4 ms·

>In April 2021, signal outraged the open-source community by going a whole year without publishing their server code updates. So? We have no way to be sure wha

>In April 2021, signal outraged the open-source community by going a whole year without publishing their server code updates. So? We have no way to be sure what is actually running on the server. In an end to end encrypted system, if the server can degrade security then you are doing it wrong.

thrtythreeforty 5y ago
We should make a distinction between the server tampering with message content and message metadata. Message content is protected by well-scrutinized and auditable client code. However, there's nothing stopping a malicious server from logging a bunch of extra metadata on top of what they claim to log, which would be very interesting for nation states. And the extra-metadata scenario is the one being criticized, I think. If you trust Intel SGX (or other secure enclaves) it is theoretically possible for the server to attest to the client that a particular hash of code is running. (Typically the reverse process is used, to attest to a server that a client is running whatever DRM code the company wants.) Signal already uses SGX to implement contact search [1]. The actual algorithm is performed in plaintext in the enclave. Now, you might counter that SGX is full of holes, and I would agree with you. [1]: https://signal.org/blog/private-contact-discovery/ https://signal.org/blog/private-contact-discovery/
- XorNot 5y ago
  Who cares? I can't audit the Signal servers. Signal can't realistically be completely sure the servers weren't tampered with - they're not funded to run bomb proof, spy proof, supply-chain secure data centers. This is why we have E2E messaging and we accept the risk profile that entails - there is no better solution.
Brian_K_White 5y ago
Any server can at least log both data and metadata. Any server could at least monitor and alert. I wonder if there is a theoretical way to use ecryption to somehow prove that a message was only handled the way it was claimed? Seems impossible on the face of it but I've only given it one minutes thought yet. Could you for instance have a hypervizor that does not know anything about the comms, and the client supplies something encrypted that causes a server to be created on the spot, do the comms work, and go away, and all the hypervizor knows is that it ran a process for a while? And the encrypted thing the client submits is not just an envelope and message but also essentially it's own decryption and verification code, such that the client can verify that the server is running the code it submitted, which of course included no copying.

thrtythreeforty 5y ago

We should make a distinction between the server tampering with message content and message metadata. Message content is protected by well-scrutinized and auditable client code. However, there's nothing stopping a malicious server from logging a bunch of extra metadata on top of what they claim to log, which would be very interesting for nation states. And the extra-metadata scenario is the one being criticized, I think. If you trust Intel SGX (or other secure enclaves) it is theoretically possible for the server to attest to the client that a particular hash of code is running. (Typically the reverse process is used, to attest to a server that a client is running whatever DRM code the company wants.) Signal already uses SGX to implement contact search [1]. The actual algorithm is performed in plaintext in the enclave. Now, you might counter that SGX is full of holes, and I would agree with you. [1]: https://signal.org/blog/private-contact-discovery/ https://signal.org/blog/private-contact-discovery/

XorNot 5y ago
Who cares? I can't audit the Signal servers. Signal can't realistically be completely sure the servers weren't tampered with - they're not funded to run bomb proof, spy proof, supply-chain secure data centers. This is why we have E2E messaging and we accept the risk profile that entails - there is no better solution.

Brian_K_White 5y ago

Any server can at least log both data and metadata. Any server could at least monitor and alert. I wonder if there is a theoretical way to use ecryption to somehow prove that a message was only handled the way it was claimed? Seems impossible on the face of it but I've only given it one minutes thought yet. Could you for instance have a hypervizor that does not know anything about the comms, and the client supplies something encrypted that causes a server to be created on the spot, do the comms work, and go away, and all the hypervizor knows is that it ran a process for a while? And the encrypted thing the client submits is not just an envelope and message but also essentially it's own decryption and verification code, such that the client can verify that the server is running the code it submitted, which of course included no copying.