5 ms·

What the article fails to mention: 1) I would assume Facebook still gets unencrypted access to my address book for use with their shadow profiles 2) We have z

by pilif 11y ago

What the article fails to mention: 1) I would assume Facebook still gets unencrypted access to my address book for use with their shadow profiles 2) We have zero control over what key the client encrypts the messages for. Is it only the other peer's phone? Or is it for the peer's phone plus Facebook for analysis of the messages? Especially 2) is of some concern to me (against 1 I can't protect myself anyways because if people add me to their address books I'm screwed anyways). From that perspective, I'm still inclined to trust apple's iMessage a bit more especially after recent events. The only safe solution right now is to compile your own signal client and use that, of course at the cost of reach because nobody else is on Signal. WhatsApp might be a good compromise at least for only semi-important messages: The probability that any of your contacts has WhatsApp is much, much higher than the probability of them having Signal running. On the other hand, whatever you're sending over WhatsApp is likely going to be used by FB (and then possibly handed out to governments and/or stolen by attackers).

tptacek 11y ago
I think this is a reasonable analysis. I would refine it this way (examples are only for illustrative purposes): Tier 1 secure messengers: all possible tradeoffs in favor of security made; use for worst-case adversaries: - Signal/TextSecure - Pond - PGP† - OTR Tier 2 secure messengers: serious secure messaging protocols that make some tradeoffs in favor of adoption and usability; use for normal messages of low sensitivity: - WhatsApp - iMessage Tier 3 secure messengers: secure messaging protocols with flaws, limited cryptanalysis, only content-controlled browser clients, &c - Redacted to avoid flamewars. Everything else: insecure; use only to bootstrap conversations to a Tier 2 protocol (knowing that if you're a state-level target, you're exposed even after you "upgrade") - Google Talk - Facebook Messenger - AIM I think WhatsApp would like to be a tier 1 secure messenger (they'd be the first mainstream tier 1 secure messenger!) and they have a shot at being that, but they're probably some years away from it. † (I know PGP and OTR are cryptographically limited compared to Signal Protocol, but from an OPSEC perspective they're still a tier above iMessage.)
- swombat 11y ago
  > - Redacted to avoid flamewars. Aww... shucks.
  - tptacek 11y ago
    My Twitter mentions are noisy enough already this week. :)
  - knocknock 11y ago
    I'm assuming Telegram.
- slasaus 11y ago
  Don't forget Ricochet†, it only does synchronous communication but it does solve the problem of leaking meta-data. All the other clients except Pond leak meta-data. † https://ricochet.im/ https://ricochet.im/
  - tptacek 11y ago
    Ricochet appears to rely on Tor's encryption, with an additional custom RSA handshake. That's two added levels of "nope" for me, but other people might feel differently.
    - slasaus 11y ago
      I can see that but I think the self authenticating nature of Tor Onion Services and therefore bypassing bgp, dns and CA weaknesses is worth something†. Maybe in the future when prop224†† is implemented the encryption will be more solid. † https://media.ccc.de/v/32c3-7322-tor_onion_services_more_useful_than_you_think https://media.ccc.de/v/32c3-7322-tor_onion_services_more_use... †† https://gitweb.torproject.org/user/asn/torspec.git/tree/proposals/224-rend-spec-ng.txt?h=prop224-fixes https://gitweb.torproject.org/user/asn/torspec.git/tree/prop...
      - tptacek 11y ago
pfg 11y ago
> From that perspective, I'm still inclined to trust apple's iMessage a bit more especially after recent events. // edit: got my answer here: https://news.ycombinator.com/item?id=11432629 https://news.ycombinator.com/item?id=11432629 I'm curious, is that because of what they did in the FBI case, or for technical reasons? IIRC iMessage would allow Apple to add public keys which they (or the FBI/$ADVERSARY) control as a sort-of backdoor as well. I can't say that I've been keeping track of Facebook's position or history on this topic, so it might or might not be fair to say that Apple deserves more trust here, but on a technical level there's not much of a difference.
- jd20 11y ago
  The unfortunate reality too is that average users will never go to the extra trouble of authenticating keys themselves. I'm also more likely to trust a company like Apple or Google with key management than a "trusted third party" (simply because they're bigger companies, with more valuable brands to protect, and resources to throw at the problem). So, it feels like for the average consumer, a product like iMessage ticks all the necessary boxes. While WhatsApp adding features like the ability to compare your keys via a QR code looks cool, I have to wonder how many users will actually take advantage (and how would they even know if that number or QR code really represents what they think it does?)
  - pfg 11y ago
    Manual authentication via QR (or comparing the digits) works on top of the server-side authentication. It does what iMessage does, but you also have the option to actually compare the fingerprints if you are so inclined.
  - nickik 11y ago
    The good thing about verification is that if only a few people do it, it already profieds a benefit.
hannob 11y ago
> From that perspective, I'm still inclined to trust apple's iMessage a bit more especially after recent events. I'm surprised by this statement. After recent events I'd say the imessage protocoll is a weird ad-hoc construction that failed to follow basic modern crypto constructions like authenticated encryption and forward secrecy. I don't expect anything alike from the signal protocol.
- pilif 11y ago
  The one thing iMessage and WhatsApp have in common is that they both end-to-end encrypt without giving the user control over the keys being used. So ignoring actual protocol and implementation flaws (I agree with you that WhisperSystems will probably be ahead of Apple there), both rely on the key management being done in a thrustworthy manner. And this is where I trust Apple more than Facebook, especially in light of the recent FBI events. If Apple says they are not maliciously injecting fake public keys for the purpose of surveillance and marketing, I tend to believe Apple. If Facebook is silent about this, I assume they are doing it.
  - ianmiers 11y ago
    WhatsApp allows you to verify keys. Apple doesn't. This makes a pretty big difference. Also, iMessage's crypto protocol is cryptographically broken. It's been patched together in ways that prevent the obvious attack, but don't actually fix the underlying issue. Doing so involves replacing the protocol. In the mean time, those patches are not fool proof and someone may get around them.
    - pilif 11y ago
      > Whats App allows you to verify keys. Apple doesn't. This makes a pretty big difference. Does it? It allows me to verify a key. It doesn't give me any ability to control what other keys it's working with. This only helps me to make sure that the message I just got, I actually got from the person it's claiming to be. It doesn't give me any other protection though. I agree about the broken iMessage crypto and I hope to see Apple upgrade the protocol in a future OS release. With their quick uptake of new OSes, a fix could propagate relatively quickly.
Mafana0 11y ago
> whatever you're sending over WhatsApp is likely going to be used by FB The article links to the technical white paper[0] which explains why your points are invalid. > I'm still inclined to trust apple's iMessage a bit more Do you have any proof why iMessage is more secure or is that statement also baseless? [0]: https://www.whatsapp.com/security/WhatsApp-Security-Whitepaper.pdf https://www.whatsapp.com/security/WhatsApp-Security-Whitepap...
- colordrops 11y ago
  A white paper is not an implementation. Whatsapp is owned by Facebook and required to increase their bottom line. They are not a charity.
  - Mafana0 11y ago
    Assuming Facebook is lying isn't a very good technical argument. There are other ways for them to make profit than doing the shady things you are implicitly accusing them of doing without any base.
    - colordrops 11y ago
      They spent billions on WhatsApp. I'm open to suggestions - how would they profit on it if all the data that passed through it was opaque to them? Perhaps they are just catering to a recent strong interest by the public in encryption.
- pilif 11y ago
  The white paper doesn't say anything about additional public keys messages are encrypted for. It states that: - The private keys remain on the devices (which is good, but they don't need them to read your messages) - The messages can't be read by WhatsApp (they don't say anything about their parent company Facebook or governments though). If you read all the whitepapers and alert messages, you can totally read them in a way that allows Facebook to see, store and analyze the clear-text of every message you're sending, without anybody lying anywhere.

