5 ms·
Copy pasting my comment: Consider this paragraph from the Signal protocol > ...For example, they may compare public key fingerprints manually, or by scanning
by xrisk 6y ago
Copy pasting my comment:
Consider this paragraph from the Signal protocol
> ...For example, they may compare public key fingerprints manually, or by scanning a QR code. Methods for doing this are outside the scope of this document.
> If authentication is not performed, the parties receive no cryptographic guarantee as to who they are communicating with.
Nobody I know in practice does this authentication. If an active attack is carried out, I'm reasonably sure people would not notice.
- marcinzm 6y ago>If an active attack is carried out, I'm reasonably sure people would not notice. If the attack happened after you have started communicating wouldn't you get a notification that the key of those you're communicating with has changed? An attack would only be invisible if it happened from the first communication. But unless it's very targeted someone somewhere would compare the keys and notice.
- xrisk 6y ago> An attack would only be invisible if it happened from the first communication. This is the scenario I'm talking about.
- marcinzm 6y agoI'd argue that if you're currently the target of a government you should take the time to verify the cryptographic signatures at least every so often. Any platform you use they could have gotten to the servers or the owners of the servers. Hell, they could patch the servers in memory so there's never any trace in source code.
- zamadatix 6y agoWouldn't it just take 1 person doing the verification on a new message to catch this though?
- xrisk 6y agoNot if it's targeted towards a particular pair of people.
- zamadatix 6y agoThere is some key exchange, pregeneration, and signing smarts involved with the server for all new communications at the initial connection. The net result is either everyone on your contacts was faked or nobody was (or you get a message when only 1 is intercepted on conversation setup). That being said it's possible for all of Bob's contacts to have been MITM but not all of Carol's so each person does have to check at least one conversation to be sure.
- LockAndLol 6y agoIt might be solvable with an external identity server that keeps the ID + key of users, but then you just move the problem of trust to another party. Additionally, that ID+key would have to be updated somehow by the user and now you have a new problem: how do you verify that the user is who they say they are? Telling them to digitally sign something is possible, but what if the private key is gone? The Signal protocol solves what it can solve for now. If cryptography experts have suggestions to improve it, I'm sure they can contribute. Is there any protocol that solves the issue you're describing? And that has a good app? And that isn't centralized? We're asking for the "eierlegende Wollmilchsau" aka unicorn.
- maxerickson 6y agoI can't see how this is a problem on its own. If they were eschewing some better option than "don't trust the server", that would be a problem, but is there a better option?
- xrisk 6y agoYes, the solution is … allow the protocol to let people run their own servers?
- maxerickson 6y agoIt's the Signal app that depends on their server, there isn't anything in the protocol that stops someone from building an app that talks to other servers. It's kind of fascinating, they have done a pretty good job of laying out their goals, easy contact discovery, forced protocol upgrades, etc, and people come up with all these improvements they could make by just setting aside those goals.
- SAI_Peregrinus 6y agoMatrix has the same problem. It requires out-of-band communication to trust the E2E encryption. Indeed, EVERY decentralized communications system will have this problem. There's no way to establish trust over a compromised channel without either a centralized pre-trusted agent (like the CA system in TLS) or an out-of-band secure channel (like Signal, Matrix, PGP, etc).