4 ms·

Security is about verifiability. If you can't verify it's secure, it's not trustworthy. I've been looking into secure communication stuff for almost ten years n

by maqp 7y ago

Security is about verifiability. If you can't verify it's secure, it's not trustworthy. I've been looking into secure communication stuff for almost ten years now, and there's a low bar that makes it easy to inspect whether the app developers are even trying. You want security for two things: Metadata and content. Content privacy is done with end-to-end encryption. You ask yourself 1) Can I find public key fingerprints from the app? If this is not available, the app is not end-to-end encrypted properly, and you should immediately abandon it. 2) If the app is end-to-end encrypted, can I inspect the source code to verify end-to-end encryption is implemented properly? If you can't do that, i.e. if the source code is not available, there's no way to trust the app. If you lack skills needed to do that, you can pitch into an audit by third party. 3) If the source is open, can I verify I'm using binary compiled from said source? I.e., does the client have reproducible builds. If all these three are true, then you can be sure it offers quite strong protection for your content. This is true for e.g. Signal. Regarding your Sagan Standard, the extraordinary claim is not "It has a backdoor because we can't check." The extraordinary claim is "It doesn't have a backdoor, it's secure, but no, you can't check that for yourself." At that point you need to have extraordinary proof that can verify the security. There's no pro-security argument in keeping an app proprietary, only monetary. --- Next, metadata: You ask yourself 1) Can I register the service anonymously, i.e. without giving any of my details 2) Can I connect (both register and use the app) via Tor? If not, your IP reveals your identity. 3) Who's hosting the service? Does a third party learn how often UID #4346455432 sends messages to other parties. I.e. is the app peer-to-peer. If the app is not peer-to-peer, your peers' bad OPSEC might deanonymize you if server-side data is cross-compared with an other social graph. 4) Can I misconfigure the system and lose anonymity (i.e. is the system Tor-routed by design or can you accidentally connect without Tor), and can you accidentally turn off end-to-end encryption and say something that might deanonymize you to the server? ToTok is not open source, it doesn't have public key fingerprints, and judging by the completely novice, non-technical name-dropping of a few primitives in their PR statement (https://totok.ai/news https://totok.ai/news): "Furthermore, we equipped ToTok with such high-security standards as AES256, TLS/SSL, RSA and SHA256, to diligently protect the user data. We also implemented a privacy framework that complies with the local and international legal requirements to safeguard our users at all times." It's trivial to implement backdoored system with said primitives: TLS is encryption that uses AES256, RSA, and SHA256, and it's only encryption between user and server, so server has access to plaintext data which can be given to the secret police etc. Even if they say they don't comply they might a) lie or b) be hacked. The only way to protect from that is to always use E2EE, something ToTok does not do. So no, there's no reason to trust them. They haven't even attempted to deploy E2EE or anonymity for their system. Even if they're not intentionally being evil, they're being ignorant about security and thus, ignorant about the human lives affected.

peter_d_sherman 7y ago
First off a few things: I appreciate your nuanced and well-written, well-thought out comments. You are a very smart person, and you are an excellent writer. I agree with what you said about 98%. We could stop here, and we could shake hands, or I could go on to describe the 2% of what you've written that I don't exactly agree with. With your permission, I'm going to discuss that 2%. Please understand that I mean you no personal offense in the following discussion. First understand that I in no way support ToTok, I don't use it, I have never used it, and don't really care to potentially use it. I have no financial or interest in the company. I didn't even know it existed until I read the NYT article. I do, on the other hand, have a very deep interest in Online Communities, Apps, Users, Users' rights, including but not limited to privacy, and Company's rights, including, but not limited to not being destroyed (financially and/or reputationally) by media smear campaigns, intentional or unintentional, explicit or implied. Now you say: "Regarding your Sagan Standard, the extraordinary claim is not "It has a backdoor because we can't check." The extraordinary claim is "It doesn't have a backdoor, it's secure, but no, you can't check that for yourself." No, the extraordinary claim is the title of the NYT article: "It Seemed Like a Popular Chat App. It’s Secretly a Spy Tool." Now... here's the thing (and this is where things get really subtle, so follow along closely!). That title, and all that the article alleges, might be 100% true! So what's the problem then? The potential problem looks something like this: Let's suppose that an app developer in the U.S. does all of the things you say to to, for the sake of security/privacy. OK, and now let's suppose that a Nation State Attacker -- our guys, their guys, whoever -- somehow subverts the security of the app (Browser/OS/Hardware/Network/? hacks) and gathers the apps' data. Now... let's suppose that some foreign newspaper, the foreign equivalent of the NYT -- prints a story that our friend, the U.S. app developer -- who did nothing wrong, and tried to do everything right -- is actually gathering data for the Nation State Attacker (foreign or domestic), and thus is a "Spy" tool. Well guess what! Under those conditions, the story is absolutely, absolutely CORRECT! Except that there's a teensy little problem... Call it a lie; call it an error of ommission... The problem is as follows: The problem is that this newspaper article's author/authors, being ignorant of the fact that there was NO INTENT of the app developer to have their app used as a "Spy Tool" -- yet that was the end effect, caused by circumstances and actors outside of the control of the app company! That's scenario #1. Scenario #2: The law/legal system of the country in question is used to force the intentional engineering of hidden backdoors for the Nation State Attacker, under penalty of a very long prison sentence... Either way, the paper's story is "correct" -- but it causes a crapload of harm to the application developer, who only wanted to make a dollar by providing an equal-and-opposite value, and never intended for these things to happen! Of course, if the ToTok developers intentionally engineered security holes while not being coerced to do so (and the NYT could present proof of this), THEN this article is clean, ethical journalism... otherwise the NYT should not have presented it until it had, and was willing to show to the world this proof... Would you want a story like this to break in some other part of the world, some part where you do business, but some part where you might lack the language/cultural/legal skills to defend you and your company, when you and your company are acting with the best intentions in mind? I'm not a Christian, but... remember that "Do Unto Others" quote... That's why we have have Due Process, The Right Of An Accuser to Face The Accused (Cross Examination), and the Presumption of Innocence -- in our U.S. system of Law... That's why in this day and age, I never assume that 100% of what the media says is true, 100% of the time. I am sorry, but even if ToTok has betrayed its user trust (and I'm not saying they did or didn't) -- then certainly the U.S. media has, more often than not, betrayed mine... I reiterate that the burden of proof -- is on the NYT.

