6 ms·

> The journalists who depend on it struggle with it and often mess up (“I send you the private key to communicate privately, right?”), the activists who use it

> The journalists who depend on it struggle with it and often mess up (“I send you the private key to communicate privately, right?”), the activists who use it do so relatively sparingly (“wait, this thing wants my finger print?”), and no other sane person is willing to use it by default. I used to think that the GPG web-of-trust verification in person was antiquated and no one would do it in practice. Which they don't. With Signal, when someone changes their phone, or reinstalls Signal, or one of five other things, I am supposed to...verify their "safety number" in person. I am not smart enough to make meaningful comments about cryptography, but the expectations from the user to verify things in real life seem the same in both cases. Am I just wrong here, or understanding something wrong? I swear everyone I talk to on Signal has changed their safety numbers at least once in the last couple years. Should I not talk to them any more until I verify those in person?

shawnz 6y ago
You probably don't need to verify just to tell someone "hello" or exchange other non-secret conversation. But it would be wise to verify before you plan a secret conspiracy with the person.
deleted 6y ago
[deleted]
movedx 6y ago
> Should I not talk to them any more until I verify those in person? It depends on your threat model. If you're a journalist talking to sources, then you should probably put down the phone and reach out through some other equally secure channel to confirm they're the ones who have changed their safety number (and even then, at this kind of level I'd have an "under duress" safe word.) If you're like me and you're browsing Hacker News in your underwear shouting at people's posts because they're wrong about Go, you're probably OK to assume your mate just changed their phone.
- tareqak 6y ago
  I have most of my Signal contacts also belong to a group on Signal. When I see the message for a contact’s verification number changing, I ask the contact in the Signal group if they got a new phone.
  - codethief 6y ago
    What prevents an attacker (who obtained access to your contact's phone number or is acting as a MITM) to forge a message (pretending to be your contact) in that Signal group, saying that yes, "he" indeed got a new phone? Or are you hoping that the attacker is only attacking your personal conversation with your contact, not your contact's other conversations?
    - tareqak 6y ago
      I know it's not sufficiently secure. For me, it's about educating other Signal users about the significance of the message that pops up. Almost all of the people on my Signal contact list use Signal because I asked them to do so.
cassepipe 6y ago
Well I guess it depends on your threat model. Do you casually use Signal because you are mass-surveillance aware or is it really important for you to be sure who you're sending messages to? Sounds like the former, so just let it be. Bonus : You get to know when your friends has lost his phone/bought a new one. (Unless they are very careful and set up a NIP:) I think Signal is a pretty good example of how to easily bring encrypted communication to the masses and to some individuals that may need the level of protection it provides. Is it perfect? No. Does it cover all use cases? No. Is it easier to set up than PGP? Definitely.
deathanatos 6y ago
> I am not smart enough to make meaningful comments about cryptography, but the expectations from the user to verify things in real life seem the same in both cases. It pretty much has to be, because it doesn't fall out of any particular crypto algorithm or implementation. When you're setting up an encrypted conversation with some other person, let's say "Bob", how do you ensure that you've actually set it up with Bob, vs. someone pretending to be Bob, or merely forwarding your messages to Bob so that both you & Bob think you're in contact, when you've really got an eavesdropper between you? In essences, you have to make sure that whatever cryptographic material you've either created or exchanged in order to communicate — e.g., your public keys — are the right ones. (That is, you have actual-Bob's key, not an attackers, and vice versa.) So, you must verify them, in whatever manner will convince you that you've gotten the right key(s). Verifying in person is essentially impossible to fake, unless you believe in masks like those from Mission Impossible. In this regard, the really important bit is authentication — making sure you're talking to the right person, not just making sure the conversation is private. It does no good to have a private conversation with the wrong person. One might refer to this as the "binding" between the cryptographic key(s) and the real-world meatspace entity (e.g., Bob) those keys represent. Is the binding we have the right binding? And that's the hard problem, it isn't "solvable" in the sense that we can make it invisible, but good UI can help immensely here. That said, in-person verification isn't the only way you can do things. "Trust-on-first-use" ("TOFU"), which is where you just blindly accept the key during the first conversation, but after that, you expect the same key. The idea being that it's a trade-off between convenience and safety — as long as that first exchange is fine, then afterwards, we'd notice anything fishy. And