5 ms·

A timely reminder of the non-cryptographic issues you must get right, in addition to the cryptographic ones, in order to build a robustly secured system!

tptacek 4y ago
See the recent Matrix fiasco for a more vivid example.
- 2Gkashmiri 4y ago
  What?
  - ttyprintk 4y ago
    An complete break, at most academically: https://news.ycombinator.com/item?id=33009721 https://news.ycombinator.com/item?id=33009721
    - tptacek 4y ago
      What does "at most academically" mean?
      - ttyprintk 4y ago
        At the time, there was contention about whether all implementations needed to be patched. I only remember agreement about the academic scope of the protocol problem.
- TheCycoONE 4y ago
  Can you link to whatever you're referring to?
  - iampivot 4y ago
    Maybe it's this? https://www.theregister.com/2022/09/28/matrix_encryption_flaws/ https://www.theregister.com/2022/09/28/matrix_encryption_fla...
  - tptacek 4y ago
    https://nebuchadnezzar-megolm.github.io/ https://nebuchadnezzar-megolm.github.io/ The cryptography itself didn't come out unscathed, but the basic nuts and bolts semantics of the system itself had devastating vulnerabilities.
    - est31 4y ago
      It's a nice piece of research but I wouldn't call it a fiasco. Many parts were well engineered, they just found some edge cases that yes had devastating effects. It's the old attacker's advantage again, in security, even edge cases can get you in. Matrix is a complicated protocol and tries to do things that other messengers can't, like multi device support. The researchers also write on the website that Matrix has fixed most of the issues (4 of the listed 6 on the website), and for the remaining ones there are plans for fixes.
      - tptacek 4y ago
        All Matrix messages (in practice) are group messages, and servers control the keys for all Matrix groups. "Devastating" isn't strong enough. They killed it. It's dead. The response (or lack thereof) to this research is pretty fascinating!
        est31 4y ago
        > The response (or lack thereof) to this research is pretty fascinating! What about: https://matrix.org/blog/2022/09/28/upgrade-now-to-address-encryption-vulns-in-matrix-sdks-and-clients https://matrix.org/blog/2022/09/28/upgrade-now-to-address-en... > "Homeserver Control of Room Membership" – A malicious homeserver can fake invites on behalf of its users to invite malicious users into their conversations, or add malicious devices into its users accounts. However, when this happens, we clearly warn the user: if you have verified the users you are talking to, the room and user will be shown with a big red cross to mark if malicious devices have been added. Similarly, if an unexpected user is invited to a conversation, all users can clearly see and take evasive action. Therefore we consider this a low severity issue. That said, this behaviour can be improved, and we've started work on switching our trust model to trust-on-first-use (so that new untrusted devices are proactively excluded from conversations, even if you haven't explicitly verified their owner) - and we're also looking to add cryptographic signatures to membership events in E2EE rooms to stop impersonated invites. These fixes will land over the coming months.

tptacek 4y ago

See the recent Matrix fiasco for a more vivid example.

2Gkashmiri 4y ago
What?
- ttyprintk 4y ago
  An complete break, at most academically: https://news.ycombinator.com/item?id=33009721 https://news.ycombinator.com/item?id=33009721
  - tptacek 4y ago
    What does "at most academically" mean?
    - ttyprintk 4y ago
      At the time, there was contention about whether all implementations needed to be patched. I only remember agreement about the academic scope of the protocol problem.
TheCycoONE 4y ago
Can you link to whatever you're referring to?
- iampivot 4y ago
  Maybe it's this? https://www.theregister.com/2022/09/28/matrix_encryption_flaws/ https://www.theregister.com/2022/09/28/matrix_encryption_fla...
- tptacek 4y ago
  https://nebuchadnezzar-megolm.github.io/ https://nebuchadnezzar-megolm.github.io/ The cryptography itself didn't come out unscathed, but the basic nuts and bolts semantics of the system itself had devastating vulnerabilities.
  - est31 4y ago
    It's a nice piece of research but I wouldn't call it a fiasco. Many parts were well engineered, they just found some edge cases that yes had devastating effects. It's the old attacker's advantage again, in security, even edge cases can get you in. Matrix is a complicated protocol and tries to do things that other messengers can't, like multi device support. The researchers also write on the website that Matrix has fixed most of the issues (4 of the listed 6 on the website), and for the remaining ones there are plans for fixes.
    - tptacek 4y ago
      All Matrix messages (in practice) are group messages, and servers control the keys for all Matrix groups. "Devastating" isn't strong enough. They killed it. It's dead. The response (or lack thereof) to this research is pretty fascinating!
      - est31 4y ago
        > The response (or lack thereof) to this research is pretty fascinating! What about: https://matrix.org/blog/2022/09/28/upgrade-now-to-address-encryption-vulns-in-matrix-sdks-and-clients https://matrix.org/blog/2022/09/28/upgrade-now-to-address-en... > "Homeserver Control of Room Membership" – A malicious homeserver can fake invites on behalf of its users to invite malicious users into their conversations, or add malicious devices into its users accounts. However, when this happens, we clearly warn the user: if you have verified the users you are talking to, the room and user will be shown with a big red cross to mark if malicious devices have been added. Similarly, if an unexpected user is invited to a conversation, all users can clearly see and take evasive action. Therefore we consider this a low severity issue. That said, this behaviour can be improved, and we've started work on switching our trust model to trust-on-first-use (so that new untrusted devices are proactively excluded from conversations, even if you haven't explicitly verified their owner) - and we're also looking to add cryptographic signatures to membership events in E2EE rooms to stop impersonated invites. These fixes will land over the coming months.