36 ms·

Horcrux Encrypted Messaging

77 points by ljlolel 6y ago

md_ 6y ago
A few points: * The 0day argument (that using multiple apps reduces exposure) is a poor one. If we're talking about 0days that allow message decryption from a MITM, this is true--but if we're talking about RCE with (on mobile OSes) a local sandbox escape (e.g. https://threatpost.com/whatsapp-zero-day-exploited-in-targeted-spyware-attacks/144696/ https://threatpost.com/whatsapp-zero-day-exploited-in-target...), then installing more apps increases the attack surface and thus the risk. * Another argument for multiple services seems to be some implied DOS resistance. But of course exactly the opposite is true: if you split your message and deliver it via multiple channels, any one of those channels can be taken offline and thus thwart message delivery. * The real argument for multiple services seems to be based on an assumed threat model of an attacker who primarily relies on lawful intercept orders, not on technical capabilities (e.g., a warrant, not cryptanalysis). Adding multiple services may do little or nothing for the latter threat, since many messaging services rely on the same underlying protocols (e.g. the Signal Protocol) or the same crypto primitives. This is important for my next point: * If the threat model is about lawful intercepts, and you actually trust modern crypto, this entire scheme makes no sense. Just share a public key for a common, well-vetted algorithm. Encrypting messages using an air-gapped device makes sense. * Further, if we trust crypto, this scheme's sole value is effectively in contact (or public key) discovery: assuming you can't meet face-to-face, the point of this scheme is really to allow multiple services to help you discover a contact's public key (assuming we replace the unnecessary OTP approach with public key exchanges). But many (most?) of these services rely on the telephone system for identity--so there's still a fairly trivial single point of failure, commonly controlled by the government. * To beat a dead horse: if we don't trust modern crypto, it's likely an adversary can access all components of the message+OTP anyway (even without lawful intercept capabilities), so this scheme adds no value. Summary: This proposal would benefit by a more clearly stated threat model. As-is, it's hard to come up with a coherent threat model where this proposal adds value.
- mindfulhack 6y ago
  Hyperbolic claims aside†, I think this is a practical way to dramatically increase the security of OTP key transmission over networked communication. It's not perfect, but it would make any attacker's job harder, right? E.g. attacker may have no idea where the OTP key is sent, nor on what messaging platform, and would need to crack earlier messages to potentially find out what the communicators were using for all other parts of the horcrux cohort. That's a chicken and egg problem for the attacker. The information on exactly where and what the other horcruxes are could be residing entirely elsewhere in a very encrypted way, or even discussed in person. [†] I'm interested in the hyperbolic claims about OTP in and of itself bringing 'perfect secrecy' via networked communication. Aren't the mechanisms to transmit OTP keys (i.e. the transport mechanisms over the network) prone to weaker security than the OTP mechanism itself? But again, I think that's what this idea helps mitigate.
  - md_ 6y ago
    Right, you're spot on about the OTP. The pad is itself transmitted over the same channel(s) as the message, so there's no value in using an OTP per se. I think the author was just going for a way to split a message in a way that one needs all parts of the split message (or key) to decrypt it. I'm not sure I buy your argument for the value this may provide, though. * The question you pose for an attacker--which platform and which device/identity was used to send a message of interest--already exists, in a more general form, for any attacker. Our threat model presumes the attacker has solved it, or else we wouldn't need e2ee to begin with. * If you're going to discuss something in person, instead of discussing how to use a small number of different channels or identities, just share cryptographic keys! It's my strong sense that the author is mostly ignorant of encryption itself (hence the misuse of OTP) and instead is trying to solve for the problem of lawful intercept (and hence the digression about supply chain security). This is a somewhat reasonable concern, but I don't think the proposal does much to help with it. As I noted above, barring assumptions of extremely pervasive full stack compromise (or full compromise of common cryptographic primitives, an air-gapped dedicated device for encrypting messages with preshared keys provides all the security of this scheme, reduces risk (e.g. of 0days), and is far more usable.
natcombs 6y ago
> This encryption is perfect secrecy Sending your key in plaintext over a separate channel isn’t really perfect secrecy but okay... it’s interesting, but laden with assumptions.
- m3kw9 6y ago
  What do you mean plain text? It’s scrambled using the OTP then sent. Each sent on a separate channel. The only way to crack is to intercept both. Or if the random generator is weak and can be predicted.
  - natcombs 6y ago
    > What do you mean plain text? This: "We will send the ciphertext through Signal and the one-time pad through WeChat." You're sending the OTP in plaintext. This is the age-old key distribution problem, and that's not magically solved by using a separate channel.
    - ljlolel 6y ago
      I used those words, but if you understand how OTP/XOR works, they're both kind of OTP. They're both totally random 0's and 1's. Only putting them together (using simple XOR) makes them a message. The separate channels is important since each is mostly E2EE secure except for the whole government spying problems, but usually not all of them cheaply on each service. We live in unique times now where this wasn't as relevant or possible before. Does that make sense?