if you get a different one, there needs to be a reason, like Bob saying "oh I have a new phone now" — but does Bob actually have a new phone (and for some reason couldn't reuse the key from the old phone?) or is someone impersonating Bob using that as an excuse to get you to accept the new key. Another example is the CA system used by certificates on the web. CA's help establish the binding between a website & its private key by signing certificates. They verify keys, e.g., through the ACME challenges. It's definitely not without its defects, and a fair amount of ink has been spilled over the problems with the CA system. But it again represents a system of figuring out those bindings. Now, what you should do, e.g., whether TOFU suffices or not, should probably be dictated by some form of threat model. What risks are acceptable to you, what attacks do you expect to see, or that you must guard against (perhaps, e.g., due to legal requirement)? Those will tell you if, e.g., TOFU suffices, or if you need something stronger. From personal experience, specifically with GPG, just getting someone to display, e.g., a GPG fingerprint, long enough to verify it, is a PITA. It takes all of 15 minutes, but the people I've generally had to do this with are too impatient, and expect it to be simpler and quicker than GPG makes it. Marlinspike's article touches on that sort of stuff in "technological dead end"; although he is mentioning it more from an API integration point of view (which is painful), just day-to-day use of the CLI is also painful, and painful to teach.
upofadown 6y ago
It's like with any of these things that leave the hard problem of identity entirely to the user. You don't have to verify the safety number but if you don't you implicitly trust Signal not to intercept your communications. A valid choice, but these sorts of issues should be made clearer to the user. Just tell the user that if you want effective end to end communications there are certain things you have to do. A truth in advertising thing.
- greggyb 6y ago
  Forgive me if I misunderstand, but I thought Signal's protocol prevented anyone, including Signal from intercepting messages, as these are encrypted end-to-end. The threat model is that someone else is impersonating your correspondent. This is not message interception but identity verification. Your communication with whoever is on the other end is secure within Signal, but your correspondent may do whatever they wish with the messages.
  - lmm 6y ago
    If you haven't verified the identity of the other end then Signal could be MITMing you the whole time.
aborsy 6y ago
The journalists should implement appropriate OpSec, including learning to encrypt confidential information properly; be it using PGP or a more involved system: https://securedrop.org/ https://securedrop.org/ or otherwise seek professional help. Sending a message via WhatsApp or Signal may hide it from the Chinese government, but hands it over to Apple, Google, and intelligence agencies with whom they collaborate, who control mobile platforms.
- amingilani 6y ago
  This sounds great in theory but the journalists that often need this kind of help work in underfunded and hostile environments where technical people refuse to help them for their own safety. The few times I've given my analysis on some (trivially) technical material to a journalist, I was told that most people shy away from material they think is sensitive (it wasn't. Technically it was public information). I saw this first hand another time when I tried to introduce a journalist to an expert on a subject, but the expert just wouldn't want to get involved. And so they're left with terrible OpSec and technical people judging them from the sidelines. This is, of course, all based on my own experience from a developing country.
stuzenz 6y ago
> Am I just wrong here, or understanding something wrong? I swear everyone I talk to on Signal has changed their safety numbers at least once in the last couple years. Should I not talk to them any more until I verify those in person? I think keybase.io are on to the correct idea here. There was a good blog post about it somewhere in their blog. It wasn't this one - but this one does talk specifically to the problem you describe. https://keybase.io/blog/chat-apps-softer-than-tofu https://keybase.io/blog/chat-apps-softer-than-tofu
- schoolornot 6y ago
  Keybase also has the system where you can approve a new device from another. Why can't we have the same thing w/ Signal? Maybe tack on the PIN to make it a bit more secure.
  - vifon 6y ago
    If you backup the Signal data on the old device and restore it on the new one, your safety number won't change. This is the proper way to securely migrate to a new device.
    - dingaling 6y ago
      I think that's a serious backdoor for a coercive attacker. They only need access to the original device once and can then assume the identity of the contact on another device.
- oconnor663 6y ago
  You might be thinking of this one? https://keybase.io/blog/keybase-new-key-model https://keybase.io/blog/keybase-new-key-model
deleted 6y ago
[deleted]
deleted 6y ago
[deleted]
gspr 6y ago
> I used to think that the GPG web-of-trust verification in person was antiquated and no one would do it in practice. Which they don't. Debian developers authenticate through a GPG web of trust. In fact, to become one, one requirement is obtaining two links from the existing DD web of trust.

