5 ms·

Matrix handles this by exposing the device keys to the user so they can make decisions about whether to trust new devices (and I believe identity key changes me

by cyphar 8y ago

Matrix handles this by exposing the device keys to the user so they can make decisions about whether to trust new devices (and I believe identity key changes mean you wouldn't be in your rooms anymore -- but in order to change identity keys you would have to delete you entire Matrix account on the homeserver). If a new device has shown up, your messages will be blocked from being sent until you verify the new device. To be fair, it is too easy to blaze past the warning -- and it can happen often in large rooms. As a result, it's a little bit cumbersome at the moment, but with device cross-signing coming down the pipe and the new verification system (which is much better than Signal's IMHO -- you just check both devices have the same string of 7 emoji on their screen) it's getting a lot better.

IshKebab 8y ago
Yeah that sounds like it doesn't really solve it at all (yet).
- cyphar 8y ago
  It does partially solve the issue of continuing to send messages without any sort of warning -- new devices mean your messages won't send unless you hit the "send anyway" button (and in your settings you can disable the send anyway option). It also solves a problem that Keybase has which is that all new devices are automatically trusted (so a compromised device can just register more devices to avoid being blocked). To be fair, this makes for a pretty bad UX -- and the Matrix folks are working on cross-signing to make this easier -- but it is very useful for a user to be able to detect new devices to be detected (especially their own).
ajvs 8y ago
Yeah usability-wise it's not the greatest right now until those features get added, but security-wise it's better than Signal/WhatsApp in warning you about detected new keys.
UncleMeat 8y ago
This works great for incredibly tech savvy people who have an offline way of verifying public keys. This is completely and utterly useless for 99.9% of whatsapp's 1b+ users. Heck, how many times have security-aware software engineers blazed through the "THIS KEY IS NOT TRUSTED" warning from ssh?
- BenjiWiebe 8y ago
  I ignore the ssh key not trusted only if i know why it isn't trusted.
  - zepearl 8y ago
    Same here, at least privately - it happened a couple of times that I renewed or changed for whatever reason the key on some server and a few days later when I tried to connect using a secondary device I got the warning, which made me go to defcon-2 for at least a few minutes, hehe. On the other hand, at the company I work for, internal machine certificates/keys are renewed without my involvement (I'm a so-called "IT-owner" of some apps and the infrastructure that the apps use), and therefore I get the warning when connecting to their Linux hosts but each time (few times every few years, but still...) I dismiss it hoping that it's because of the work of the admins renewing the certificates (clarifying who-did-what-when would be a potential major administrative undertaking) => this is absolutely a flaw of the internal processes. Yes, it could be fixed by a more complex infrastructure, but again, if the internal processes are weak then even the more-complex-infrastructure could be compromised by side-attacks.
  - ndnxhs 8y ago
    Same. If I reinstall the OS on my raspberry pi I will ignore the warning. I once had an issue where using the WiFi hotspot on a coworkers phone caused the SSH warning to trigger and neither of us could work out why. I did not ignore that warning.
- cyphar 8y ago
  Matrix's new key verification UX is incredibly intuitive. You press a button to verify the keys and then you out-of-band check that you're both looking at the same set of 7 emoji. This mutually-verifies both devices. I don't think it's possible for it to get any simpler. With cross-signing, this will get even easier because cross-signed devices will be automatically trusted.