      - hinkley 6y ago
        No, it doesn’t. People who are anonymous can generally have anonymous conversations. Once anyone becomes interested in those conversations, they are not anonymous and none of their existing strategies are applicable. State actors have the resources to store messages now and correlate them later. If either is plain text, the other will fall.
- hinkley 6y ago
m3kw9 6y ago
The problem is the UX and can be cracked if the receiver is lazy and always have both channel close by for convenience
- ljlolel 6y ago
  That's true. You could end up with bad Opsec and then accidentally download both Signal and Telegram on the same device, reducing (but not eliminating) security. Thanks I'll add this to vulnerabilities. You can mitigate that with some upfront choices. For example, use a blackberry and blackberry messaging as one device, which wouldn't be available on other devices?
johnisgood 6y ago
> The encryption can be broken in the future if the rival states become allies, or otherwise become willing to share data with each other. Witty, sure, but I would not trust it with sensitive data at all if it is relying on political relations ("politics") only. > Many [vulnerabilities] in Whatsapp/Telegram/Signal Please provide citations for currently known vulnerabilities of each of these, then. Telegram does not even support "secret chat" (E2EE) on their desktop and web version of the software[1]. No need for vulnerabilities here. [1] https://tsf.telegram.org/manuals/e2ee-simple https://tsf.telegram.org/manuals/e2ee-simple
- ljlolel 6y ago
  Horcruxes are just a layer of security. If you want to further encrypt (or do more steganography) on the messages then it is not hard to add that too depending on your threat model and paranoia level. Horcruxes provide a unique solution to the problem of dragnets and increase costs of hacking your device even for governments.
  - maqp 6y ago
    Horcruxes are just a layer of security. Sure, but the problem it solves is not the problem that needs addressing. Ciphertext and key delivery can already be done safely with E2EE apps like Signal. Metadata can be eliminated with e.g. Tor Onion Services. Your apps relies on QR-codes to exchange data, the same channel can be used to authenticate Signal endpoints and/or exchange PSKs, no need for SSS. Goal for information theoretic security is fine but considering nobody is doing CT-only attacks against modern algorithms anyway, the easiest attack vector will be MITM attack or remote key exfiltration. E.g. Snowden has been very vocal in the past about NSAs of the world hacking endpoints, but has quieted a bit down wrt the matter, perhaps he realized that was too high bar for average users who still benefit from incremental security from Signal etc.
    - ljlolel 6y ago
      Pleas read through the whole doc. In many places it describes how it increases the cost of device hacking using 0-days significantly. There are limited other solutions for this, whereas Horcruxes are cheap and easy to implement.
tuxxy 6y ago
This lacks a clear threat model and even overstates many problems it claims to resolve (e.g. vulnerabilities in Signal, et al). I'm not very certain what value this adds to the landscape. Is it possible the developers can elaborate here?
- ljlolel 6y ago
  I added a section on Threat Models as examples
vessenes 6y ago
There is some magical thinking in this proposal as relates to key creation and transmission — I do not think it’s as easy as the author proposes to get enough entropy for a one-time pad from QR codes, for instance. A giant QR code gives only 406 bytes, and the ones phones trade are usually smaller. Also, it is easy to scan a QR code automatically by its nature. That said, I reinterpret this idea slightly and think it’s brilliant — to Shamir split a message between different channels is a really good idea. To split them in such a way that different nation-state actors will each encounter significant expense is pretty brilliant. Ultimately, (and I think this is acknowledged), for this to be usable you’re going to need a device that you don’t think is compromised to read and send; In the crypto world, the canonical device would be a formatted flashed older phone that you never turn on data for; it would then use the camera to scan and incorporate the QR codes sent through each channel and recombine them. If that’s the best usability Horcruxes provide, they are going to be used only for ultra-high-value short communication — private keys, passwords, GPS locations of very high value. TL;DR The proposal provides some improved messaging security but at high usability cost. I think it’s probably better than not using it if you use it as an app on your “main” phone, but it doesn’t give full benefits in that mode.
- ljlolel 6y ago
  Thanks for saying it's brilliant :) Yes, entropy and true randomness will be an issue. I can imagine manufacturing a Magic Wand (all in the US) which would be a custom piece of HW with an entropy chip (maybe using cosmic rays?) Yes you're right and I mention that in the Usability section.
  - maqp 6y ago
    How are you ensuring a US-manufactured HWRNG produces random numbers -- i.e. how are you ensuring the NSA doesn't put HW implants to your devices as they're being delivered to your customers? https://arstechnica.com/tech-policy/2014/05/photos-of-an-nsa-upgrade-factory-show-cisco-router-getting-implant/ https://arstechnica.com/tech-policy/2014/05/photos-of-an-nsa...
    - 6y ago
black_puppydog 6y ago
Meta/side-track: notion is a horrible publishing platform. I can see its use as a wiki/documentation solution (although I disagree with many of the UI choices they make and would never personally choose it) but none of these points actually hold when I'm just reading a published page. Export it to markdown, and dump it on a github page or something. At least that way we can use space/PgUp etc to navigate.