shawnz 6y ago

You probably don't need to verify just to tell someone "hello" or exchange other non-secret conversation. But it would be wise to verify before you plan a secret conspiracy with the person.

deleted 6y ago

[deleted]

movedx 6y ago

> Should I not talk to them any more until I verify those in person? It depends on your threat model. If you're a journalist talking to sources, then you should probably put down the phone and reach out through some other equally secure channel to confirm they're the ones who have changed their safety number (and even then, at this kind of level I'd have an "under duress" safe word.) If you're like me and you're browsing Hacker News in your underwear shouting at people's posts because they're wrong about Go, you're probably OK to assume your mate just changed their phone.

tareqak 6y ago
I have most of my Signal contacts also belong to a group on Signal. When I see the message for a contact’s verification number changing, I ask the contact in the Signal group if they got a new phone.
- codethief 6y ago
  What prevents an attacker (who obtained access to your contact's phone number or is acting as a MITM) to forge a message (pretending to be your contact) in that Signal group, saying that yes, "he" indeed got a new phone? Or are you hoping that the attacker is only attacking your personal conversation with your contact, not your contact's other conversations?
  - tareqak 6y ago
    I know it's not sufficiently secure. For me, it's about educating other Signal users about the significance of the message that pops up. Almost all of the people on my Signal contact list use Signal because I asked them to do so.

cassepipe 6y ago

Well I guess it depends on your threat model. Do you casually use Signal because you are mass-surveillance aware or is it really important for you to be sure who you're sending messages to? Sounds like the former, so just let it be. Bonus : You get to know when your friends has lost his phone/bought a new one. (Unless they are very careful and set up a NIP:) I think Signal is a pretty good example of how to easily bring encrypted communication to the masses and to some individuals that may need the level of protection it provides. Is it perfect? No. Does it cover all use cases? No. Is it easier to set up than PGP? Definitely.

deathanatos 6y ago

> I am not smart enough to make meaningful comments about cryptography, but the expectations from the user to verify things in real life seem the same in both cases. It pretty much has to be, because it doesn't fall out of any particular crypto algorithm or implementation. When you're setting up an encrypted conversation with some other person, let's say "Bob", how do you ensure that you've actually set it up with Bob, vs. someone pretending to be Bob, or merely forwarding your messages to Bob so that both you & Bob think you're in contact, when you've really got an eavesdropper between you? In essences, you have to make sure that whatever cryptographic material you've either created or exchanged in order to communicate — e.g., your public keys — are the right ones. (That is, you have actual-Bob's key, not an attackers, and vice versa.) So, you must verify them, in whatever manner will convince you that you've gotten the right key(s). Verifying in person is essentially impossible to fake, unless you believe in masks like those from Mission Impossible. In this regard, the really important bit is authentication — making sure you're talking to the right person, not just making sure the conversation is private. It does no good to have a private conversation with the wrong person. One might refer to this as the "binding" between the cryptographic key(s) and the real-world meatspace entity (e.g., Bob) those keys represent. Is the binding we have the right binding? And that's the hard problem, it isn't "solvable" in the sense that we can make it invisible, but good UI can help immensely here. That said, in-person verification isn't the only way you can do things. "Trust-on-first-use" ("TOFU"), which is where you just blindly accept the key during the first conversation, but after that, you expect the same key. The idea being that it's a trade-off between convenience and safety — as long as that first exchange is fine, then afterwards, we'd notice anything fishy. And if you get a different one, there needs to be a reason, like Bob saying "oh I have a new phone now" — but does Bob actually have a new phone (and for some reason couldn't reuse the key from the old phone?) or is someone impersonating Bob using that as an excuse to get you to accept the new key. Another example is the CA system used by certificates on the web. CA's help establish the binding between a website & its private key by signing certificates. They verify keys, e.g., through the ACME challenges. It's definitely not without its defects, and a fair amount of ink has been spilled over the problems with the CA system. But it again represents a system of figuring out those bindings. Now, what you should do, e.g., whether TOFU suffices or not, should probably be dictated by some form of threat model. What risks are acceptable to you, what attacks do you expect to see, or that you must guard against (perhaps, e.g., due to legal requirement)? Those will tell you if, e.g., TOFU suffices, or if you need something stronger. From personal experience, specifically with GPG, just getting someone to display, e.g., a GPG fingerprint, long enough to verify it, is a PITA. It takes all of 15 minutes, but the people I've generally had to do this with are too impatient, and expect it to be simpler and quicker than GPG makes it. Marlinspike's article touches on that sort of stuff in "technological dead end"; although he is mentioning it more from an API integration point of view (which is painful), just day-to-day use of the CLI is also painful, and painful to teach.

