3 ms·

> Disappearing messages by default could further weaken social protections. > Police and authorities can have logs (either of everyone or high value targets) a

> Disappearing messages by default could further weaken social protections. > Police and authorities can have logs (either of everyone or high value targets) and those people won't have access to their own messages to defend themselves. > It even means chat conversations can be entirely fabricated by one side, and the other has no way to refute it. I don't think that's a realistic threat, and if it was, the defense you propose wouldn't work. Given that Signal is E2E encrypted, I don't see the mechanism where the police and authorities could even have logs without compromising the endpoints. Furthermore, even if they did fabricate a message, it's not like your phone is some inviolable log of what you actually sent. Even with Signal today, you can delete messages on an ah-hoc basis, so their rebuttal (that you sent it but deleted it from your phone) would be exactly the same.

tialaramex 5y ago
> it's not like your phone is some inviolable log of what you actually sent. In some systems, e.g. PGP, messages are digitally signed. This means when I send you a PGP mail, I'm actually providing proof - which anybody can verify - that I really sent that email. If what you wanted the message platform for was to agree legal contracts maybe that feels like a reasonable structure. Alice sends Bob a PGP mail "I agree to X" and Bob now has a signed message proving this agreement. Bob couldn't have faked that, only Alice could have signed it. Signal deliberately doesn't do that. Signal messages have cryptographic integrity protection (so Charlie can't send Bob a message pretending to be from Alice) but not signatures, so Bob can fake messages from Alice to Bob because Bob is a participant and so has the keys. As a result Bob knows if the messages are fake or real, but can't prove that to anybody else. That feels much more like what you want from a platform you use to chat with people, not for making legal contracts.
- upofadown 5y ago
  Signal messages are effectively signed as part of the protocol. Signal releases data to allow your correspondent to forge that signature after they have received your message. Then you have to attempt to claim a forgery in a system specifically designed to allow such a claim. PGP does the identity verification out of band. So you can simply not sign your message and completely eliminate the problem in the first place. So it seems odd to suggest that PGP is inferior to what Signal does. >This means when I send you a PGP mail, I'm actually providing proof - which anybody can verify - that I really sent that email. PGP prevents access to signature information with the encryption. So you would need access to the private key of the person I sent the message to before you can verify my signature.
  - tialaramex 5y ago
    > Signal messages are effectively signed as part of the protocol What is the word "effectively" doing in your sentence? I suggest that the word you needed is in fact just not. The messages can be authenticated but they are not signed. > Signal releases data to allow your correspondent to forge that signature after they have received your message. Nope. Bob always has the ability to produce forged messages apparently from Alice (or Charlie) to Bob. What may have confused you is that Signal can eventually send Bob's expired authentication keys in cleartext. At this point any eavesdropper could make forged messages from somebody to Bob, that seem authentic to anybody except Bob (and presumably whoever didn't actually send them) but are rather old news. > PGP does the identity verification out of band. So you can simply not sign your message and completely eliminate the problem in the first place. In this case your message can't be authenticated, a very different scenario. Now Bob can't tell if this PGP email is really even from Alice because it lacks a signature. Perhaps useful for an anonymous tips line or something, but rarely what we want for messaging. > PGP prevents access to signature information with the encryption. So you would need access to the private key of the person I sent the message to before you can verify my signature. Nope. Just need the signed message. If the message was also encrypted then its recipient can decrypt it and show the decrypted but still signed message to other people as proof of what was sent, without revealing their private key. This is very often undesirable, and yet it's the only option provided in PGP.
    - upofadown 5y ago
      Signal uses a form of Diffie-Hellman to generate a common key. That exchange has to be signed. So you know that your key is common with your correspondent. Without this signature you would have no way to know where a message came from, just like in the unsigned PGP case. Without this signature you would also be subject to MITM attacks (unlike the PGP case). >What may have confused you is that Signal can eventually send Bob's expired authentication keys in cleartext. Is this a new feature? Originally the decision was made to only allow correspondents to forge messages, not everyone as in the case of Off The Record. If you signed a PGP message and did not encrypt it then you specifically wanted it to be possible for everyone to verify the signature. A trusted correspondent would not decrypt and release your signed message so the only time that would happen would be if your correspondent was compromised. In the Signal case you would have to claim that your trusted correspondent forged a message from you. That wouldn't really work. In the case of an untrusted correspondent you would not want to sign your message at all or would sign it with a non-public identity. PGP allows you do do either.