by pilif 11y ago

tptacek 11y ago

I think this is a reasonable analysis. I would refine it this way (examples are only for illustrative purposes): Tier 1 secure messengers: all possible tradeoffs in favor of security made; use for worst-case adversaries: - Signal/TextSecure - Pond - PGP† - OTR Tier 2 secure messengers: serious secure messaging protocols that make some tradeoffs in favor of adoption and usability; use for normal messages of low sensitivity: - WhatsApp - iMessage Tier 3 secure messengers: secure messaging protocols with flaws, limited cryptanalysis, only content-controlled browser clients, &c - Redacted to avoid flamewars. Everything else: insecure; use only to bootstrap conversations to a Tier 2 protocol (knowing that if you're a state-level target, you're exposed even after you "upgrade") - Google Talk - Facebook Messenger - AIM I think WhatsApp would like to be a tier 1 secure messenger (they'd be the first mainstream tier 1 secure messenger!) and they have a shot at being that, but they're probably some years away from it. † (I know PGP and OTR are cryptographically limited compared to Signal Protocol, but from an OPSEC perspective they're still a tier above iMessage.)

swombat 11y ago
> - Redacted to avoid flamewars. Aww... shucks.
- tptacek 11y ago
  My Twitter mentions are noisy enough already this week. :)
- knocknock 11y ago
  I'm assuming Telegram.
slasaus 11y ago
Don't forget Ricochet†, it only does synchronous communication but it does solve the problem of leaking meta-data. All the other clients except Pond leak meta-data. † https://ricochet.im/ https://ricochet.im/
- tptacek 11y ago
  Ricochet appears to rely on Tor's encryption, with an additional custom RSA handshake. That's two added levels of "nope" for me, but other people might feel differently.
  - slasaus 11y ago
    I can see that but I think the self authenticating nature of Tor Onion Services and therefore bypassing bgp, dns and CA weaknesses is worth something†. Maybe in the future when prop224†† is implemented the encryption will be more solid. † https://media.ccc.de/v/32c3-7322-tor_onion_services_more_useful_than_you_think https://media.ccc.de/v/32c3-7322-tor_onion_services_more_use... †† https://gitweb.torproject.org/user/asn/torspec.git/tree/proposals/224-rend-spec-ng.txt?h=prop224-fixes https://gitweb.torproject.org/user/asn/torspec.git/tree/prop...
    - tptacek 11y ago

