5 ms·

(Edit: while reading further this went from "overstated claims" to "potentially big security issue", see the edit below.) It's definitely an interesting idea,

by lucb1e 6y ago

(Edit: while reading further this went from "overstated claims" to "potentially big security issue", see the edit below.) It's definitely an interesting idea, but the security claims are rather overstated. If "Horcrux" has a vulnerability, then no, you don't necessarily have to hack each of the transport services to abuse that vulnerability. Depending on what kind of vulnerability it is, you might be able to send someone a message that their client parses and runs your malicious code, or perhaps it leads to plaintext recovery or malleability when you intercept or tamper with only one service. Another thing to note, somehow missing in the table of (magical) claims where Horcrux comes out on top in every comparison, is that metadata is a problem that you're greatly exacerbating with this. Now not only the USA knows who talks to who, but also Russia and China (in the example given with VK and WeChat). I'd be happy for my chats to run encrypted through Russia since they have very little else on me and distributing who knows what is a good way to prevent someone from knowing everything, but it's still a thing to note. Edit: And reading a bit more in detail... this seems worrying: > We will send the ciphertext through Signal and the one-time pad through WeChat So if a service assumes that a three-byte message is "yes", they can change that into "no " (note the space) by just xoring against one of the two messages ('ciphertext' or 'one-time pad') right? You don't need to capture both. The claim "no passwords, encryption keys, and no complicated key management. There is no trust of any complicated public key algorithm, key lengths, or code" makes that there is also no way to verify authenticity of anything. You just have to hope that China, Russia, and the USA all independently decided not to mess with you today; it takes only one, not all three/N. Proof of concept: Send (hex) c64d2d through service A and (hex) bf285e through service B. The recipient xors them together and gets (ascii) "yes", the original message. Now what if service A decides to tamper with it? They xor c64d2d with "yes" and get bf285e. By no coincidence, that's what will be sent through service B. They can xor anything against that, such as "no " (6e6f20), which would result in d1477e. When the recipient receives d1477e from one channel and bf285e from the other, they xor it together and show the message: no.

