL5bneg Every reply you've made here seems to have been either an appeal to your own authority or a claim based on a browsing environment circa 2005. You haven't pointed to a single specific flaw in WebSign's architecture, so I can only assume you won't go into further detail because there is no further detail. This conversation was certainly enlightening (if nothing else, at least on our technical messaging). Thank you for the feedback.

tptacek 11y ago
That's not what that message says, but maybe you could email your auditors and ask if they'd stand by the assertion you're making that native apps aren't safer for cryptography than browser apps. As for the rest of it: I'm sorry you feel that way, but I've reached a point in my message-boarding career where, after many, many years of fighting the good (then marginal then tedious then bad) fight, I'm just not going to litigate this issue anymore. What you're doing is now is a bad idea, and for the sake of your users I think you should port to a browser extension (and, eventually, to a native mobile app) as soon as you possibly can. Maybe you can improve your security before your popularity gets out of hand and avoid the fate Telegram seems to be falling into. When new web standards make browser crypto viable, I'll acknowledge them. Unfortunately, the 10 years since 2005 have made browsers less hospitable to cryptography.
- eganist 11y ago
  > I think you should port to a browser extension Chrome extensions are HTML5/JS... which wouldn't stand to your own argument. > Unfortunately, the 10 years since 2005 have made browsers less hospitable to cryptography. You're saying IE6 and Firefox 1.0 were better for cryptography than our environment today? We've got effective standards like CSP and CSP2 for restricting code execution client side, SRI for validating resources hosted beyond trust boundaries, HPKP and HSTS for ensuring trust on TLS connections, and we have cooperation between major browser vendors to implement patterns like HSTS preloading and even certificate preloading for certain sites such as Twitter, environment sandboxing introduced as early as 2007, and your assertion is that the browser environment now is less hospitable to cryptography than in 2005? You were right a few comments ago; there's no point debating this any further. I have to do some shoveling anyway.
  - tptacek 11y ago
    No, I'm saying that web standards were more hospitable for crypto. The mic drop at the end of your comment would have been more dramatic had you been replying to a comment addressed to you.
- buu700 11y ago
  I'm just not sure how you expect me to take your position seriously and blindly follow it, when your reaction to the information I've presented is to pretend that there's literally no difference between WebSign/Cyph and something like MEGAChat. I felt that the "HPKP suicide" hack (which is something enabled only by recent Web standards) was a stroke of genius on Cure53's part; in the very least generous interpretation, it obviously still isn't equivalent to the security of a vanilla Web application, which you seem to be suggesting. As far as Mario's statement, while you're correct that it doesn't explicitly compare WebSign with installing a native app, it was made in the context of a threat model that assumed that level of security. This is why the one WebSign bypass exploit they found[1] was flagged as High — in any other Web app it would simply be a given that the server can serve new code. re: browser extensions, what WebSign provides is comparable, except without sacrificing the security benefits of the restricted privilege set of a standard Web context. (i.e. A vuln in Cyph wouldn't put more than just your browser tab at risk.) --- 1: This was immediately fixed, and then the HPKP rotation scheme Cure53 came up with was soon added on top of that fix.
  - buu700 11y ago
    So, if you're still reading this thread, I have one last question: what advantage do you think a browser extension has over WebSign as I've described it? I'm asking explicitly because, since you still maintain that the extension model is objectively more secure, at least one of us is clearly missing something very important.

by buu700 11y ago

tptacek 11y ago

That's not what that message says, but maybe you could email your auditors and ask if they'd stand by the assertion you're making that native apps aren't safer for cryptography than browser apps. As for the rest of it: I'm sorry you feel that way, but I've reached a point in my message-boarding career where, after many, many years of fighting the good (then marginal then tedious then bad) fight, I'm just not going to litigate this issue anymore. What you're doing is now is a bad idea, and for the sake of your users I think you should port to a browser extension (and, eventually, to a native mobile app) as soon as you possibly can. Maybe you can improve your security before your popularity gets out of hand and avoid the fate Telegram seems to be falling into. When new web standards make browser crypto viable, I'll acknowledge them. Unfortunately, the 10 years since 2005 have made browsers less hospitable to cryptography.

eganist 11y ago
> I think you should port to a browser extension Chrome extensions are HTML5/JS... which wouldn't stand to your own argument. > Unfortunately, the 10 years since 2005 have made browsers less hospitable to cryptography. You're saying IE6 and Firefox 1.0 were better for cryptography than our environment today? We've got effective standards like CSP and CSP2 for restricting code execution client side, SRI for validating resources hosted beyond trust boundaries, HPKP and HSTS for ensuring trust on TLS connections, and we have cooperation between major browser vendors to implement patterns like HSTS preloading and even certificate preloading for certain sites such as Twitter, environment sandboxing introduced as early as 2007, and your assertion is that the browser environment now is less hospitable to cryptography than in 2005? You were right a few comments ago; there's no point debating this any further. I have to do some shoveling anyway.
- tptacek 11y ago
  No, I'm saying that web standards were more hospitable for crypto. The mic drop at the end of your comment would have been more dramatic had you been replying to a comment addressed to you.
buu700 11y ago
I'm just not sure how you expect me to take your position seriously and blindly follow it, when your reaction to the information I've presented is to pretend that there's literally no difference between WebSign/Cyph and something like MEGAChat. I felt that the "HPKP suicide" hack (which is something enabled only by recent Web standards) was a stroke of genius on Cure53's part; in the very least generous interpretation, it obviously still isn't equivalent to the security of a vanilla Web application, which you seem to be suggesting. As far as Mario's statement, while you're correct that it doesn't explicitly compare WebSign with installing a native app, it was made in the context of a threat model that assumed that level of security. This is why the one WebSign bypass exploit they found[1] was flagged as High — in any other Web app it would simply be a given that the server can serve new code. re: browser extensions, what WebSign provides is comparable, except without sacrificing the security benefits of the restricted privilege set of a standard Web context. (i.e. A vuln in Cyph wouldn't put more than just your browser tab at risk.) --- 1: This was immediately fixed, and then the HPKP rotation scheme Cure53 came up with was soon added on top of that fix.
- buu700 11y ago
  So, if you're still reading this thread, I have one last question: what advantage do you think a browser extension has over WebSign as I've described it? I'm asking explicitly because, since you still maintain that the extension model is objectively more secure, at least one of us is clearly missing something very important.