uhoreg 8y ago
Yes, our (Matrix's) cross-signing feature, which we're currently working on, sounds similar to the solution presented by Keybase in this blog post.
- Arathorn 8y ago
  https://github.com/uhoreg/matrix-doc/blob/cross-signing2/proposals/1756-cross-signing.md https://github.com/uhoreg/matrix-doc/blob/cross-signing2/pro... is the spec for this, fwiw
eeeeeeeeeeeee 8y ago
I still think Keybase is right — multi-device or some kind of multi-trust model is best so the key revocations aren’t happening so often. I remember this problem with PGP and most people did not take the key verification seriously. And the problem with SSH that was pointed out in the article is funny now because of cloud services where servers are constantly being destroyed, so keys are changing frequently, unless you save and persist that private key for the server in your configuration. Which I’ve realized a lot of companies are simply not doing, which leads to people straight up ignoring key verifications in their ssh config.
- groestl 8y ago
  A side note on the last part: @cert-authority is an underrated feature of OpenSSH. More companies should use it to make their infrastructure safer to use.
  - chupasaurus 8y ago
    It has flaws in usage: issuer cert per group isn't easy to manage (and makes pubkeys 1000+ characters long), you have to distribute CRLs, one error in sshd_config could make server unmanagable (multiplied by your config manager). I haven't seen a pure SSH CA automation project too.
    - groestl 8y ago
      Can you elaborate on the first issue?
      - chupasaurus 8y ago
        You can make a certificate with multiple principals, but in order to add/remove some group access you'll have to reissue the public cert (and add previous to CRL with removal of some), which is OK for short-lived certs. With multiple issuers, you can add/remove public keys for different CAs but the resulting meta public key will be a set of keys actually.
- 8y ago
zobzu 8y ago
yup, one big issue is the warning coming up too often, not making it more visible or forcing it in like matrix does. because then you just end up with less people on the system, so you'll talk to them over unsafe channels. keybase's opinion is definitely my opinion so im a little biased there, but so far i can't think of anything that's better than making the reset occurs as rarely as possible by using multiple devices for recovery.
zepearl 8y ago
Just fyi, about "Matrix" (not directly related to this specific post, but I still wanted to mention something about it...): I started testing "Matrix" using the "Riot" app on Android and the web-frontend ~4 weeks ago and so far things look good, which I think is fantastic!!! I was especially happy to see that I could not read messages posted prior to me entering any encrypted chatrooms => gave me a real "good general feeling". The "Riot"-app for Android (using it on SailfishOS) is so far quite intuitive and it did never crash so far. Battery consumption is relatively heavy (I used to charge my phone once per week, now it's once every ~3-4 days) but I guess that other users that have more frequently an active Internet connection (because of other apps) will be impacted less. All in all I'm beginning to think to try to push it to my friends - I think that the first attempt might be to use an encrypted group chat for special themes (e.g. discussions about algorithms, stock market discussions, etc..., all what we do not dare to post in Whatsapp) to have a technical advantage vs. Whasapp & Co. .
- ndnxhs 8y ago
  Yeah the security of matrix + riot seems like the best of its kind. The issues come from the extra security causing some things to be a bit of a bad user experience but its getting better.

