4 ms·

I share the view that end-to-end encryption (E2EE) provides strong security guarantees only if the clients used to exchange data/messages are fully under contro

I share the view that end-to-end encryption (E2EE) provides strong security guarantees only if the clients used to exchange data/messages are fully under control of the end users. All it would take Signal to undermine their E2EE is a single update of their app that exfiltrates all chat messages (not saying that I think they would ever do that). Same story for WhatsApp. In my opinion, a necessary ingredient for secure E2EE is that you don't have to trust the central infrastructure operator, at all. And that just doesn't work if the provider controls the client software. Another problem is that almost all E2EE messengers can still be trivially man-in-the-middled (MITM) by the infrastructure operator, as there's no out-of-band verification of keys. The central server can just replace client keys in transit and decrypt all the data exchanged between two clients. This can only be detected by clients comparing their public keys over an out-of-band channel. Most E2EE messengers simply disregard this risk [1], while some provide functionality for out-of-band key verification (e.g. Threema). Always struck me as a bit odd as it's like using self-signed TLS certificates for your server, which leads to a security exception in all modern browsers but somehow seems to be fine for E2EE messengers. Keybase tried to solve this problem but unfortunately they got acquired by Zoom so I doubt they will continue working on that. [1] https://signal.org/blog/there-is-no-whatsapp-backdoor/ https://signal.org/blog/there-is-no-whatsapp-backdoor/

telotortium 5y ago
The article mentioned something I was not aware of - that WhatsApp has already started sending metadata (the number of times a message has been forwarded) in the clear: > This is not a theoretical argument. Disabling E2E encryption has already happened, although hardly anyone knows about it. In 2019 WhatsApp imposed forwarding limits on messages in order to “slow down the spread of rumors, viral messages, and fake news”. This represents a total defeat of the Signal protocol’s cryptographic objectives: a basic goal of any modern cryptographic scheme is to ensure the same message encrypted twice doesn’t encrypt to the same bytes. The point of this is to stop the adversary knowing when you’re repeatedly sending the same message and encryption modes that get this wrong (like AES/ECB) are discredited. Yet once Facebook — the adversary — became dominated by authoritarians who see unlimited communication as chaotic, they simply changed the client to include a forwarding counter outside the encrypted part of the message. There was nothing anyone could do about this. It just showed up one day, and all the fancy mathematics designed to stop this “attack” were irrelevant.
- mathnmusic 5y ago
  WhatsApp does the counting of message forward completely on the client side. Their server does not know how many times a message has been forwarded. THe article author's point was not that metadata is being sent in the clear, but that the real goal of encryption is to be unable to manipulate social behaviour. And because WhatsApp controls the client, they are able to do this without breaking E2EE or leaking metadata.
rcxdude 5y ago
"Trivial" is overstating it, for exactly the reasons posted in that blogpost. People can and do verify keys out-of-band, and for that reason there is an extremely low chance that whatsapp (or signal) is wholesale MITMing connections. If you are concerned you will be targeted specifically you can treat key changes with much more suspicion.
- mike_hearn 5y ago
  But note, this still requires trusting the client. If the provider is going to change a key on you to spy on your messages, they will start by pushing a routine update to take out the warning and - assuming some cooperation from the app stores - that update could be sent only to you or your contacts.
rezonant 5y ago
> And that just doesn't work if the provider controls the client software. The web platform is now capable of making this not required, we just need to build solutions that take advantage of it. The coupling of the service and the client (web/mobile apps) is something that should be challenged in "web 3.0" designs.
feanaro 5y ago
This is why you should use an open standard like Matrix and a client like Element where key verification is a first-class citizen.

telotortium 5y ago

The article mentioned something I was not aware of - that WhatsApp has already started sending metadata (the number of times a message has been forwarded) in the clear: > This is not a theoretical argument. Disabling E2E encryption has already happened, although hardly anyone knows about it. In 2019 WhatsApp imposed forwarding limits on messages in order to “slow down the spread of rumors, viral messages, and fake news”. This represents a total defeat of the Signal protocol’s cryptographic objectives: a basic goal of any modern cryptographic scheme is to ensure the same message encrypted twice doesn’t encrypt to the same bytes. The point of this is to stop the adversary knowing when you’re repeatedly sending the same message and encryption modes that get this wrong (like AES/ECB) are discredited. Yet once Facebook — the adversary — became dominated by authoritarians who see unlimited communication as chaotic, they simply changed the client to include a forwarding counter outside the encrypted part of the message. There was nothing anyone could do about this. It just showed up one day, and all the fancy mathematics designed to stop this “attack” were irrelevant.

mathnmusic 5y ago
WhatsApp does the counting of message forward completely on the client side. Their server does not know how many times a message has been forwarded. THe article author's point was not that metadata is being sent in the clear, but that the real goal of encryption is to be unable to manipulate social behaviour. And because WhatsApp controls the client, they are able to do this without breaking E2EE or leaking metadata.

rcxdude 5y ago

"Trivial" is overstating it, for exactly the reasons posted in that blogpost. People can and do verify keys out-of-band, and for that reason there is an extremely low chance that whatsapp (or signal) is wholesale MITMing connections. If you are concerned you will be targeted specifically you can treat key changes with much more suspicion.

mike_hearn 5y ago
But note, this still requires trusting the client. If the provider is going to change a key on you to spy on your messages, they will start by pushing a routine update to take out the warning and - assuming some cooperation from the app stores - that update could be sent only to you or your contacts.

rezonant 5y ago

> And that just doesn't work if the provider controls the client software. The web platform is now capable of making this not required, we just need to build solutions that take advantage of it. The coupling of the service and the client (web/mobile apps) is something that should be challenged in "web 3.0" designs.

feanaro 5y ago

This is why you should use an open standard like Matrix and a client like Element where key verification is a first-class citizen.