6 ms·

> Email can be e2e encrypted easily if you want it. Not with the same security guarantees, the same usability, nor the absence of footguns that apps such as Si

by hiq 5y ago

> Email can be e2e encrypted easily if you want it. Not with the same security guarantees, the same usability, nor the absence of footguns that apps such as Signal provide. > Also, proper e2ee requires identity verification of your contacts, where you check their key fingerprints using an uncompromised channel. If you skip this part, all e2ee you use is just a security theater. Even if you don't check fingerprints, you're fully protected against passive attackers, as well as attackers who started being active only after the key exchange. For casual users, Signal is a good protection against dragnet surveillance. For advanced users, Signal with key fingerprint checks is a good protection against more powerful attackers that control the network.

Andrew_nenakhov 5y ago
> For casual users, Signal is a good protection against dragnet surveillance. It is not a protection, just a security theater. If you don't trust your service provider not to spy on you, you must not trust it completely. Thus, Signal tells you that you are talking to Joe, but it can easily make it so that you talk to MitM who talks to Joe, for everyone, dragnet style. (those who do indeed verify fingerprints are excluded from this program) Nobody but the slim nerdy minority wants to burden themselves with proper e2ee, yet everyone insists on having some snake oil too. Don't want to be spied by your service provider - run you own server. That's what federation is for.
- angus-prune 5y ago
  I feel like I'm missing something. If they introduced blanket MitM, it would only take one person to verify fingerprints for it to become public. You mention that people who verify fingerprints would be excluded, but I've no idea how you'd achieve that. My understanding is that proper fingerprint confirmation has to, by definition, be conducted out of band. With any FLOSS everyone is trusting that another geek somewhere is paying attention to a particular piece of software and will raise the alarm if there is something wrong. And I do mean everyone. I don't think its conceivable that even the most paranoid, technically proficient user could verify the integrity of their entire technology stack.
  - Andrew_nenakhov 5y ago
    No, not really. There are actually ways to go around that. One person who does verify a fingerprint will get a real fingerprint. Or maybe they'll just show you same numbers as to your buddy, because they control both server and client software and users have very very limited resources to control what code is shipped to them via appstores. You see, this is all a question of trust. The only threat against which the e2ee is useful is non-trusted server admin. But then signal fans paradoxically don't trust Signal to have their unencrypted communications and simultaneously trust them to have means to get access to their messages. So in practice a personal/corporate email / xmpp server without any e2ee gives you a better level of security than using third party service like Signal with e2ww, because in that case the attacker will have to somehow gain admin access to your server to learn anything about your communications, while in Signal's case, even if they don't compromise your encryption, they still have means to know who you are talking with, when, your IP addresses, etc. (and don't even let me started on that crap where Signal supposedly has no ability to know who is sending you a message - it all can be logged on server side, and we're not trusting the service operator, right?) Tldr: insisting on e2ee while fully trusting third party infrastructure is double-think at its best. If you want to be safe, use self-hosted servers. Which brings you to federation. :-D
    - hiq 5y ago
      > One person who does verify a fingerprint will get a real fingerprint. Or maybe they'll just show you same numbers as to your buddy, because they control both server and client software and users have very very limited resources to control what code is shipped to them via appstores. The fingerprint is computed at key exchange, you can't change it after the fact without warnings about it. If you assume the clients are compromised, E2EE or federation or other network properties won't help, so this discussion is meaningless. Nobody claimed E2EE was the be-all and end-all of security; only that it's an improvement over having to trust a 3rd party. This is because everything else being equal, the less components you trust, the better security-wise. So given a network operator, if you can choose between trusting them or not, you'll be better off not trusting them. That's why E2EE is better than no E2EE. Finally "use your own server" seems like the perfect solution if you're only talking to yourself. To take the email example, just because you trust gmx.de doesn't mean you want to trust mail.ru, but it seems that you're either suggesting that the trust propagates between servers in the same federated network (obviously not the case), or that you can just demand your recipients use the server you chose, ending up with a centralized silo within the federated network, which is itself a contradiction.
- hiq 5y ago
  > It is not a protection, just a security theater. Signal is a perfectly good protection against passive attackers. MITMing a non negligible portion of Signal users would be too visible to be worth doing. This doesn't solve target surveillance (but key fingerprint checks help there), but this does ensure that most of the data exchanged via Signal services does not feed NSA databases. > If you don't trust your service provider not to spy on you, you must not trust it completely. Ideally you wouldn't trust anything nor anyone, that's the Mossad thread model and it's not useful to judge incremental improvements. > Don't want to be spied by your service provider - run you own server. That's what federation is for. A server running where? Most "servers" are rented from a big cloud provider, and there's no physical control over it. Having to trust these is definitely worse in terms of security. This is also forgetting the users Signal is targeting, who are not technical users, but precisely people who don't know what a server is.
  - Andrew_nenakhov 5y ago