- ljlolel 6y ago
  Originally I had it as a Google Doc. That got 0 votes on HN. This is my second attempt. Super easy upgrade to Notion. I agree could be better, but further raising the bar to publishing might mean I never do it :(. Actually the feedback about not being able to use space / PgDn is good feedback for the Notion team. How do we relay feedback to them? :)
  - NetOpWibby 6y ago
    That's fair.
  - justaj 6y ago
    For me personally, if I can't view it without JS, then I'll try the Web Archive version. If that fails, then I just move on to the next article.
  - black_puppydog 6y ago
    FWIW, I don't think the google.com vs notion.so domain was the distinguishing factor here. Whether or not a submission gets votes is a pretty random process in any case. I think the notion folks should be well aware of the UI issues, since they're long standing. They simply don't care for people that don't navigate with an Apple (TM) touchpad.
    - ljlolel 6y ago
      i'll put it up on my personal blog jperla.com/blog and then re-post it. Seems like this got abruptly banned from the front page for some reason as it hit 50 upvotes...
slaymaker1907 6y ago
An interesting idea, I was thinking why not use public key encryption instead of transmitting keys in plain text, but it doesn’t really make sense to do so. Breaking the public key encryption only requires the plain text or the public key (assuming it can be cracked) so horcrux would not help. However, using a symmetric algorithm like AES could give you better performance since that would reduce the bandwidth overhead from O(h * n) where n is the size of the message and h is the number of horcruxes to O(n + k * h) where k is the size of the key.
- ljlolel 6y ago
  Yes a few people suggested that. Note that I am maintaining ZERO infrastructure here (important! also since it can help prevent DOS!), so it doesn't cost me anything to send these. A lot of these messaging infrastructures are free to users too. So does it really matter that it's O(h * n)? h will always be not that big too, (n as well!) so it's not that much data. It is not much data, and costs me nothing, and costs the user nothing. Does it matter? I like that OTP has perfect secrecy and is super easy to code and audit the code (NSA hasn't snuck in any weird matrices, no weird goto return bug, buying a bigger quantum computer doesn't break it, etc). You could also use Horcruxes to set up public key encryption or a key exchange, then do the rest of the communication on a new channel directly using public key encryption.
lostgame 6y ago
I know it may sound pedantic to the uninitiated, but the name immediately triggered me / made me uninterested - as it would to any trans person I know - because it's using a name from Harry Potter. Something we have a hard time just 'getting over' or 'ignoring', and certainly shouldn't be asked to. The author, JK Rowling, is currently on the single biggest hate campaign I've seen a celebrity run against trans rights. It's negatively affecting the connotations of being associated with the 'Potterverse,' and support for Potter these days is widely considered inconsiderate, especially in the ever growing queer community. Simply using a name like this was enough to turn me off, and certainly I would not want any friends to have a similarly triggering experience, so I therefore can't recommend it's use, either. While Potter actually used to be a portal of expression for these types of people, it is now associated with repression and ignorance. It sucks that any time I see media related / referencing Potter I honestly am immediately disgusted, but this is clearly what Rowling wants. She has had many chances to step down and apologize to her fan base, but she insists on invalidating us. I grew up with those books, they meant a lot to me, and actually produced a crisis of faith to me with regards to separating art from the artist. Michael Jackson was, pretty definitely, a child molester. I listened to his music for years after until I finally decided I couldn't do it, as a survivor of sexual assault myself, it makes it difficult to be caught casually listening to him. The Potter books are good, but there are a lot of other great books out there (and inspiration for names!) that wouldn't immediately turn off any and all potential trans customers like myself. I will note that it could be amazingly positive PR for you guys if you chose to rename the app for this program, I know I myself would sent it to a few of my queer tech blogging friends. Unfortunately, to even be a fan of Potter any more is to be a fan in spite of, or choosing to ignore Rowling's continuing, relentless campaign to invalidate us as people, and has drawn tangible battle lines between fan communities.
- ljlolel 6y ago
  I hear you and I agree I'd rather not be triggering that. I tried asking a few people and trying to come up with a different name and people didn't understand it as easily. Horcruxes give you an idea of what it's doing basically just from the name (you could even imagine a cryptographer inventing this system just from hearing the name it is so obvious). Do you have an idea for another name for it that will communicate the idea as well? Maybe you can activate your queer tech blogging friends so that we can come up with a new name? (and then I can resubmit under the new name, since Notion will change and kill this link once I change the name). What else can be split up into pieces and you have to get all of them?
lucb1e 6y ago