ljlolel 6y ago
It's true, but the way I describe the Magic Wand it doesn't have any data so not much to hack. It's also pretty simple, trivial, QR code and XOR code, so really easy to audit fuzz test and verify nothing fishy can happen. Good point about how now multiple nation states know who you're talking to, whereas if you only use Signal then it's probably only US gov. I'll add that to the Vulnerabilities section! Note that steganography can help with that, or you can use a messaging channel which doesn't transparently tell governments who you're talking to (not Signal!)
- maqp 6y ago
  "It's true, but the way I describe the Magic Wand it doesn't have any data so not much to hack" For remote key/plaintext exfiltration, it's enough the plaintext message or private key is in the memory of the application for some time. The exfiltration attack can then use privileged process to periodically read the memory of the Magic Wand application. There's nothing an app on a networked TCB can do against that. You need either an airgap or preferably a split TCB to protect yourself against endpoint exploitation.
  - ljlolel 6y ago
    Yes it is airgapped, as stated in the doc, and multiple times in these comments.
    - maqp 6y ago
      Then how are you addressing 1) the security of the individual endpoints with access to each share. Let's say your magic wand is airgapped and nothing gets in via the share transmission media (QR-code, thumbdrive, whatnot). What if your Huawei, iPhone and device N are compromised via network because they're all connected to network at all times. The adversary can then just steal all necessary shares and they don't even need to access your magic wand, they can just XOR the shares from the three receiving endpoints and recover the message. 2) Airgap exfiltration security. Let's say the iPhone is secure enough and the adversary can't hack it. But how are you ensuring the QR-code scanner app of the Magic Wand can not be exploited with a carefully crafted QR-code? If the Magic Wand is compromised, it can leak plaintext messages the next time you scan the QR-codes of outgoing shares.
      - lucb1e 6y ago
        To be fair about #2, I have rarely seen vulns in QR code scanners that were actually related to the scanning of QR codes. The only issues I heard about were things like auto-opening a URL or logic issues when handling the scanned data. Of course this doesn't immediately lead to perfect and provable security, but there are bigger issues with the concept than this.
ljlolel 6y ago
> Proof of Concept Heh, that's funny, the documented threat model was looking at observing text, not changing it. I haven't heard about anybody making things tamper-proof from a government that has got your keys. With Signal, of course if NSA got your keys by force, can do the same thing, just on a single client. So there isn't any less security than Signal. Finally, if you have 3, 4, 5, horcruxes, then they would still all need to cooperate to get the messages in order to do this perfect XOR (and remember they need to hack through the E2EE on each service too).
- lucb1e 6y ago
  > Heh, that's funny, the documented threat model was looking at observing text, not changing it. It doesn't really matter what your threat model is if people see "encrypted messaging" and think it's to secure chat messages.... Putting an asterisk somewhere that indicates you exclude the single biggest source of issues for an encryption scheme is like throwing a brick through Sony's window with the text on it "BY ACCEPTING THIS BRICK THROUGH YOUR WINDOW, YOU ACCEPT IT AS IS AND AGREE TO MY DISCLAIMER OF ALL WARRANTIES, EXPRESS OR IMPLIED, AS WELL AS DISCLAIMERS OF ALL LIABILITY, DIRECT, INDIRECT, CONSEQUENTIAL OR INCIDENTAL, THAT MAY ARISE FROM THE INSTALLATION OF THIS BRICK INTO YOUR BUILDING." (http://bash.org/?577451 http://bash.org/?577451) Anyhow, defending a broken scheme rather than just honestly saying "I had not considered that; I'll introduce X to fix this issue." also kind of breaks any credibility down for me.
  - ljlolel 6y ago
    Chill out a bit... Like I said, Signal (and everything else) has the same exact vulnerability, it must since I'd be sending over Signal. And if it doesn't, then this attack wouldn't be possible.... The whole point of using these existing schemes is to inherit at least the security properties of those channels, and then augmenting them and mitigating some threats.
- deleted 6y ago
  [deleted]
ljlolel 6y ago
> Proof of Concept Heh, that's funny, the threat model was looking at observing text, not changing it. I haven't heard about anybody making things tamper-proof from a government that has got your keys. Signal, of course if they get your keys by force, can do the same thing, just on a single client. So there isn't any more security. Finally, if you have 3, 4, 5, horcruxes, then they would still all need to cooperate to get the messages in order to do this perfect XOR (and remember they need to hack through the E2EE on each service too by getting your keys).
- lucb1e 6y ago
  > Signal, of course if they get your keys by force, can do the same thing, just on a single client ... So there isn't any more security. What? Keys "by force"? So if they come to my house and threaten me? I doubt that any security scheme holds up under that, yours nor theirs. > Finally, if you have 3, 4, 5, horcruxes, then they would still all need to cooperate to get the messages in order to do this perfect XOR I won't spend another 30 minutes making another POC but I'm fairly sure that this is not true. Have you tried it? If I'm not mistaken: the third, fourth, and fifth OTP are xored together with the first and second, and are therefore the same as xoring messages 2..5 together into one value and xoring that with the first message. The result of {plaintext} xor {any of them} will match the value of {xor the others together}. Therefore any of them can decide to do the attack and they don't even need to know how many other messages/channels/OTPs/horcruxes there are.
  - ljlolel 6y ago
    "by force" I mean force Signal to ship code to the end user to upload the private keys so they can give it to the government, as described in the doc.... Oh I see what you mean about modifying. Good point. That's not in the threat model, I haven't heard of people doing that, but if it is a worry and you want to add it to the threat model, it's not hard to add a hash to the messages that will be a commitment scheme to ensure that you have all horcruxes and they haven't been tampered with. That's pretty easy.
    - 6y ago

by lucb1e 6y ago

ljlolel 6y ago

It's true, but the way I describe the Magic Wand it doesn't have any data so not much to hack. It's also pretty simple, trivial, QR code and XOR code, so really easy to audit fuzz test and verify nothing fishy can happen. Good point about how now multiple nation states know who you're talking to, whereas if you only use Signal then it's probably only US gov. I'll add that to the Vulnerabilities section! Note that steganography can help with that, or you can use a messaging channel which doesn't transparently tell governments who you're talking to (not Signal!)