    > MITMing a non negligible portion of Signal users would be too visible to be worth doing. You are not trusting Signal to have your unencrypted chats. Why do you trust their client apps? You aren't building them yourselves, right? MitMing ALL users and just showing them matching fingerprints so they feel safe is pretty plausible, since all users communicate using one central server. Of course, this MitMing is best perpetrated by Signal themselves. > A server running where? Most "servers" are rented from a big cloud provider, and there's no physical control over it. If you are a criminal, somewhere in TOR. If you are a legal organization, in your server room. If you are neither, nobody freaking cares about your chats and you might as well keep them unencrypted, enjoying better portability and overall improved user experience, as proven by Telegram.
    - hiq 5y ago
      > Why do you trust their client apps? Because it's open-source, has been reviewed extensively, and people (with various degrees of expertise) keep looking at it. > You aren't building them yourselves, right? It builds reproducibly on Android, so this doesn't matter. > If you are neither, nobody freaking cares about your chats That's not what the Snowden leaks showed, nor what scandals about e.g. some $BIG_CORP employees stalking their acquaintances via their privileged accesses demonstrated. E2EE on Signal means I don't have to trust that some employees won't abuse their rights to access my data. Do you even know how many people could access your Telegram chats if they wanted to? Just look up "stalker facebook employee", this is not some theoretical scenario. You're basically saying you and others have "nothing to hide". This argument has been repeated and debunked ad nauseam, if the whole literature against this stance hasn't convinced you yet I don't have more to convince you now.
- tialaramex 5y ago
  > (those who do indeed verify fingerprints are excluded from this program) Does this use mind-reading or time travel? Which is it? Suppose I walk across to my friend Steve's house tomorrow and I verify our Safety Numbers match. Do the Secret Police hop into their time machine and go back and cross Steve and myself [and all our contacts?] off their MITM list? Or did they use precognition to know I was going to do it and so they were able to never intercept the affected messages in the past? > Don't want to be spied by your service provider - run you own server. That's what federation is for. Notice that when you do this, the Secret Police's job is suddenly trivial. Gee, I wonder who we should arrest for this conspiracy that was organised on Andrew_nenakhov's server? Let's try starting with Andrew_nenakhov. Bingo. Job #1 if you actually don't want this sort of global surveillance effort to be successful is Don't Stand Out. If your traffic is special, if your users are different, if your service is unlike all the others - you are a target. So blend in, that means you use TLS because everybody else does, and you use Google's Play message service because everybody else does, and you use the same server for all the mundane shit that is used for the plot to kill the Secret Police chief.
  - Andrew_nenakhov 5y ago
    > Does this use mind-reading or time travel? Which is it? Read my lips. You do not trust the service provider. To be consistent, you do not trust the software provided by this provider. From here, the possibilities are endless. They can just show you some fingerprint numbers so you feel safe, while in practice they might be completely unrelated to the real keys. Or whatever. The keys you verify with your friend Steve might be generated on the very moment you look at them, unrelated to your prior keys that you used 'trusting' the Signal's CA. > Job #1 if you actually don't want this sort of global surveillance effort to be successful is Don't Stand Out. That's why just use a plain old email server in TOR network, not tied to your identity. Email blends in juuust fine, certainly much better than centralized silo Signal where your accounts are tied to your identites.
    - tialaramex 5y ago
      You made a claim ("those who do indeed verify fingerprints are excluded from this program") and "read my lips" doesn't substantiate it. Your claim was in fact just nonsense.
upofadown 5y ago
Well that means that, Signal (and other instant encrypted messengers) bundle the risk up into one huge footgun. Very few people know how to verify their identities with the "safety numbers" and then keep them verified. As a result, you end up trusting the provider not to MITM your messages. This is particularly trivial to do in, say, some sort of non-federated system where one entity controls the entire infrastructure. That is not necessarily a bad thing but it would be good if the user was made to understand exactly who they are trusting. Signal deemphasizes this sort of information these days and has made the warnings about changed safety numbers easier to ignore. This is a depressingly common progression. At least with encrypted email you are less likely to kid yourself. If you do figure it out then the existence of identities you treat as objects ("public keys") makes it intuitively obvious that you have to get the right one.
- hiq 5y ago
  I think you're saying that Signal is not perfect, and I agree, but there's just nothing better at the moment. Email encryption is a bad reference because it has negligible usage (in comparison with modern messengers) and has proved over the years that it cannot cater to the needs of Signal's current users. But even then, I don't think we can claim that getting the email encryption setup right is any easier than ensuring one hasn't been MITMed during the initial key exchange on Signal.
  - upofadown 5y ago
    In terms of usability, Signal is not that great. In a usability study involving Signal[1], 21 out of 28 computer science students failed to establish and maintain a secure end to end encrypted connection. I am old enough to be pretty cynical about this stuff. People keep on coming up with purely technical solutions to the encrypted messaging problem. They all eventually fall down on the human side. This isn't working. We have to do something else. [1] https://www.ndss-symposium.org/wp-content/uploads/2018/03/09-when-signal-hits-the-fan-on-the-usability-and-security-of-state-of-the-art-secure-mobile-messaging.pdf https://www.ndss-symposium.org/wp-content/uploads/2018/03/09...