(Edit: while reading further this went from "overstated claims" to "potentially big security issue", see the edit below.) It's definitely an interesting idea, but the security claims are rather overstated. If "Horcrux" has a vulnerability, then no, you don't necessarily have to hack each of the transport services to abuse that vulnerability. Depending on what kind of vulnerability it is, you might be able to send someone a message that their client parses and runs your malicious code, or perhaps it leads to plaintext recovery or malleability when you intercept or tamper with only one service. Another thing to note, somehow missing in the table of (magical) claims where Horcrux comes out on top in every comparison, is that metadata is a problem that you're greatly exacerbating with this. Now not only the USA knows who talks to who, but also Russia and China (in the example given with VK and WeChat). I'd be happy for my chats to run encrypted through Russia since they have very little else on me and distributing who knows what is a good way to prevent someone from knowing everything, but it's still a thing to note. Edit: And reading a bit more in detail... this seems worrying: > We will send the ciphertext through Signal and the one-time pad through WeChat So if a service assumes that a three-byte message is "yes", they can change that into "no " (note the space) by just xoring against one of the two messages ('ciphertext' or 'one-time pad') right? You don't need to capture both. The claim "no passwords, encryption keys, and no complicated key management. There is no trust of any complicated public key algorithm, key lengths, or code" makes that there is also no way to verify authenticity of anything. You just have to hope that China, Russia, and the USA all independently decided not to mess with you today; it takes only one, not all three/N. Proof of concept: Send (hex) c64d2d through service A and (hex) bf285e through service B. The recipient xors them together and gets (ascii) "yes", the original message. Now what if service A decides to tamper with it? They xor c64d2d with "yes" and get bf285e. By no coincidence, that's what will be sent through service B. They can xor anything against that, such as "no " (6e6f20), which would result in d1477e. When the recipient receives d1477e from one channel and bf285e from the other, they xor it together and show the message: no.
- ljlolel 6y ago
  It's true, but the way I describe the Magic Wand it doesn't have any data so not much to hack. It's also pretty simple, trivial, QR code and XOR code, so really easy to audit fuzz test and verify nothing fishy can happen. Good point about how now multiple nation states know who you're talking to, whereas if you only use Signal then it's probably only US gov. I'll add that to the Vulnerabilities section! Note that steganography can help with that, or you can use a messaging channel which doesn't transparently tell governments who you're talking to (not Signal!)
josh2600 6y ago
It’s a cool idea but I think it’s hard to imagine how a user would perform this type of messaging transparently. For example, signal doesn’t support bots today or really any kind of unofficial API access so the idea of increasing the number of messengers I need to manually interact with to send a message seems like a big UX burden. As with all things, the simplest UX will probably win. Lastly, if you use a single client like a phone for sending/assembling all of your horcruxes, that’s probably the place that an adversary would target.
- ljlolel 6y ago
  Let's be more creative here Josh :) Maybe not Signal, but there are multiple secure encrypted email clients which DO have programmatic access including ProtonMail, DeltaChat, and others which are under different jurisdictions around the world. Also you can compile and run your own custom version of the open source Signal Client which does have programmatic access :) >Lastly, if you use a single client like a phone for sending/assembling all of your horcruxes, that’s probably the place that an adversary would target. That vulnerability is listed and described in the doc. It still has security, just a different threat model, just not as much security as using multiple devices. Note that under your one Signal app one device, you have no way to prevent this attack at all. Horcruxes now open up new possibilities.
  - maqp 6y ago
    From the documentation: "Often the 0-days are targeting the most common platforms, so using a lesser used platform increases the attack cost linearly or superlinearly." There's only so many platforms. The exploit would either be directed against the app itself or the OS or some other popular software package like SSH server running on the endpoint. The threat model of Horcrux doesn't differ from Signal: both are effectively networked TCBs. This will hold unless you explicitly spec it to run on other systems like airgapped, or split TCB configurations. "Horcruxes now open up new possibilities." What the world needs is less vague marketing language, and more concrete examples.
    - ljlolel 6y ago
blindm 6y ago
Is this a member of Notion.so staff? How is it possible that you can blog with Notion?
- ljlolel 6y ago
  Notion free personal version let's you publish links publicly (just not be SEO). It's awesome! Way nicer than google docs.
  - blindm 6y ago
    Cool!
mindfulhack 6y ago
Just another thought, although IANAL: while it's probably OK to use the word 'horcrux' in casual discussion, for an actual product, even if non-profit, it may be unfeasible to use that word because it's part of the Harry Potter IP. Maybe I'm totally wrong because it's a different enough industry to be able to use it, but what happens in practice however is another thing. Remember Jo Rowling is a billionaire, hehe. Also, it's a completely unique word that she proudly invented. She said before creating it she checked and Google had zero results on the word.
- ljlolel 6y ago
  Yea some queer bloggers are going to help me find a better name too since we don't want the association with what JKR is talking about these days This doesn't help but XORcrux would also work maybe
senectus1 6y ago
Obscurity isn't security, its just administrative overhead + additional points of failure.
deleted 6y ago
[deleted]