upofadown 6y ago

It's like with any of these things that leave the hard problem of identity entirely to the user. You don't have to verify the safety number but if you don't you implicitly trust Signal not to intercept your communications. A valid choice, but these sorts of issues should be made clearer to the user. Just tell the user that if you want effective end to end communications there are certain things you have to do. A truth in advertising thing.

greggyb 6y ago
Forgive me if I misunderstand, but I thought Signal's protocol prevented anyone, including Signal from intercepting messages, as these are encrypted end-to-end. The threat model is that someone else is impersonating your correspondent. This is not message interception but identity verification. Your communication with whoever is on the other end is secure within Signal, but your correspondent may do whatever they wish with the messages.
- lmm 6y ago
  If you haven't verified the identity of the other end then Signal could be MITMing you the whole time.

aborsy 6y ago

The journalists should implement appropriate OpSec, including learning to encrypt confidential information properly; be it using PGP or a more involved system: https://securedrop.org/ https://securedrop.org/ or otherwise seek professional help. Sending a message via WhatsApp or Signal may hide it from the Chinese government, but hands it over to Apple, Google, and intelligence agencies with whom they collaborate, who control mobile platforms.

amingilani 6y ago
This sounds great in theory but the journalists that often need this kind of help work in underfunded and hostile environments where technical people refuse to help them for their own safety. The few times I've given my analysis on some (trivially) technical material to a journalist, I was told that most people shy away from material they think is sensitive (it wasn't. Technically it was public information). I saw this first hand another time when I tried to introduce a journalist to an expert on a subject, but the expert just wouldn't want to get involved. And so they're left with terrible OpSec and technical people judging them from the sidelines. This is, of course, all based on my own experience from a developing country.

stuzenz 6y ago

> Am I just wrong here, or understanding something wrong? I swear everyone I talk to on Signal has changed their safety numbers at least once in the last couple years. Should I not talk to them any more until I verify those in person? I think keybase.io are on to the correct idea here. There was a good blog post about it somewhere in their blog. It wasn't this one - but this one does talk specifically to the problem you describe. https://keybase.io/blog/chat-apps-softer-than-tofu https://keybase.io/blog/chat-apps-softer-than-tofu

schoolornot 6y ago
Keybase also has the system where you can approve a new device from another. Why can't we have the same thing w/ Signal? Maybe tack on the PIN to make it a bit more secure.
- vifon 6y ago
  If you backup the Signal data on the old device and restore it on the new one, your safety number won't change. This is the proper way to securely migrate to a new device.
  - dingaling 6y ago
    I think that's a serious backdoor for a coercive attacker. They only need access to the original device once and can then assume the identity of the contact on another device.
oconnor663 6y ago
You might be thinking of this one? https://keybase.io/blog/keybase-new-key-model https://keybase.io/blog/keybase-new-key-model

deleted 6y ago

[deleted]

deleted 6y ago

[deleted]

gspr 6y ago

> I used to think that the GPG web-of-trust verification in person was antiquated and no one would do it in practice. Which they don't. Debian developers authenticate through a GPG web of trust. In fact, to become one, one requirement is obtaining two links from the existing DD web of trust.