by hiq 5y ago

Andrew_nenakhov 5y ago

> For casual users, Signal is a good protection against dragnet surveillance. It is not a protection, just a security theater. If you don't trust your service provider not to spy on you, you must not trust it completely. Thus, Signal tells you that you are talking to Joe, but it can easily make it so that you talk to MitM who talks to Joe, for everyone, dragnet style. (those who do indeed verify fingerprints are excluded from this program) Nobody but the slim nerdy minority wants to burden themselves with proper e2ee, yet everyone insists on having some snake oil too. Don't want to be spied by your service provider - run you own server. That's what federation is for.

angus-prune 5y ago
I feel like I'm missing something. If they introduced blanket MitM, it would only take one person to verify fingerprints for it to become public. You mention that people who verify fingerprints would be excluded, but I've no idea how you'd achieve that. My understanding is that proper fingerprint confirmation has to, by definition, be conducted out of band. With any FLOSS everyone is trusting that another geek somewhere is paying attention to a particular piece of software and will raise the alarm if there is something wrong. And I do mean everyone. I don't think its conceivable that even the most paranoid, technically proficient user could verify the integrity of their entire technology stack.
- Andrew_nenakhov 5y ago
  No, not really. There are actually ways to go around that. One person who does verify a fingerprint will get a real fingerprint. Or maybe they'll just show you same numbers as to your buddy, because they control both server and client software and users have very very limited resources to control what code is shipped to them via appstores. You see, this is all a question of trust. The only threat against which the e2ee is useful is non-trusted server admin. But then signal fans paradoxically don't trust Signal to have their unencrypted communications and simultaneously trust them to have means to get access to their messages. So in practice a personal/corporate email / xmpp server without any e2ee gives you a better level of security than using third party service like Signal with e2ww, because in that case the attacker will have to somehow gain admin access to your server to learn anything about your communications, while in Signal's case, even if they don't compromise your encryption, they still have means to know who you are talking with, when, your IP addresses, etc. (and don't even let me started on that crap where Signal supposedly has no ability to know who is sending you a message - it all can be logged on server side, and we're not trusting the service operator, right?) Tldr: insisting on e2ee while fully trusting third party infrastructure is double-think at its best. If you want to be safe, use self-hosted servers. Which brings you to federation. :-D
  - hiq 5y ago
    > One person who does verify a fingerprint will get a real fingerprint. Or maybe they'll just show you same numbers as to your buddy, because they control both server and client software and users have very very limited resources to control what code is shipped to them via appstores. The fingerprint is computed at key exchange, you can't change it after the fact without warnings about it. If you assume the clients are compromised, E2EE or federation or other network properties won't help, so this discussion is meaningless. Nobody claimed E2EE was the be-all and end-all of security; only that it's an improvement over having to trust a 3rd party. This is because everything else being equal, the less components you trust, the better security-wise. So given a network operator, if you can choose between trusting them or not, you'll be better off not trusting them. That's why E2EE is better than no E2EE. Finally "use your own server" seems like the perfect solution if you're only talking to yourself. To take the email example, just because you trust gmx.de doesn't mean you want to trust mail.ru, but it seems that you're either suggesting that the trust propagates between servers in the same federated network (obviously not the case), or that you can just demand your recipients use the server you chose, ending up with a centralized silo within the federated network, which is itself a contradiction.
hiq 5y ago