by cyphar 8y ago

IshKebab 8y ago

Yeah that sounds like it doesn't really solve it at all (yet).

cyphar 8y ago
It does partially solve the issue of continuing to send messages without any sort of warning -- new devices mean your messages won't send unless you hit the "send anyway" button (and in your settings you can disable the send anyway option). It also solves a problem that Keybase has which is that all new devices are automatically trusted (so a compromised device can just register more devices to avoid being blocked). To be fair, this makes for a pretty bad UX -- and the Matrix folks are working on cross-signing to make this easier -- but it is very useful for a user to be able to detect new devices to be detected (especially their own).

ajvs 8y ago

Yeah usability-wise it's not the greatest right now until those features get added, but security-wise it's better than Signal/WhatsApp in warning you about detected new keys.

UncleMeat 8y ago

This works great for incredibly tech savvy people who have an offline way of verifying public keys. This is completely and utterly useless for 99.9% of whatsapp's 1b+ users. Heck, how many times have security-aware software engineers blazed through the "THIS KEY IS NOT TRUSTED" warning from ssh?

BenjiWiebe 8y ago
I ignore the ssh key not trusted only if i know why it isn't trusted.
- zepearl 8y ago
  Same here, at least privately - it happened a couple of times that I renewed or changed for whatever reason the key on some server and a few days later when I tried to connect using a secondary device I got the warning, which made me go to defcon-2 for at least a few minutes, hehe. On the other hand, at the company I work for, internal machine certificates/keys are renewed without my involvement (I'm a so-called "IT-owner" of some apps and the infrastructure that the apps use), and therefore I get the warning when connecting to their Linux hosts but each time (few times every few years, but still...) I dismiss it hoping that it's because of the work of the admins renewing the certificates (clarifying who-did-what-when would be a potential major administrative undertaking) => this is absolutely a flaw of the internal processes. Yes, it could be fixed by a more complex infrastructure, but again, if the internal processes are weak then even the more-complex-infrastructure could be compromised by side-attacks.
- ndnxhs 8y ago
  Same. If I reinstall the OS on my raspberry pi I will ignore the warning. I once had an issue where using the WiFi hotspot on a coworkers phone caused the SSH warning to trigger and neither of us could work out why. I did not ignore that warning.
cyphar 8y ago
Matrix's new key verification UX is incredibly intuitive. You press a button to verify the keys and then you out-of-band check that you're both looking at the same set of 7 emoji. This mutually-verifies both devices. I don't think it's possible for it to get any simpler. With cross-signing, this will get even easier because cross-signed devices will be automatically trusted.

uhoreg 8y ago

Yes, our (Matrix's) cross-signing feature, which we're currently working on, sounds similar to the solution presented by Keybase in this blog post.

Arathorn 8y ago
https://github.com/uhoreg/matrix-doc/blob/cross-signing2/proposals/1756-cross-signing.md https://github.com/uhoreg/matrix-doc/blob/cross-signing2/pro... is the spec for this, fwiw

eeeeeeeeeeeee 8y ago

I still think Keybase is right — multi-device or some kind of multi-trust model is best so the key revocations aren’t happening so often. I remember this problem with PGP and most people did not take the key verification seriously. And the problem with SSH that was pointed out in the article is funny now because of cloud services where servers are constantly being destroyed, so keys are changing frequently, unless you save and persist that private key for the server in your configuration. Which I’ve realized a lot of companies are simply not doing, which leads to people straight up ignoring key verifications in their ssh config.

groestl 8y ago
A side note on the last part: @cert-authority is an underrated feature of OpenSSH. More companies should use it to make their infrastructure safer to use.
- chupasaurus 8y ago
  It has flaws in usage: issuer cert per group isn't easy to manage (and makes pubkeys 1000+ characters long), you have to distribute CRLs, one error in sshd_config could make server unmanagable (multiplied by your config manager). I haven't seen a pure SSH CA automation project too.
  - groestl 8y ago
    Can you elaborate on the first issue?
    - chupasaurus 8y ago
      You can make a certificate with multiple principals, but in order to add/remove some group access you'll have to reissue the public cert (and add previous to CRL with removal of some), which is OK for short-lived certs. With multiple issuers, you can add/remove public keys for different CAs but the resulting meta public key will be a set of keys actually.
8y ago

zobzu 8y ago

yup, one big issue is the warning coming up too often, not making it more visible or forcing it in like matrix does. because then you just end up with less people on the system, so you'll talk to them over unsafe channels. keybase's opinion is definitely my opinion so im a little biased there, but so far i can't think of anything that's better than making the reset occurs as rarely as possible by using multiple devices for recovery.

zepearl 8y ago

Just fyi, about "Matrix" (not directly related to this specific post, but I still wanted to mention something about it...): I started testing "Matrix" using the "Riot" app on Android and the web-frontend ~4 weeks ago and so far things look good, which I think is fantastic!!! I was especially happy to see that I could not read messages posted prior to me entering any encrypted chatrooms => gave me a real "good general feeling". The "Riot"-app for Android (using it on SailfishOS) is so far quite intuitive and it did never crash so far. Battery consumption is relatively heavy (I used to charge my phone once per week, now it's once every ~3-4 days) but I guess that other users that have more frequently an active Internet connection (because of other apps) will be impacted less. All in all I'm beginning to think to try to push it to my friends - I think that the first attempt might be to use an encrypted group chat for special themes (e.g. discussions about algorithms, stock market discussions, etc..., all what we do not dare to post in Whatsapp) to have a technical advantage vs. Whasapp & Co. .

ndnxhs 8y ago
Yeah the security of matrix + riot seems like the best of its kind. The issues come from the extra security causing some things to be a bit of a bad user experience but its getting better.