3 ms·
Signal protocol might be airtight but nobody knows if any part of an app that is built on top of it doesn't leak keys somewhere in the pipeline. All crypto prot
by bitL 7y ago
Signal protocol might be airtight but nobody knows if any part of an app that is built on top of it doesn't leak keys somewhere in the pipeline. All crypto protocols work under certain assumptions and no protocol is 100% secure from all possible misuses when Mallory owns certain portions of infrastructure.
- UncleMeat 7y agoOf course they do. Reading bytecode is not much harder than reading source. Even reading decompiled binaries isn’t so hard. There is zero compelling reason to believe that signal is uniquely flawed.
- bitL 7y agoOutside Signal app, if e.g. I incorporate the protocol to my own app via the provided source code, am I prevented from leaking keys?
- tptacek 7y agoExactly what is your point? Durov is talking about Signal, not some hypothetical application you came up with to leak keys.
- bitL 7y agoWasn't he talking about WhatsApp that integrates Signal protocol? Asking if integrating protocol allows the "host" app to leak keys is completely valid.
- UncleMeat 7y agoAgain, reading bytecode is not hard. Even reading decompiled binaries isn't very hard. If WhatsApp was leaking keys on the side it wouldn't be too difficult to find, especially given how incredibly high profile it is as a target. Open source vs closed source is not meaningful here.
- bitL 7y agoAlright, I got what you meant. Do you know if anyone performed bytecode-level analysis on WhatsApp clients already? Just curious, it's nothing I really need.