> It is not a protection, just a security theater. Signal is a perfectly good protection against passive attackers. MITMing a non negligible portion of Signal users would be too visible to be worth doing. This doesn't solve target surveillance (but key fingerprint checks help there), but this does ensure that most of the data exchanged via Signal services does not feed NSA databases. > If you don't trust your service provider not to spy on you, you must not trust it completely. Ideally you wouldn't trust anything nor anyone, that's the Mossad thread model and it's not useful to judge incremental improvements. > Don't want to be spied by your service provider - run you own server. That's what federation is for. A server running where? Most "servers" are rented from a big cloud provider, and there's no physical control over it. Having to trust these is definitely worse in terms of security. This is also forgetting the users Signal is targeting, who are not technical users, but precisely people who don't know what a server is.
- Andrew_nenakhov 5y ago
  > MITMing a non negligible portion of Signal users would be too visible to be worth doing. You are not trusting Signal to have your unencrypted chats. Why do you trust their client apps? You aren't building them yourselves, right? MitMing ALL users and just showing them matching fingerprints so they feel safe is pretty plausible, since all users communicate using one central server. Of course, this MitMing is best perpetrated by Signal themselves. > A server running where? Most "servers" are rented from a big cloud provider, and there's no physical control over it. If you are a criminal, somewhere in TOR. If you are a legal organization, in your server room. If you are neither, nobody freaking cares about your chats and you might as well keep them unencrypted, enjoying better portability and overall improved user experience, as proven by Telegram.
  - hiq 5y ago
    > Why do you trust their client apps? Because it's open-source, has been reviewed extensively, and people (with various degrees of expertise) keep looking at it. > You aren't building them yourselves, right? It builds reproducibly on Android, so this doesn't matter. > If you are neither, nobody freaking cares about your chats That's not what the Snowden leaks showed, nor what scandals about e.g. some $BIG_CORP employees stalking their acquaintances via their privileged accesses demonstrated. E2EE on Signal means I don't have to trust that some employees won't abuse their rights to access my data. Do you even know how many people could access your Telegram chats if they wanted to? Just look up "stalker facebook employee", this is not some theoretical scenario. You're basically saying you and others have "nothing to hide". This argument has been repeated and debunked ad nauseam, if the whole literature against this stance hasn't convinced you yet I don't have more to convince you now.
tialaramex 5y ago
> (those who do indeed verify fingerprints are excluded from this program) Does this use mind-reading or time travel? Which is it? Suppose I walk across to my friend Steve's house tomorrow and I verify our Safety Numbers match. Do the Secret Police hop into their time machine and go back and cross Steve and myself [and all our contacts?] off their MITM list? Or did they use precognition to know I was going to do it and so they were able to never intercept the affected messages in the past? > Don't want to be spied by your service provider - run you own server. That's what federation is for. Notice that when you do this, the Secret Police's job is suddenly trivial. Gee, I wonder who we should arrest for this conspiracy that was organised on Andrew_nenakhov's server? Let's try starting with Andrew_nenakhov. Bingo. Job #1 if you actually don't want this sort of global surveillance effort to be successful is Don't Stand Out. If your traffic is special, if your users are different, if your service is unlike all the others - you are a target. So blend in, that means you use TLS because everybody else does, and you use Google's Play message service because everybody else does, and you use the same server for all the mundane shit that is used for the plot to kill the Secret Police chief.
- Andrew_nenakhov 5y ago
  > Does this use mind-reading or time travel? Which is it? Read my lips. You do not trust the service provider. To be consistent, you do not trust the software provided by this provider. From here, the possibilities are endless. They can just show you some fingerprint numbers so you feel safe, while in practice they might be completely unrelated to the real keys. Or whatever. The keys you verify with your friend Steve might be generated on the very moment you look at them, unrelated to your prior keys that you used 'trusting' the Signal's CA. > Job #1 if you actually don't want this sort of global surveillance effort to be successful is Don't Stand Out. That's why just use a plain old email server in TOR network, not tied to your identity. Email blends in juuust fine, certainly much better than centralized silo Signal where your accounts are tied to your identites.
  - tialaramex 5y ago
    You made a claim ("those who do indeed verify fingerprints are excluded from this program") and "read my lips" doesn't substantiate it. Your claim was in fact just nonsense.