77 points by ljlolel 6y ago

md_ 6y ago

A few points: * The 0day argument (that using multiple apps reduces exposure) is a poor one. If we're talking about 0days that allow message decryption from a MITM, this is true--but if we're talking about RCE with (on mobile OSes) a local sandbox escape (e.g. https://threatpost.com/whatsapp-zero-day-exploited-in-targeted-spyware-attacks/144696/ https://threatpost.com/whatsapp-zero-day-exploited-in-target...), then installing more apps increases the attack surface and thus the risk. * Another argument for multiple services seems to be some implied DOS resistance. But of course exactly the opposite is true: if you split your message and deliver it via multiple channels, any one of those channels can be taken offline and thus thwart message delivery. * The real argument for multiple services seems to be based on an assumed threat model of an attacker who primarily relies on lawful intercept orders, not on technical capabilities (e.g., a warrant, not cryptanalysis). Adding multiple services may do little or nothing for the latter threat, since many messaging services rely on the same underlying protocols (e.g. the Signal Protocol) or the same crypto primitives. This is important for my next point: * If the threat model is about lawful intercepts, and you actually trust modern crypto, this entire scheme makes no sense. Just share a public key for a common, well-vetted algorithm. Encrypting messages using an air-gapped device makes sense. * Further, if we trust crypto, this scheme's sole value is effectively in contact (or public key) discovery: assuming you can't meet face-to-face, the point of this scheme is really to allow multiple services to help you discover a contact's public key (assuming we replace the unnecessary OTP approach with public key exchanges). But many (most?) of these services rely on the telephone system for identity--so there's still a fairly trivial single point of failure, commonly controlled by the government. * To beat a dead horse: if we don't trust modern crypto, it's likely an adversary can access all components of the message+OTP anyway (even without lawful intercept capabilities), so this scheme adds no value. Summary: This proposal would benefit by a more clearly stated threat model. As-is, it's hard to come up with a coherent threat model where this proposal adds value.

mindfulhack 6y ago
Hyperbolic claims aside†, I think this is a practical way to dramatically increase the security of OTP key transmission over networked communication. It's not perfect, but it would make any attacker's job harder, right? E.g. attacker may have no idea where the OTP key is sent, nor on what messaging platform, and would need to crack earlier messages to potentially find out what the communicators were using for all other parts of the horcrux cohort. That's a chicken and egg problem for the attacker. The information on exactly where and what the other horcruxes are could be residing entirely elsewhere in a very encrypted way, or even discussed in person. [†] I'm interested in the hyperbolic claims about OTP in and of itself bringing 'perfect secrecy' via networked communication. Aren't the mechanisms to transmit OTP keys (i.e. the transport mechanisms over the network) prone to weaker security than the OTP mechanism itself? But again, I think that's what this idea helps mitigate.
- md_ 6y ago
  Right, you're spot on about the OTP. The pad is itself transmitted over the same channel(s) as the message, so there's no value in using an OTP per se. I think the author was just going for a way to split a message in a way that one needs all parts of the split message (or key) to decrypt it. I'm not sure I buy your argument for the value this may provide, though. * The question you pose for an attacker--which platform and which device/identity was used to send a message of interest--already exists, in a more general form, for any attacker. Our threat model presumes the attacker has solved it, or else we wouldn't need e2ee to begin with. * If you're going to discuss something in person, instead of discussing how to use a small number of different channels or identities, just share cryptographic keys! It's my strong sense that the author is mostly ignorant of encryption itself (hence the misuse of OTP) and instead is trying to solve for the problem of lawful intercept (and hence the digression about supply chain security). This is a somewhat reasonable concern, but I don't think the proposal does much to help with it. As I noted above, barring assumptions of extremely pervasive full stack compromise (or full compromise of common cryptographic primitives, an air-gapped dedicated device for encrypting messages with preshared keys provides all the security of this scheme, reduces risk (e.g. of 0days), and is far more usable.

natcombs 6y ago

> This encryption is perfect secrecy Sending your key in plaintext over a separate channel isn’t really perfect secrecy but okay... it’s interesting, but laden with assumptions.