tialaramex 5y ago

> it's not like your phone is some inviolable log of what you actually sent. In some systems, e.g. PGP, messages are digitally signed. This means when I send you a PGP mail, I'm actually providing proof - which anybody can verify - that I really sent that email. If what you wanted the message platform for was to agree legal contracts maybe that feels like a reasonable structure. Alice sends Bob a PGP mail "I agree to X" and Bob now has a signed message proving this agreement. Bob couldn't have faked that, only Alice could have signed it. Signal deliberately doesn't do that. Signal messages have cryptographic integrity protection (so Charlie can't send Bob a message pretending to be from Alice) but not signatures, so Bob can fake messages from Alice to Bob because Bob is a participant and so has the keys. As a result Bob knows if the messages are fake or real, but can't prove that to anybody else. That feels much more like what you want from a platform you use to chat with people, not for making legal contracts.

upofadown 5y ago
Signal messages are effectively signed as part of the protocol. Signal releases data to allow your correspondent to forge that signature after they have received your message. Then you have to attempt to claim a forgery in a system specifically designed to allow such a claim. PGP does the identity verification out of band. So you can simply not sign your message and completely eliminate the problem in the first place. So it seems odd to suggest that PGP is inferior to what Signal does. >This means when I send you a PGP mail, I'm actually providing proof - which anybody can verify - that I really sent that email. PGP prevents access to signature information with the encryption. So you would need access to the private key of the person I sent the message to before you can verify my signature.
- tialaramex 5y ago
  > Signal messages are effectively signed as part of the protocol What is the word "effectively" doing in your sentence? I suggest that the word you needed is in fact just not. The messages can be authenticated but they are not signed. > Signal releases data to allow your correspondent to forge that signature after they have received your message. Nope. Bob always has the ability to produce forged messages apparently from Alice (or Charlie) to Bob. What may have confused you is that Signal can eventually send Bob's expired authentication keys in cleartext. At this point any eavesdropper could make forged messages from somebody to Bob, that seem authentic to anybody except Bob (and presumably whoever didn't actually send them) but are rather old news. > PGP does the identity verification out of band. So you can simply not sign your message and completely eliminate the problem in the first place. In this case your message can't be authenticated, a very different scenario. Now Bob can't tell if this PGP email is really even from Alice because it lacks a signature. Perhaps useful for an anonymous tips line or something, but rarely what we want for messaging. > PGP prevents access to signature information with the encryption. So you would need access to the private key of the person I sent the message to before you can verify my signature. Nope. Just need the signed message. If the message was also encrypted then its recipient can decrypt it and show the decrypted but still signed message to other people as proof of what was sent, without revealing their private key. This is very often undesirable, and yet it's the only option provided in PGP.
  - upofadown 5y ago
    Signal uses a form of Diffie-Hellman to generate a common key. That exchange has to be signed. So you know that your key is common with your correspondent. Without this signature you would have no way to know where a message came from, just like in the unsigned PGP case. Without this signature you would also be subject to MITM attacks (unlike the PGP case). >What may have confused you is that Signal can eventually send Bob's expired authentication keys in cleartext. Is this a new feature? Originally the decision was made to only allow correspondents to forge messages, not everyone as in the case of Off The Record. If you signed a PGP message and did not encrypt it then you specifically wanted it to be possible for everyone to verify the signature. A trusted correspondent would not decrypt and release your signed message so the only time that would happen would be if your correspondent was compromised. In the Signal case you would have to claim that your trusted correspondent forged a message from you. That wouldn't really work. In the case of an untrusted correspondent you would not want to sign your message at all or would sign it with a non-public identity. PGP allows you do do either.