upofadown 5y ago

Well that means that, Signal (and other instant encrypted messengers) bundle the risk up into one huge footgun. Very few people know how to verify their identities with the "safety numbers" and then keep them verified. As a result, you end up trusting the provider not to MITM your messages. This is particularly trivial to do in, say, some sort of non-federated system where one entity controls the entire infrastructure. That is not necessarily a bad thing but it would be good if the user was made to understand exactly who they are trusting. Signal deemphasizes this sort of information these days and has made the warnings about changed safety numbers easier to ignore. This is a depressingly common progression. At least with encrypted email you are less likely to kid yourself. If you do figure it out then the existence of identities you treat as objects ("public keys") makes it intuitively obvious that you have to get the right one.

hiq 5y ago
I think you're saying that Signal is not perfect, and I agree, but there's just nothing better at the moment. Email encryption is a bad reference because it has negligible usage (in comparison with modern messengers) and has proved over the years that it cannot cater to the needs of Signal's current users. But even then, I don't think we can claim that getting the email encryption setup right is any easier than ensuring one hasn't been MITMed during the initial key exchange on Signal.
- upofadown 5y ago
  In terms of usability, Signal is not that great. In a usability study involving Signal[1], 21 out of 28 computer science students failed to establish and maintain a secure end to end encrypted connection. I am old enough to be pretty cynical about this stuff. People keep on coming up with purely technical solutions to the encrypted messaging problem. They all eventually fall down on the human side. This isn't working. We have to do something else. [1] https://www.ndss-symposium.org/wp-content/uploads/2018/03/09-when-signal-hits-the-fan-on-the-usability-and-security-of-state-of-the-art-secure-mobile-messaging.pdf https://www.ndss-symposium.org/wp-content/uploads/2018/03/09...