m3kw9 6y ago
What do you mean plain text? It’s scrambled using the OTP then sent. Each sent on a separate channel. The only way to crack is to intercept both. Or if the random generator is weak and can be predicted.
- natcombs 6y ago
  > What do you mean plain text? This: "We will send the ciphertext through Signal and the one-time pad through WeChat." You're sending the OTP in plaintext. This is the age-old key distribution problem, and that's not magically solved by using a separate channel.
  - ljlolel 6y ago
    I used those words, but if you understand how OTP/XOR works, they're both kind of OTP. They're both totally random 0's and 1's. Only putting them together (using simple XOR) makes them a message. The separate channels is important since each is mostly E2EE secure except for the whole government spying problems, but usually not all of them cheaply on each service. We live in unique times now where this wasn't as relevant or possible before. Does that make sense?
    - hinkley 6y ago
      No, it doesn’t. People who are anonymous can generally have anonymous conversations. Once anyone becomes interested in those conversations, they are not anonymous and none of their existing strategies are applicable. State actors have the resources to store messages now and correlate them later. If either is plain text, the other will fall.
hinkley 6y ago

m3kw9 6y ago

The problem is the UX and can be cracked if the receiver is lazy and always have both channel close by for convenience

ljlolel 6y ago
That's true. You could end up with bad Opsec and then accidentally download both Signal and Telegram on the same device, reducing (but not eliminating) security. Thanks I'll add this to vulnerabilities. You can mitigate that with some upfront choices. For example, use a blackberry and blackberry messaging as one device, which wouldn't be available on other devices?

johnisgood 6y ago

> The encryption can be broken in the future if the rival states become allies, or otherwise become willing to share data with each other. Witty, sure, but I would not trust it with sensitive data at all if it is relying on political relations ("politics") only. > Many [vulnerabilities] in Whatsapp/Telegram/Signal Please provide citations for currently known vulnerabilities of each of these, then. Telegram does not even support "secret chat" (E2EE) on their desktop and web version of the software[1]. No need for vulnerabilities here. [1] https://tsf.telegram.org/manuals/e2ee-simple https://tsf.telegram.org/manuals/e2ee-simple

ljlolel 6y ago
Horcruxes are just a layer of security. If you want to further encrypt (or do more steganography) on the messages then it is not hard to add that too depending on your threat model and paranoia level. Horcruxes provide a unique solution to the problem of dragnets and increase costs of hacking your device even for governments.
- maqp 6y ago
  Horcruxes are just a layer of security. Sure, but the problem it solves is not the problem that needs addressing. Ciphertext and key delivery can already be done safely with E2EE apps like Signal. Metadata can be eliminated with e.g. Tor Onion Services. Your apps relies on QR-codes to exchange data, the same channel can be used to authenticate Signal endpoints and/or exchange PSKs, no need for SSS. Goal for information theoretic security is fine but considering nobody is doing CT-only attacks against modern algorithms anyway, the easiest attack vector will be MITM attack or remote key exfiltration. E.g. Snowden has been very vocal in the past about NSAs of the world hacking endpoints, but has quieted a bit down wrt the matter, perhaps he realized that was too high bar for average users who still benefit from incremental security from Signal etc.
  - ljlolel 6y ago
    Pleas read through the whole doc. In many places it describes how it increases the cost of device hacking using 0-days significantly. There are limited other solutions for this, whereas Horcruxes are cheap and easy to implement.

tuxxy 6y ago

This lacks a clear threat model and even overstates many problems it claims to resolve (e.g. vulnerabilities in Signal, et al). I'm not very certain what value this adds to the landscape. Is it possible the developers can elaborate here?

ljlolel 6y ago
I added a section on Threat Models as examples

vessenes 6y ago

There is some magical thinking in this proposal as relates to key creation and transmission — I do not think it’s as easy as the author proposes to get enough entropy for a one-time pad from QR codes, for instance. A giant QR code gives only 406 bytes, and the ones phones trade are usually smaller. Also, it is easy to scan a QR code automatically by its nature. That said, I reinterpret this idea slightly and think it’s brilliant — to Shamir split a message between different channels is a really good idea. To split them in such a way that different nation-state actors will each encounter significant expense is pretty brilliant. Ultimately, (and I think this is acknowledged), for this to be usable you’re going to need a device that you don’t think is compromised to read and send; In the crypto world, the canonical device would be a formatted flashed older phone that you never turn on data for; it would then use the camera to scan and incorporate the QR codes sent through each channel and recombine them. If that’s the best usability Horcruxes provide, they are going to be used only for ultra-high-value short communication — private keys, passwords, GPS locations of very high value. TL;DR The proposal provides some improved messaging security but at high usability cost. I think it’s probably better than not using it if you use it as an app on your “main” phone, but it doesn’t give full benefits in that mode.

ljlolel 6y ago
Thanks for saying it's brilliant :) Yes, entropy and true randomness will be an issue. I can imagine manufacturing a Magic Wand (all in the US) which would be a custom piece of HW with an entropy chip (maybe using cosmic rays?) Yes you're right and I mention that in the Usability section.
- maqp 6y ago
  How are you ensuring a US-manufactured HWRNG produces random numbers -- i.e. how are you ensuring the NSA doesn't put HW implants to your devices as they're being delivered to your customers? https://arstechnica.com/tech-policy/2014/05/photos-of-an-nsa-upgrade-factory-show-cisco-router-getting-implant/ https://arstechnica.com/tech-policy/2014/05/photos-of-an-nsa...
  - 6y ago

black_puppydog 6y ago

Meta/side-track: notion is a horrible publishing platform. I can see its use as a wiki/documentation solution (although I disagree with many of the UI choices they make and would never personally choose it) but none of these points actually hold when I'm just reading a published page. Export it to markdown, and dump it on a github page or something. At least that way we can use space/PgUp etc to navigate.