maqp 6y ago
"It's true, but the way I describe the Magic Wand it doesn't have any data so not much to hack" For remote key/plaintext exfiltration, it's enough the plaintext message or private key is in the memory of the application for some time. The exfiltration attack can then use privileged process to periodically read the memory of the Magic Wand application. There's nothing an app on a networked TCB can do against that. You need either an airgap or preferably a split TCB to protect yourself against endpoint exploitation.
- ljlolel 6y ago
  Yes it is airgapped, as stated in the doc, and multiple times in these comments.
  - maqp 6y ago
    Then how are you addressing 1) the security of the individual endpoints with access to each share. Let's say your magic wand is airgapped and nothing gets in via the share transmission media (QR-code, thumbdrive, whatnot). What if your Huawei, iPhone and device N are compromised via network because they're all connected to network at all times. The adversary can then just steal all necessary shares and they don't even need to access your magic wand, they can just XOR the shares from the three receiving endpoints and recover the message. 2) Airgap exfiltration security. Let's say the iPhone is secure enough and the adversary can't hack it. But how are you ensuring the QR-code scanner app of the Magic Wand can not be exploited with a carefully crafted QR-code? If the Magic Wand is compromised, it can leak plaintext messages the next time you scan the QR-codes of outgoing shares.
    - lucb1e 6y ago
      To be fair about #2, I have rarely seen vulns in QR code scanners that were actually related to the scanning of QR codes. The only issues I heard about were things like auto-opening a URL or logic issues when handling the scanned data. Of course this doesn't immediately lead to perfect and provable security, but there are bigger issues with the concept than this.

ljlolel 6y ago

> Proof of Concept Heh, that's funny, the documented threat model was looking at observing text, not changing it. I haven't heard about anybody making things tamper-proof from a government that has got your keys. With Signal, of course if NSA got your keys by force, can do the same thing, just on a single client. So there isn't any less security than Signal. Finally, if you have 3, 4, 5, horcruxes, then they would still all need to cooperate to get the messages in order to do this perfect XOR (and remember they need to hack through the E2EE on each service too).

lucb1e 6y ago
> Heh, that's funny, the documented threat model was looking at observing text, not changing it. It doesn't really matter what your threat model is if people see "encrypted messaging" and think it's to secure chat messages.... Putting an asterisk somewhere that indicates you exclude the single biggest source of issues for an encryption scheme is like throwing a brick through Sony's window with the text on it "BY ACCEPTING THIS BRICK THROUGH YOUR WINDOW, YOU ACCEPT IT AS IS AND AGREE TO MY DISCLAIMER OF ALL WARRANTIES, EXPRESS OR IMPLIED, AS WELL AS DISCLAIMERS OF ALL LIABILITY, DIRECT, INDIRECT, CONSEQUENTIAL OR INCIDENTAL, THAT MAY ARISE FROM THE INSTALLATION OF THIS BRICK INTO YOUR BUILDING." (http://bash.org/?577451 http://bash.org/?577451) Anyhow, defending a broken scheme rather than just honestly saying "I had not considered that; I'll introduce X to fix this issue." also kind of breaks any credibility down for me.
- ljlolel 6y ago
  Chill out a bit... Like I said, Signal (and everything else) has the same exact vulnerability, it must since I'd be sending over Signal. And if it doesn't, then this attack wouldn't be possible.... The whole point of using these existing schemes is to inherit at least the security properties of those channels, and then augmenting them and mitigating some threats.
deleted 6y ago
[deleted]

ljlolel 6y ago

> Proof of Concept Heh, that's funny, the threat model was looking at observing text, not changing it. I haven't heard about anybody making things tamper-proof from a government that has got your keys. Signal, of course if they get your keys by force, can do the same thing, just on a single client. So there isn't any more security. Finally, if you have 3, 4, 5, horcruxes, then they would still all need to cooperate to get the messages in order to do this perfect XOR (and remember they need to hack through the E2EE on each service too by getting your keys).

lucb1e 6y ago
> Signal, of course if they get your keys by force, can do the same thing, just on a single client ... So there isn't any more security. What? Keys "by force"? So if they come to my house and threaten me? I doubt that any security scheme holds up under that, yours nor theirs. > Finally, if you have 3, 4, 5, horcruxes, then they would still all need to cooperate to get the messages in order to do this perfect XOR I won't spend another 30 minutes making another POC but I'm fairly sure that this is not true. Have you tried it? If I'm not mistaken: the third, fourth, and fifth OTP are xored together with the first and second, and are therefore the same as xoring messages 2..5 together into one value and xoring that with the first message. The result of {plaintext} xor {any of them} will match the value of {xor the others together}. Therefore any of them can decide to do the attack and they don't even need to know how many other messages/channels/OTPs/horcruxes there are.
- ljlolel 6y ago
  "by force" I mean force Signal to ship code to the end user to upload the private keys so they can give it to the government, as described in the doc.... Oh I see what you mean about modifying. Good point. That's not in the threat model, I haven't heard of people doing that, but if it is a worry and you want to add it to the threat model, it's not hard to add a hash to the messages that will be a commitment scheme to ensure that you have all horcruxes and they haven't been tampered with. That's pretty easy.
  - 6y ago