4 ms·

Even with e2e you have availability concerns, so picking a "good" jurisdiction makes sense. The rest of your criticisms are completely valid -- webmail is neve

by rdl 11y ago

Even with e2e you have availability concerns, so picking a "good" jurisdiction makes sense. The rest of your criticisms are completely valid -- webmail is never going to approach the security of true e2e client crypto. The best possible system for webmail would be a browser extension or in the far future world, some kind of browser security extensions. Failing that, there's probably value in "best effort" secure webmail if users are explicitly aware of the limitations. The problem is even developers aren't really aware of the limitations (since they vary with threats and per user), so this is probably not a realistic goal.

farfromright 11y ago
Would you care to comment on Cyph [1]? They claim that they are able to approximate client side programs that provide e2e but in a non-plugin browser environment [2]. I know tptacek doesn't like it but he wasn't willing to go into a detailed account of why. [1] https://cyph.com https://cyph.com [2] https://docs.google.com/document/d/1XVh4ALXhbfxi70QSUY-xHclauob8O635bSySy6f1Ysk/edit?pref=2&pli=1 https://docs.google.com/document/d/1XVh4ALXhbfxi70QSUY-xHcla...
- buu700 11y ago
  Cyph cofounder here; thanks for the mention! It'd be great to hear thoughts from Moxie or anyone else on WebSign. By the way, I think this was the doc you meant to link to for [2]: http://cyph.team/websigndoc http://cyph.team/websigndoc.
- eganist 11y ago
  Hah. I had some time to think about that interaction and concluded (after a chat with a few peers at AppSec Cali) that he and I simply differ in mentality. I understand where he's coming from about the risks posed by that level of flexibility in the execution environment, but I'm also more prone to push for the idea that making encryption more convenient for all justifies taking some risks in terms of the execution environment so long as we can (to the best of our knowledge) sufficiently mitigate them. That and browser sandboxing helps a ton more than having someone break an app running in userspace. His objection might be at a more visceral level, which I understand but steadfastly disagree with.
  - tptacek 11y ago
    You guys seem to remember more about "this interaction" than I do. Someone want to bring me up to speed?
    - buu700 11y ago
      There was a thread a couple months back where I brought up WebSign (Cyph's TOFU in-browser code signing layer) in response to a story about MEGAChat, which you generally disapproved of but didn't go into detail on why. There was also some related back-and-forth between you and eganist. My impression was that you hadn't necessarily had the chance to fully digest the architecture due to time constraints on your end, and were coming more from a position of "the premise of this is scary and it's almost definitely broken in some way" than of having identified a specific flaw. Also, as eganist noted here, you may have held a different opinion than us on the drawbacks of the flexible execution environment (despite Cyph's partial mitigations of TypeScript for static typing and asm.js for pseudo-native crypto) vs the benefits of the well-vetted sandbox.
      - tptacek 11y ago
        Oh wow, is Cyph the one with the elaborate caching scheme where they invalidate the certificate once a week to prevent the package, once downloaded, from ever reloading itself off the website?
        buu700 11y ago
        Yep, that's it. (To clarify, the signed package is freshly downloaded each time; it's just the root of the origin of the application that's pinned via "HPKP suicide" invalidation.)
        tptacek 11y ago
        Look, it's clever. I mean it. I'm not saying the people that came up with that insane scheme were dumb to do that. It would be a good research project! But I can't imagine relying on that janky set of side effects for my own personal safety, and I can't recommend that anyone else do that either. If you want to use continuity (aka 'TOFU') for security and you insist on getting your crypto in the form of a browser Javascript application --- which is a bad idea for other reasons that I hope will become clearer later this year --- then you should just use an installable, non-auto-updatable Chrome application. People shouldn't play games with message crypto. I really don't think doing message crypto in browser Javascript is going to work out. Or, if it does, it will work out only after 5-10 year of semiregular hair-on-fire security emergencies that the world's most repressive governments will tend to know about a year or two before the rest of us do.
drakenot 11y ago
Speaking of e2e browser extensions, does anyone know what the status of Google's "End-to-End" chrome extension[0] is? They started the project in June of 2014 and the development pace on the project has been somewhat slow. I don't know if this is just a couple dev's 20% project or if it has dedicated resources, or what. [0] https://github.com/google/end-to-end https://github.com/google/end-to-end