ljlolel 6y ago
Originally I had it as a Google Doc. That got 0 votes on HN. This is my second attempt. Super easy upgrade to Notion. I agree could be better, but further raising the bar to publishing might mean I never do it :(. Actually the feedback about not being able to use space / PgDn is good feedback for the Notion team. How do we relay feedback to them? :)
- NetOpWibby 6y ago
  That's fair.
- justaj 6y ago
  For me personally, if I can't view it without JS, then I'll try the Web Archive version. If that fails, then I just move on to the next article.
- black_puppydog 6y ago
  FWIW, I don't think the google.com vs notion.so domain was the distinguishing factor here. Whether or not a submission gets votes is a pretty random process in any case. I think the notion folks should be well aware of the UI issues, since they're long standing. They simply don't care for people that don't navigate with an Apple (TM) touchpad.
  - ljlolel 6y ago
    i'll put it up on my personal blog jperla.com/blog and then re-post it. Seems like this got abruptly banned from the front page for some reason as it hit 50 upvotes...

slaymaker1907 6y ago

An interesting idea, I was thinking why not use public key encryption instead of transmitting keys in plain text, but it doesn’t really make sense to do so. Breaking the public key encryption only requires the plain text or the public key (assuming it can be cracked) so horcrux would not help. However, using a symmetric algorithm like AES could give you better performance since that would reduce the bandwidth overhead from O(h * n) where n is the size of the message and h is the number of horcruxes to O(n + k * h) where k is the size of the key.

ljlolel 6y ago
Yes a few people suggested that. Note that I am maintaining ZERO infrastructure here (important! also since it can help prevent DOS!), so it doesn't cost me anything to send these. A lot of these messaging infrastructures are free to users too. So does it really matter that it's O(h * n)? h will always be not that big too, (n as well!) so it's not that much data. It is not much data, and costs me nothing, and costs the user nothing. Does it matter? I like that OTP has perfect secrecy and is super easy to code and audit the code (NSA hasn't snuck in any weird matrices, no weird goto return bug, buying a bigger quantum computer doesn't break it, etc). You could also use Horcruxes to set up public key encryption or a key exchange, then do the rest of the communication on a new channel directly using public key encryption.

lostgame 6y ago

I know it may sound pedantic to the uninitiated, but the name immediately triggered me / made me uninterested - as it would to any trans person I know - because it's using a name from Harry Potter. Something we have a hard time just 'getting over' or 'ignoring', and certainly shouldn't be asked to. The author, JK Rowling, is currently on the single biggest hate campaign I've seen a celebrity run against trans rights. It's negatively affecting the connotations of being associated with the 'Potterverse,' and support for Potter these days is widely considered inconsiderate, especially in the ever growing queer community. Simply using a name like this was enough to turn me off, and certainly I would not want any friends to have a similarly triggering experience, so I therefore can't recommend it's use, either. While Potter actually used to be a portal of expression for these types of people, it is now associated with repression and ignorance. It sucks that any time I see media related / referencing Potter I honestly am immediately disgusted, but this is clearly what Rowling wants. She has had many chances to step down and apologize to her fan base, but she insists on invalidating us. I grew up with those books, they meant a lot to me, and actually produced a crisis of faith to me with regards to separating art from the artist. Michael Jackson was, pretty definitely, a child molester. I listened to his music for years after until I finally decided I couldn't do it, as a survivor of sexual assault myself, it makes it difficult to be caught casually listening to him. The Potter books are good, but there are a lot of other great books out there (and inspiration for names!) that wouldn't immediately turn off any and all potential trans customers like myself. I will note that it could be amazingly positive PR for you guys if you chose to rename the app for this program, I know I myself would sent it to a few of my queer tech blogging friends. Unfortunately, to even be a fan of Potter any more is to be a fan in spite of, or choosing to ignore Rowling's continuing, relentless campaign to invalidate us as people, and has drawn tangible battle lines between fan communities.

ljlolel 6y ago
I hear you and I agree I'd rather not be triggering that. I tried asking a few people and trying to come up with a different name and people didn't understand it as easily. Horcruxes give you an idea of what it's doing basically just from the name (you could even imagine a cryptographer inventing this system just from hearing the name it is so obvious). Do you have an idea for another name for it that will communicate the idea as well? Maybe you can activate your queer tech blogging friends so that we can come up with a new name? (and then I can resubmit under the new name, since Notion will change and kill this link once I change the name). What else can be split up into pieces and you have to get all of them?