pfg 11y ago

> From that perspective, I'm still inclined to trust apple's iMessage a bit more especially after recent events. // edit: got my answer here: https://news.ycombinator.com/item?id=11432629 https://news.ycombinator.com/item?id=11432629 I'm curious, is that because of what they did in the FBI case, or for technical reasons? IIRC iMessage would allow Apple to add public keys which they (or the FBI/$ADVERSARY) control as a sort-of backdoor as well. I can't say that I've been keeping track of Facebook's position or history on this topic, so it might or might not be fair to say that Apple deserves more trust here, but on a technical level there's not much of a difference.

jd20 11y ago
The unfortunate reality too is that average users will never go to the extra trouble of authenticating keys themselves. I'm also more likely to trust a company like Apple or Google with key management than a "trusted third party" (simply because they're bigger companies, with more valuable brands to protect, and resources to throw at the problem). So, it feels like for the average consumer, a product like iMessage ticks all the necessary boxes. While WhatsApp adding features like the ability to compare your keys via a QR code looks cool, I have to wonder how many users will actually take advantage (and how would they even know if that number or QR code really represents what they think it does?)
- pfg 11y ago
  Manual authentication via QR (or comparing the digits) works on top of the server-side authentication. It does what iMessage does, but you also have the option to actually compare the fingerprints if you are so inclined.
- nickik 11y ago
  The good thing about verification is that if only a few people do it, it already profieds a benefit.

hannob 11y ago

> From that perspective, I'm still inclined to trust apple's iMessage a bit more especially after recent events. I'm surprised by this statement. After recent events I'd say the imessage protocoll is a weird ad-hoc construction that failed to follow basic modern crypto constructions like authenticated encryption and forward secrecy. I don't expect anything alike from the signal protocol.

pilif 11y ago
The one thing iMessage and WhatsApp have in common is that they both end-to-end encrypt without giving the user control over the keys being used. So ignoring actual protocol and implementation flaws (I agree with you that WhisperSystems will probably be ahead of Apple there), both rely on the key management being done in a thrustworthy manner. And this is where I trust Apple more than Facebook, especially in light of the recent FBI events. If Apple says they are not maliciously injecting fake public keys for the purpose of surveillance and marketing, I tend to believe Apple. If Facebook is silent about this, I assume they are doing it.
- ianmiers 11y ago
  WhatsApp allows you to verify keys. Apple doesn't. This makes a pretty big difference. Also, iMessage's crypto protocol is cryptographically broken. It's been patched together in ways that prevent the obvious attack, but don't actually fix the underlying issue. Doing so involves replacing the protocol. In the mean time, those patches are not fool proof and someone may get around them.
  - pilif 11y ago
    > Whats App allows you to verify keys. Apple doesn't. This makes a pretty big difference. Does it? It allows me to verify a key. It doesn't give me any ability to control what other keys it's working with. This only helps me to make sure that the message I just got, I actually got from the person it's claiming to be. It doesn't give me any other protection though. I agree about the broken iMessage crypto and I hope to see Apple upgrade the protocol in a future OS release. With their quick uptake of new OSes, a fix could propagate relatively quickly.

Mafana0 11y ago

> whatever you're sending over WhatsApp is likely going to be used by FB The article links to the technical white paper[0] which explains why your points are invalid. > I'm still inclined to trust apple's iMessage a bit more Do you have any proof why iMessage is more secure or is that statement also baseless? [0]: https://www.whatsapp.com/security/WhatsApp-Security-Whitepaper.pdf https://www.whatsapp.com/security/WhatsApp-Security-Whitepap...

colordrops 11y ago
A white paper is not an implementation. Whatsapp is owned by Facebook and required to increase their bottom line. They are not a charity.
- Mafana0 11y ago
  Assuming Facebook is lying isn't a very good technical argument. There are other ways for them to make profit than doing the shady things you are implicitly accusing them of doing without any base.
  - colordrops 11y ago
    They spent billions on WhatsApp. I'm open to suggestions - how would they profit on it if all the data that passed through it was opaque to them? Perhaps they are just catering to a recent strong interest by the public in encryption.
pilif 11y ago
The white paper doesn't say anything about additional public keys messages are encrypted for. It states that: - The private keys remain on the devices (which is good, but they don't need them to read your messages) - The messages can't be read by WhatsApp (they don't say anything about their parent company Facebook or governments though). If you read all the whitepapers and alert messages, you can totally read them in a way that allows Facebook to see, store and analyze the clear-text of every message you're sending, without anybody lying anywhere.