4 ms·

When the party storing the DM controls key storage/exchange, does this matter? If you can't verify the other party's keys are in use, and ensure no other keys a

When the party storing the DM controls key storage/exchange, does this matter? If you can't verify the other party's keys are in use, and ensure no other keys are being silently added, this type of encryption is just checking a box.

kodah 4y ago
There's implementations where it would work, be effective, or be both. It all depends on what the key material is protected with at that point. If it's something provided client side and is transmitted securely, and used blindly, then it would work. Anything short of that would probably trigger my curiosity. Edit: This kind of statement also needs to b prepended with who you're trying to protect yourself from, because that entirely changes the game. Edit: There's also key exchange (and derivation) that could happen and impact the effectiveness of this process.
- brian-armstrong 4y ago
  If the client is entirely in the browser, it doesn't particularly matter if they give you some keys to scan. You don't know what it's actually doing, or how the keys are generated.
  - kingcharles 4y ago
    It would need to encrypt the messages in the browser before they are sent, for a start.
ajconway 4y ago
Almost every encrypted app allows users to check their keys via QR code scanning or string comparison. If twitter adopts encryption, I hope they will let users do that. At this point the same entity controls both key distribution and the messaging channel, so information-theoretically it may seem that encryption becomes pointless because it’s very easy to perform a mitm attack. However, since any user can check their keys (at least in theory), the service cannot mitm _every_ conversation. This prohibits mass surveillance which is good enough.
- brian-armstrong 4y ago
  Aren't you also trusting that their client actually renders all the keys in use though?
  - madeofpalk 4y ago
    I would imagine that for people that actually care (whose threat model involves governments targeting them specifically), then they're aware of all the tradeoffs involved and can make informed decisions (and know how to use more secure, harder to use platforms). For everyone else, I think "e2e encrypted by maybe twitter is lying to you" is no worse than the current state of play.
  - ajconway 4y ago
    We do, but that would require the company to lie about what they are doing with the app. At Twitter's scale it's very possible that someone would notice and leak that. The goal as I imagine it is to go from "Hundreds of Twitter employees can definitely access my messages today and anything I've sent and received up until now" to "Twitter will likely need to perform a MITM attack to read my messages starting from the moment when the attack was performed. Maybe they have a secret backdoor, but it's probably too valuable to use on my cat photos".
    - brian-armstrong 4y ago
      If it's just about internal access, how is it any different from implementing access controls? Put another way, at Twitter's scale, any employee access to production data is intentional.
      - ajconway 4y ago
        Correct, but with everything in plaintext one just needs to read a file stored somewhere in a database. With encryption, one needs to perform an active attack.
    - dontcare007 4y ago

kodah 4y ago

There's implementations where it would work, be effective, or be both. It all depends on what the key material is protected with at that point. If it's something provided client side and is transmitted securely, and used blindly, then it would work. Anything short of that would probably trigger my curiosity. Edit: This kind of statement also needs to b prepended with who you're trying to protect yourself from, because that entirely changes the game. Edit: There's also key exchange (and derivation) that could happen and impact the effectiveness of this process.

brian-armstrong 4y ago
If the client is entirely in the browser, it doesn't particularly matter if they give you some keys to scan. You don't know what it's actually doing, or how the keys are generated.
- kingcharles 4y ago
  It would need to encrypt the messages in the browser before they are sent, for a start.

ajconway 4y ago

Almost every encrypted app allows users to check their keys via QR code scanning or string comparison. If twitter adopts encryption, I hope they will let users do that. At this point the same entity controls both key distribution and the messaging channel, so information-theoretically it may seem that encryption becomes pointless because it’s very easy to perform a mitm attack. However, since any user can check their keys (at least in theory), the service cannot mitm _every_ conversation. This prohibits mass surveillance which is good enough.

brian-armstrong 4y ago
Aren't you also trusting that their client actually renders all the keys in use though?
- madeofpalk 4y ago
  I would imagine that for people that actually care (whose threat model involves governments targeting them specifically), then they're aware of all the tradeoffs involved and can make informed decisions (and know how to use more secure, harder to use platforms). For everyone else, I think "e2e encrypted by maybe twitter is lying to you" is no worse than the current state of play.
- ajconway 4y ago
  We do, but that would require the company to lie about what they are doing with the app. At Twitter's scale it's very possible that someone would notice and leak that. The goal as I imagine it is to go from "Hundreds of Twitter employees can definitely access my messages today and anything I've sent and received up until now" to "Twitter will likely need to perform a MITM attack to read my messages starting from the moment when the attack was performed. Maybe they have a secret backdoor, but it's probably too valuable to use on my cat photos".
  - brian-armstrong 4y ago
    If it's just about internal access, how is it any different from implementing access controls? Put another way, at Twitter's scale, any employee access to production data is intentional.
    - ajconway 4y ago
      Correct, but with everything in plaintext one just needs to read a file stored somewhere in a database. With encryption, one needs to perform an active attack.
  - dontcare007 4y ago