by rdl 11y ago

farfromright 11y ago

Would you care to comment on Cyph [1]? They claim that they are able to approximate client side programs that provide e2e but in a non-plugin browser environment [2]. I know tptacek doesn't like it but he wasn't willing to go into a detailed account of why. [1] https://cyph.com https://cyph.com [2] https://docs.google.com/document/d/1XVh4ALXhbfxi70QSUY-xHclauob8O635bSySy6f1Ysk/edit?pref=2&pli=1 https://docs.google.com/document/d/1XVh4ALXhbfxi70QSUY-xHcla...

buu700 11y ago
Cyph cofounder here; thanks for the mention! It'd be great to hear thoughts from Moxie or anyone else on WebSign. By the way, I think this was the doc you meant to link to for [2]: http://cyph.team/websigndoc http://cyph.team/websigndoc.
eganist 11y ago
Hah. I had some time to think about that interaction and concluded (after a chat with a few peers at AppSec Cali) that he and I simply differ in mentality. I understand where he's coming from about the risks posed by that level of flexibility in the execution environment, but I'm also more prone to push for the idea that making encryption more convenient for all justifies taking some risks in terms of the execution environment so long as we can (to the best of our knowledge) sufficiently mitigate them. That and browser sandboxing helps a ton more than having someone break an app running in userspace. His objection might be at a more visceral level, which I understand but steadfastly disagree with.
- tptacek 11y ago
  You guys seem to remember more about "this interaction" than I do. Someone want to bring me up to speed?
  - buu700 11y ago
    There was a thread a couple months back where I brought up WebSign (Cyph's TOFU in-browser code signing layer) in response to a story about MEGAChat, which you generally disapproved of but didn't go into detail on why. There was also some related back-and-forth between you and eganist. My impression was that you hadn't necessarily had the chance to fully digest the architecture due to time constraints on your end, and were coming more from a position of "the premise of this is scary and it's almost definitely broken in some way" than of having identified a specific flaw. Also, as eganist noted here, you may have held a different opinion than us on the drawbacks of the flexible execution environment (despite Cyph's partial mitigations of TypeScript for static typing and asm.js for pseudo-native crypto) vs the benefits of the well-vetted sandbox.
    - tptacek 11y ago
      Oh wow, is Cyph the one with the elaborate caching scheme where they invalidate the certificate once a week to prevent the package, once downloaded, from ever reloading itself off the website?
      - buu700 11y ago
        Yep, that's it. (To clarify, the signed package is freshly downloaded each time; it's just the root of the origin of the application that's pinned via "HPKP suicide" invalidation.)
        tptacek 11y ago
        Look, it's clever. I mean it. I'm not saying the people that came up with that insane scheme were dumb to do that. It would be a good research project! But I can't imagine relying on that janky set of side effects for my own personal safety, and I can't recommend that anyone else do that either. If you want to use continuity (aka 'TOFU') for security and you insist on getting your crypto in the form of a browser Javascript application --- which is a bad idea for other reasons that I hope will become clearer later this year --- then you should just use an installable, non-auto-updatable Chrome application. People shouldn't play games with message crypto. I really don't think doing message crypto in browser Javascript is going to work out. Or, if it does, it will work out only after 5-10 year of semiregular hair-on-fire security emergencies that the world's most repressive governments will tend to know about a year or two before the rest of us do.

drakenot 11y ago

Speaking of e2e browser extensions, does anyone know what the status of Google's "End-to-End" chrome extension[0] is? They started the project in June of 2014 and the development pace on the project has been somewhat slow. I don't know if this is just a couple dev's 20% project or if it has dedicated resources, or what. [0] https://github.com/google/end-to-end https://github.com/google/end-to-end