4 ms·

Much of the criticism of how gently WhatsApp and Signal handle key resets misses the mark. Widespread adoption of end-to-end encrypted messaging is an effective

Much of the criticism of how gently WhatsApp and Signal handle key resets misses the mark. Widespread adoption of end-to-end encrypted messaging is an effective countermeasure to passive collection and blanket surveillance. In order to get that widespread adoption, you can't be showing people skull-and-crossbones warnings every time they swap out a SIM card. Speaking from my experience getting journalists and political campaigns set up with signal in 2017-2018, the early scary key change warnings were off-putting to people and made them reluctant to continue with the messenger. At the time, I was in contact with 100-150 people via signal and quickly ran out of patience with anyone who insisted on a safety number check. But the UI at the time encouraged that level of paranoia. I continue to believe that making key changes as painless as possible for users is the correct approach as long as there are ways to harden this behavior in the settings, for the benefit of the far smaller set of people to whom MITM attacks are a credible threat.

BostonEnginerd 8y ago
I agree with your assessment about key change management. With that said, I do like the device history trail that Keybase uses. Keybase has a better multi-device story - in that it has a multi-device story at all. I understand what they're trying to do preserving message history - I do prefer my conversations to be ephemeral by default. I'm OK with the compromise that Signal has made with key management -- there are people that I really care to have private communication with, and people who I prefer to have private communication with. I verify the former, and don't bother with the latter unless we happen to be bored together in the same room. On a side note, thanks for your efforts over the last two years!
- idlewords 8y ago
  The user base for Keybase and Signal is so different that it makes sense to have such different behaviors. Thanks very much for the kind words!
  - chb 8y ago
    I would have thought that these two groups would have more in common than not. Who do you think constitutes these disparate user bases and how are their perceived expectations different?
peterwwillis 8y ago
A solution to this would be selective enforcement. Let the user decide if they want "light" (auto accept new keys), "strong" (skull and crossbones), or "paranoid" (auto-block any new keys) security. The same should be applicable to browsers, I think. When logged into your bank, you should be able to click a button that says "Make this website use paranoid security" or similar, which would apply very strict policies that prevent most HTTPS attacks, and maybe even enable protection against phishing and similar domains, or something. I don't know why apps keep painting users into a corner with one generic option rather then giving them more choices.
- tracker1 8y ago
  Wouldn't you actually want the opposite behavior... any "password" field should have a dialog with, "Are you certain this is the site you want to log into?" then you can check, "oh yeah that isn't my bank." edit: If I don't get an autofill option from LastPass, I'm incredibly skeptical if it is the right site.
  - peterwwillis 8y ago
    There's a couple problems with that. Not all sites get their password forms detected correctly. And sites may change their design, causing the old form to stop being cached correctly. It would be hard to tell if changes were just design updates or phishing, and I think the layman would be hard-pressed to make that determination. Really I think we need something akin to app shortcuts. If you want to log in to your bank, you should be able to go to your browser's Home page and find some kind of signed login link that was created the first time you logged in. It's like a bookmark, but following a particular standard, and can be pushed by the site and accepted by the user one time, with warnings and instructions to keep users from accepting it from phishers. The intent would be to add a process that would be hard to dupe users into following by accident, and giving them easy access to sensitive sites. Then the site could tell users "never follow a link in an e-mail from us, always use your Home screen shortcut" or similar. Browsers could even vet these via a kind of "app store for logins" to remove anything that looks like phishing. Maybe that's been explored before, though?
a3_nm 8y ago
> you can't be showing people skull-and-crossbones warnings every time they swap out a SIM card But isn't Keybase's solution precisely about ensuring that this doesn't happen? If you change your phone's SIM card, the phone still remembers its secret key.
comex 8y ago
I agree that there will always be some instances of key changes, and that you can't make that too scary or else it just drives users away. But it's not all or nothing. Signal could do better at improving their UX to reduce the number of key changes people make in practice. If they did, they could probably make the prompt slightly more scary (but not Keybase-level scary) – but even if they didn't change the prompt, the mere fact that users wouldn't see it as frequently means they'd be more likely to pay attention when they did. In particular, according on other posts in this thread, the backup/restore mechanism that allows transferring a key between devices currently has poor UX, only works on Android, is buggy. Obviously that should be fixed. Once that's done, they should make the app actively prompt you to transfer the key as part of the setup process, using a QR code scanned from either the previous phone or a linked computer. You would still have the option not to do so, and some users would inevitably choose that option (if only out of laziness), but if transferring the key is seamless enough, a decent fraction of users would do it.
eadmund 8y ago
> Widespread adoption of end-to-end encrypted messaging is an effective countermeasure to passive collection and blanket surveillance. Widespread adoption of MitM-capable encrypted messaging active collection and targeted surveillance.