lucb1e 6y ago

(Edit: while reading further this went from "overstated claims" to "potentially big security issue", see the edit below.) It's definitely an interesting idea, but the security claims are rather overstated. If "Horcrux" has a vulnerability, then no, you don't necessarily have to hack each of the transport services to abuse that vulnerability. Depending on what kind of vulnerability it is, you might be able to send someone a message that their client parses and runs your malicious code, or perhaps it leads to plaintext recovery or malleability when you intercept or tamper with only one service. Another thing to note, somehow missing in the table of (magical) claims where Horcrux comes out on top in every comparison, is that metadata is a problem that you're greatly exacerbating with this. Now not only the USA knows who talks to who, but also Russia and China (in the example given with VK and WeChat). I'd be happy for my chats to run encrypted through Russia since they have very little else on me and distributing who knows what is a good way to prevent someone from knowing everything, but it's still a thing to note. Edit: And reading a bit more in detail... this seems worrying: > We will send the ciphertext through Signal and the one-time pad through WeChat So if a service assumes that a three-byte message is "yes", they can change that into "no " (note the space) by just xoring against one of the two messages ('ciphertext' or 'one-time pad') right? You don't need to capture both. The claim "no passwords, encryption keys, and no complicated key management. There is no trust of any complicated public key algorithm, key lengths, or code" makes that there is also no way to verify authenticity of anything. You just have to hope that China, Russia, and the USA all independently decided not to mess with you today; it takes only one, not all three/N. Proof of concept: Send (hex) c64d2d through service A and (hex) bf285e through service B. The recipient xors them together and gets (ascii) "yes", the original message. Now what if service A decides to tamper with it? They xor c64d2d with "yes" and get bf285e. By no coincidence, that's what will be sent through service B. They can xor anything against that, such as "no " (6e6f20), which would result in d1477e. When the recipient receives d1477e from one channel and bf285e from the other, they xor it together and show the message: no.

ljlolel 6y ago
It's true, but the way I describe the Magic Wand it doesn't have any data so not much to hack. It's also pretty simple, trivial, QR code and XOR code, so really easy to audit fuzz test and verify nothing fishy can happen. Good point about how now multiple nation states know who you're talking to, whereas if you only use Signal then it's probably only US gov. I'll add that to the Vulnerabilities section! Note that steganography can help with that, or you can use a messaging channel which doesn't transparently tell governments who you're talking to (not Signal!)

josh2600 6y ago

It’s a cool idea but I think it’s hard to imagine how a user would perform this type of messaging transparently. For example, signal doesn’t support bots today or really any kind of unofficial API access so the idea of increasing the number of messengers I need to manually interact with to send a message seems like a big UX burden. As with all things, the simplest UX will probably win. Lastly, if you use a single client like a phone for sending/assembling all of your horcruxes, that’s probably the place that an adversary would target.

ljlolel 6y ago
Let's be more creative here Josh :) Maybe not Signal, but there are multiple secure encrypted email clients which DO have programmatic access including ProtonMail, DeltaChat, and others which are under different jurisdictions around the world. Also you can compile and run your own custom version of the open source Signal Client which does have programmatic access :) >Lastly, if you use a single client like a phone for sending/assembling all of your horcruxes, that’s probably the place that an adversary would target. That vulnerability is listed and described in the doc. It still has security, just a different threat model, just not as much security as using multiple devices. Note that under your one Signal app one device, you have no way to prevent this attack at all. Horcruxes now open up new possibilities.
- maqp 6y ago
  From the documentation: "Often the 0-days are targeting the most common platforms, so using a lesser used platform increases the attack cost linearly or superlinearly." There's only so many platforms. The exploit would either be directed against the app itself or the OS or some other popular software package like SSH server running on the endpoint. The threat model of Horcrux doesn't differ from Signal: both are effectively networked TCBs. This will hold unless you explicitly spec it to run on other systems like airgapped, or split TCB configurations. "Horcruxes now open up new possibilities." What the world needs is less vague marketing language, and more concrete examples.
  - ljlolel 6y ago

blindm 6y ago

Is this a member of Notion.so staff? How is it possible that you can blog with Notion?

ljlolel 6y ago
Notion free personal version let's you publish links publicly (just not be SEO). It's awesome! Way nicer than google docs.
- blindm 6y ago
  Cool!

mindfulhack 6y ago

Just another thought, although IANAL: while it's probably OK to use the word 'horcrux' in casual discussion, for an actual product, even if non-profit, it may be unfeasible to use that word because it's part of the Harry Potter IP. Maybe I'm totally wrong because it's a different enough industry to be able to use it, but what happens in practice however is another thing. Remember Jo Rowling is a billionaire, hehe. Also, it's a completely unique word that she proudly invented. She said before creating it she checked and Google had zero results on the word.

ljlolel 6y ago
Yea some queer bloggers are going to help me find a better name too since we don't want the association with what JKR is talking about these days This doesn't help but XORcrux would also work maybe

senectus1 6y ago

Obscurity isn't security, its just administrative overhead + additional points of failure.

deleted 6y ago

[deleted]