by maqp 7y ago

peter_d_sherman 7y ago

First off a few things: I appreciate your nuanced and well-written, well-thought out comments. You are a very smart person, and you are an excellent writer. I agree with what you said about 98%. We could stop here, and we could shake hands, or I could go on to describe the 2% of what you've written that I don't exactly agree with. With your permission, I'm going to discuss that 2%. Please understand that I mean you no personal offense in the following discussion. First understand that I in no way support ToTok, I don't use it, I have never used it, and don't really care to potentially use it. I have no financial or interest in the company. I didn't even know it existed until I read the NYT article. I do, on the other hand, have a very deep interest in Online Communities, Apps, Users, Users' rights, including but not limited to privacy, and Company's rights, including, but not limited to not being destroyed (financially and/or reputationally) by media smear campaigns, intentional or unintentional, explicit or implied. Now you say: "Regarding your Sagan Standard, the extraordinary claim is not "It has a backdoor because we can't check." The extraordinary claim is "It doesn't have a backdoor, it's secure, but no, you can't check that for yourself." No, the extraordinary claim is the title of the NYT article: "It Seemed Like a Popular Chat App. It’s Secretly a Spy Tool." Now... here's the thing (and this is where things get really subtle, so follow along closely!). That title, and all that the article alleges, might be 100% true! So what's the problem then? The potential problem looks something like this: Let's suppose that an app developer in the U.S. does all of the things you say to to, for the sake of security/privacy. OK, and now let's suppose that a Nation State Attacker -- our guys, their guys, whoever -- somehow subverts the security of the app (Browser/OS/Hardware/Network/? hacks) and gathers the apps' data. Now... let's suppose that some foreign newspaper, the foreign equivalent of the NYT -- prints a story that our friend, the U.S. app developer -- who did nothing wrong, and tried to do everything right -- is actually gathering data for the Nation State Attacker (foreign or domestic), and thus is a "Spy" tool. Well guess what! Under those conditions, the story is absolutely, absolutely CORRECT! Except that there's a teensy little problem... Call it a lie; call it an error of ommission... The problem is as follows: The problem is that this newspaper article's author/authors, being ignorant of the fact that there was NO INTENT of the app developer to have their app used as a "Spy Tool" -- yet that was the end effect, caused by circumstances and actors outside of the control of the app company! That's scenario #1. Scenario #2: The law/legal system of the country in question is used to force the intentional engineering of hidden backdoors for the Nation State Attacker, under penalty of a very long prison sentence... Either way, the paper's story is "correct" -- but it causes a crapload of harm to the application developer, who only wanted to make a dollar by providing an equal-and-opposite value, and never intended for these things to happen! Of course, if the ToTok developers intentionally engineered security holes while not being coerced to do so (and the NYT could present proof of this), THEN this article is clean, ethical journalism... otherwise the NYT should not have presented it until it had, and was willing to show to the world this proof... Would you want a story like this to break in some other part of the world, some part where you do business, but some part where you might lack the language/cultural/legal skills to defend you and your company, when you and your company are acting with the best intentions in mind? I'm not a Christian, but... remember that "Do Unto Others" quote... That's why we have have Due Process, The Right Of An Accuser to Face The Accused (Cross Examination), and the Presumption of Innocence -- in our U.S. system of Law... That's why in this day and age, I never assume that 100% of what the media says is true, 100% of the time. I am sorry, but even if ToTok has betrayed its user trust (and I'm not saying they did or didn't) -- then certainly the U.S. media has, more often than not, betrayed mine... I reiterate that the burden of proof -- is on the NYT.