6 ms·

Apparently some researchers from the GCHQ in the UK are proposing that "secure" messaging systems like iMessage and WhatsApp which manage group chats centrally

Apparently some researchers from the GCHQ in the UK are proposing that "secure" messaging systems like iMessage and WhatsApp which manage group chats centrally in a manner that bypasses the end to end encryption should: - Add "ghost" users/devices to existing chats - Suppress notifications of these additions to users This would perpetuate a currently known bug in secure communication protocols, effectively turning it into "feature" for law enforcement. Fortunately, systems like Signal and Briar have already moved past this flaw.

EGreg 8y ago
What does that mean, “manage centrally in a manner”... and how does Signal not manage it centrally?
- vonseel 8y ago
  Signal groups are managed by the client devices. The details are quite complicated, but some are documented here: https://signal.org/blog/private-groups/ https://signal.org/blog/private-groups/ Perhaps another user with stronger familiarity on the subject can expand on this (ELI5 would be great!).
  - EGreg 8y ago
    Interesting. Compare https://safenetworkprimer.com/ https://safenetworkprimer.com/ by the way
  - zzzcpan 8y ago
    Signal client is centrally managed and can be updated for every user. And it's quite ridiculous claim that Signal can't implement a backdoor in the client because of some arbitrary design choice.
    - gepoch 8y ago
      Yeah security is not really "proveable" in any software system. However, a few points to consider: 1. The signal server can't "see" the group. Clients are just sending N messages to everyone in the group with some encrypted metadata that says it's a group message. 2. The client app is open source. You can go look for a ghost user or backdoor mechanism yourself. 3. The build is reproduceable. You can build it yourself and sideload your own APK, or compare it to the APK coming from the play store. I don't think it's impossible to put a backdoor in, but I think it at least makes vigilance a good defense. Smart serious people are paying attention.
      - maxerickson 8y ago
        Binaries are not opaque gibberish, it is possible to analyze them. And of course for major apps, there are people doing so.
        hinata 8y ago
        Are these analysis efforts publically viewable?
      - xorcist 8y ago
        > The build is reproduceable. You can build it yourself and sideload your own APK, or compare it to the APK Have you tried this? Most people seems content that there is some source available and trust the binary. That may not be an option for everyone.
        Arnt 8y ago
        I have tried it. There's a non-zero number of people around the world who check the builds. Your security rests on the difficulty of feeding you a subverted APK without feeding any of them the same APK.
        xorcist 8y ago
        Would you mind sharing how?
    - pariahHN 8y ago
      Yes but they would have to alter the clients code - this would be reflected in the source and comparing hashes of the binary (as Signal would have to keep that code change out of the public repo). So yes, the design of the system quite effectively prevents a client side backdoor from going unnoticed. Edit: also, this is a deliberate design choice not an arbitrary one.
goblin89 8y ago
Keybase Teams—also featuring e2e-encrypted group chat—appears to be proof against the ghost-user-based attack. It would be interesting to compare its implementation to how Signal does group messaging in TextSecure v2. [0] https://keybase.io/blog/introducing-keybase-teams#anyway-teams-have-signature-chains https://keybase.io/blog/introducing-keybase-teams#anyway-tea...
- maxtaco 8y ago
  Thanks for the mention! We designed Keybase with these exact attacks in mind.
zzo38computer 8y ago
What is need is open protocols. Users can write their own implementation if they do not want to use the existing ones. WhatsApp uses XMPP according to Wikipedia, so you could implement your own according to XMPP, I suppose. You might also just use your own programs and protocols. If the messages are encrypted with the recipient's key then nobody else can know what is the message, but only that there is a message. So, you can implement encryption on client the server does not need to know about it.
Tsubasachan 8y ago
Signal is great and all but does it scale? If half a billion people sign up tomorrow can they cope? How deep are their coffers?
- tivert 8y ago
  > Signal is great and all but does it scale? If half a billion people sign up tomorrow can they cope? How deep are their coffers? At least $50 million, courtesy of a WhatsApp founder: https://www.wired.com/story/signal-foundation-whatsapp-brian-acton/ https://www.wired.com/story/signal-foundation-whatsapp-brian...

EGreg 8y ago

What does that mean, “manage centrally in a manner”... and how does Signal not manage it centrally?

vonseel 8y ago
Signal groups are managed by the client devices. The details are quite complicated, but some are documented here: https://signal.org/blog/private-groups/ https://signal.org/blog/private-groups/ Perhaps another user with stronger familiarity on the subject can expand on this (ELI5 would be great!).
- EGreg 8y ago
  Interesting. Compare https://safenetworkprimer.com/ https://safenetworkprimer.com/ by the way
- zzzcpan 8y ago
  Signal client is centrally managed and can be updated for every user. And it's quite ridiculous claim that Signal can't implement a backdoor in the client because of some arbitrary design choice.
  - gepoch 8y ago
    Yeah security is not really "proveable" in any software system. However, a few points to consider: 1. The signal server can't "see" the group. Clients are just sending N messages to everyone in the group with some encrypted metadata that says it's a group message. 2. The client app is open source. You can go look for a ghost user or backdoor mechanism yourself. 3. The build is reproduceable. You can build it yourself and sideload your own APK, or compare it to the APK coming from the play store. I don't think it's impossible to put a backdoor in, but I think it at least makes vigilance a good defense. Smart serious people are paying attention.
    - maxerickson 8y ago
      Binaries are not opaque gibberish, it is possible to analyze them. And of course for major apps, there are people doing so.
      - hinata 8y ago
        Are these analysis efforts publically viewable?
    - xorcist 8y ago
      > The build is reproduceable. You can build it yourself and sideload your own APK, or compare it to the APK Have you tried this? Most people seems content that there is some source available and trust the binary. That may not be an option for everyone.
      - Arnt 8y ago
        I have tried it. There's a non-zero number of people around the world who check the builds. Your security rests on the difficulty of feeding you a subverted APK without feeding any of them the same APK.
        xorcist 8y ago
        Would you mind sharing how?
  - pariahHN 8y ago
    Yes but they would have to alter the clients code - this would be reflected in the source and comparing hashes of the binary (as Signal would have to keep that code change out of the public repo). So yes, the design of the system quite effectively prevents a client side backdoor from going unnoticed. Edit: also, this is a deliberate design choice not an arbitrary one.

goblin89 8y ago

Keybase Teams—also featuring e2e-encrypted group chat—appears to be proof against the ghost-user-based attack. It would be interesting to compare its implementation to how Signal does group messaging in TextSecure v2. [0] https://keybase.io/blog/introducing-keybase-teams#anyway-teams-have-signature-chains https://keybase.io/blog/introducing-keybase-teams#anyway-tea...

maxtaco 8y ago
Thanks for the mention! We designed Keybase with these exact attacks in mind.

zzo38computer 8y ago

What is need is open protocols. Users can write their own implementation if they do not want to use the existing ones. WhatsApp uses XMPP according to Wikipedia, so you could implement your own according to XMPP, I suppose. You might also just use your own programs and protocols. If the messages are encrypted with the recipient's key then nobody else can know what is the message, but only that there is a message. So, you can implement encryption on client the server does not need to know about it.

Tsubasachan 8y ago

Signal is great and all but does it scale? If half a billion people sign up tomorrow can they cope? How deep are their coffers?

tivert 8y ago
> Signal is great and all but does it scale? If half a billion people sign up tomorrow can they cope? How deep are their coffers? At least $50 million, courtesy of a WhatsApp founder: https://www.wired.com/story/signal-foundation-whatsapp-brian-acton/ https://www.wired.com/story/signal-foundation-whatsapp-brian...