BostonEnginerd 8y ago

I agree with your assessment about key change management. With that said, I do like the device history trail that Keybase uses. Keybase has a better multi-device story - in that it has a multi-device story at all. I understand what they're trying to do preserving message history - I do prefer my conversations to be ephemeral by default. I'm OK with the compromise that Signal has made with key management -- there are people that I really care to have private communication with, and people who I prefer to have private communication with. I verify the former, and don't bother with the latter unless we happen to be bored together in the same room. On a side note, thanks for your efforts over the last two years!

idlewords 8y ago
The user base for Keybase and Signal is so different that it makes sense to have such different behaviors. Thanks very much for the kind words!
- chb 8y ago
  I would have thought that these two groups would have more in common than not. Who do you think constitutes these disparate user bases and how are their perceived expectations different?

peterwwillis 8y ago

A solution to this would be selective enforcement. Let the user decide if they want "light" (auto accept new keys), "strong" (skull and crossbones), or "paranoid" (auto-block any new keys) security. The same should be applicable to browsers, I think. When logged into your bank, you should be able to click a button that says "Make this website use paranoid security" or similar, which would apply very strict policies that prevent most HTTPS attacks, and maybe even enable protection against phishing and similar domains, or something. I don't know why apps keep painting users into a corner with one generic option rather then giving them more choices.

tracker1 8y ago
Wouldn't you actually want the opposite behavior... any "password" field should have a dialog with, "Are you certain this is the site you want to log into?" then you can check, "oh yeah that isn't my bank." edit: If I don't get an autofill option from LastPass, I'm incredibly skeptical if it is the right site.
- peterwwillis 8y ago
  There's a couple problems with that. Not all sites get their password forms detected correctly. And sites may change their design, causing the old form to stop being cached correctly. It would be hard to tell if changes were just design updates or phishing, and I think the layman would be hard-pressed to make that determination. Really I think we need something akin to app shortcuts. If you want to log in to your bank, you should be able to go to your browser's Home page and find some kind of signed login link that was created the first time you logged in. It's like a bookmark, but following a particular standard, and can be pushed by the site and accepted by the user one time, with warnings and instructions to keep users from accepting it from phishers. The intent would be to add a process that would be hard to dupe users into following by accident, and giving them easy access to sensitive sites. Then the site could tell users "never follow a link in an e-mail from us, always use your Home screen shortcut" or similar. Browsers could even vet these via a kind of "app store for logins" to remove anything that looks like phishing. Maybe that's been explored before, though?

a3_nm 8y ago

> you can't be showing people skull-and-crossbones warnings every time they swap out a SIM card But isn't Keybase's solution precisely about ensuring that this doesn't happen? If you change your phone's SIM card, the phone still remembers its secret key.

comex 8y ago

I agree that there will always be some instances of key changes, and that you can't make that too scary or else it just drives users away. But it's not all or nothing. Signal could do better at improving their UX to reduce the number of key changes people make in practice. If they did, they could probably make the prompt slightly more scary (but not Keybase-level scary) – but even if they didn't change the prompt, the mere fact that users wouldn't see it as frequently means they'd be more likely to pay attention when they did. In particular, according on other posts in this thread, the backup/restore mechanism that allows transferring a key between devices currently has poor UX, only works on Android, is buggy. Obviously that should be fixed. Once that's done, they should make the app actively prompt you to transfer the key as part of the setup process, using a QR code scanned from either the previous phone or a linked computer. You would still have the option not to do so, and some users would inevitably choose that option (if only out of laziness), but if transferring the key is seamless enough, a decent fraction of users would do it.

eadmund 8y ago

> Widespread adoption of end-to-end encrypted messaging is an effective countermeasure to passive collection and blanket surveillance. Widespread adoption of MitM-capable encrypted messaging active collection and targeted surveillance.