5 ms·

I'm confused about this piece. If there's true E2E encryption (verified by open source client code and review of released binaries) then why does it matter if t

I'm confused about this piece. If there's true E2E encryption (verified by open source client code and review of released binaries) then why does it matter if the server code is backdoored or not? The whole point of E2E is that you don't need to care about the server being able to ever see the text of your messages because it never can.

tailspin2019 6y ago
Do we have a way to verify that the App Store apps are actually running the open source (as published) code?
- eat_veggies 6y ago
  Builds on Android have been (mostly) reproducible since 2016: https://signal.org/blog/reproducible-android/ https://signal.org/blog/reproducible-android/ Looks like the situation is more complicated and still unresolved for iOS: https://github.com/signalapp/Signal-iOS/issues/641 https://github.com/signalapp/Signal-iOS/issues/641
  - tailspin2019 6y ago
    Interesting! Thanks for the links.
Ericson2314 6y ago
It's certainly much better than the norm! But there's also metadata retention, which Signal frequently brags about being good at not doing, but which is unverifiable unless it's you serving the warrant and coming up disappointed.
xrisk 6y ago
Copy pasting my comment: Consider this paragraph from the Signal protocol > ...For example, they may compare public key fingerprints manually, or by scanning a QR code. Methods for doing this are outside the scope of this document. > If authentication is not performed, the parties receive no cryptographic guarantee as to who they are communicating with. Nobody I know in practice does this authentication. If an active attack is carried out, I'm reasonably sure people would not notice.
- marcinzm 6y ago
  >If an active attack is carried out, I'm reasonably sure people would not notice. If the attack happened after you have started communicating wouldn't you get a notification that the key of those you're communicating with has changed? An attack would only be invisible if it happened from the first communication. But unless it's very targeted someone somewhere would compare the keys and notice.
  - xrisk 6y ago
    > An attack would only be invisible if it happened from the first communication. This is the scenario I'm talking about.
    - marcinzm 6y ago
      I'd argue that if you're currently the target of a government you should take the time to verify the cryptographic signatures at least every so often. Any platform you use they could have gotten to the servers or the owners of the servers. Hell, they could patch the servers in memory so there's never any trace in source code.
- zamadatix 6y ago
  Wouldn't it just take 1 person doing the verification on a new message to catch this though?
  - xrisk 6y ago
    Not if it's targeted towards a particular pair of people.
    - zamadatix 6y ago
      There is some key exchange, pregeneration, and signing smarts involved with the server for all new communications at the initial connection. The net result is either everyone on your contacts was faked or nobody was (or you get a message when only 1 is intercepted on conversation setup). That being said it's possible for all of Bob's contacts to have been MITM but not all of Carol's so each person does have to check at least one conversation to be sure.
einpoklum 6y ago
> If there's true E2E encryption ... why does it matter if the server code is backdoored or not? Meta-data: Log of who called whom, when and for how long. Also, user account details.

tailspin2019 6y ago

Do we have a way to verify that the App Store apps are actually running the open source (as published) code?

eat_veggies 6y ago
Builds on Android have been (mostly) reproducible since 2016: https://signal.org/blog/reproducible-android/ https://signal.org/blog/reproducible-android/ Looks like the situation is more complicated and still unresolved for iOS: https://github.com/signalapp/Signal-iOS/issues/641 https://github.com/signalapp/Signal-iOS/issues/641
- tailspin2019 6y ago
  Interesting! Thanks for the links.

Ericson2314 6y ago

It's certainly much better than the norm! But there's also metadata retention, which Signal frequently brags about being good at not doing, but which is unverifiable unless it's you serving the warrant and coming up disappointed.

xrisk 6y ago

Copy pasting my comment: Consider this paragraph from the Signal protocol > ...For example, they may compare public key fingerprints manually, or by scanning a QR code. Methods for doing this are outside the scope of this document. > If authentication is not performed, the parties receive no cryptographic guarantee as to who they are communicating with. Nobody I know in practice does this authentication. If an active attack is carried out, I'm reasonably sure people would not notice.

marcinzm 6y ago
>If an active attack is carried out, I'm reasonably sure people would not notice. If the attack happened after you have started communicating wouldn't you get a notification that the key of those you're communicating with has changed? An attack would only be invisible if it happened from the first communication. But unless it's very targeted someone somewhere would compare the keys and notice.
- xrisk 6y ago
  > An attack would only be invisible if it happened from the first communication. This is the scenario I'm talking about.
  - marcinzm 6y ago
    I'd argue that if you're currently the target of a government you should take the time to verify the cryptographic signatures at least every so often. Any platform you use they could have gotten to the servers or the owners of the servers. Hell, they could patch the servers in memory so there's never any trace in source code.
zamadatix 6y ago
Wouldn't it just take 1 person doing the verification on a new message to catch this though?
- xrisk 6y ago
  Not if it's targeted towards a particular pair of people.
  - zamadatix 6y ago
    There is some key exchange, pregeneration, and signing smarts involved with the server for all new communications at the initial connection. The net result is either everyone on your contacts was faked or nobody was (or you get a message when only 1 is intercepted on conversation setup). That being said it's possible for all of Bob's contacts to have been MITM but not all of Carol's so each person does have to check at least one conversation to be sure.

einpoklum 6y ago

> If there's true E2E encryption ... why does it matter if the server code is backdoored or not? Meta-data: Log of who called whom, when and for how long. Also, user account details.