3 ms·

> The response (or lack thereof) to this research is pretty fascinating! What about: https://matrix.org/blog/2022/09/28/upgrade-now-to-address-encryption-vulns

by est31 4y ago

> The response (or lack thereof) to this research is pretty fascinating! What about: https://matrix.org/blog/2022/09/28/upgrade-now-to-address-encryption-vulns-in-matrix-sdks-and-clients https://matrix.org/blog/2022/09/28/upgrade-now-to-address-en... > "Homeserver Control of Room Membership" – A malicious homeserver can fake invites on behalf of its users to invite malicious users into their conversations, or add malicious devices into its users accounts. However, when this happens, we clearly warn the user: if you have verified the users you are talking to, the room and user will be shown with a big red cross to mark if malicious devices have been added. Similarly, if an unexpected user is invited to a conversation, all users can clearly see and take evasive action. Therefore we consider this a low severity issue. That said, this behaviour can be improved, and we've started work on switching our trust model to trust-on-first-use (so that new untrusted devices are proactively excluded from conversations, even if you haven't explicitly verified their owner) - and we're also looking to add cryptographic signatures to membership events in E2EE rooms to stop impersonated invites. These fixes will land over the coming months.

tptacek 4y ago
I think this is an amazing response. The researchers demonstrated that a malicious server can inject itself into arbitrary Matrix groups, and thus get all the keys required to decrypt messages. The response: "we'll just try to have an alert pop up that tells you the server is reading your messages". Anyways, my point is just: this is a good illustration of the phenomenon described by the root comment.
- est31 4y ago
  > The response: "we'll just try to have an alert pop up that tells you the server is reading your messages". First, they have not said they will add alerts, they say that such alerts are already there. Second, they did admit that the current situation can be improved, and have said they will add cryptographic signatures to membership events in the future. To my reading that would be precisely what the researchers were missing, aka if new folks show up, even with support of the homeserver, they still need to present a signed invite from one of the group members to be given the keys.
- shp0ngle 4y ago
  An honest question, not trying to be argumentative. If Signal server is evil and starts to MITM a communication between two parties, replacing each of the parties keys with their own keys and decrypting in the middle, both of the participants will also just get warning “the other party changed their key”, right? That was the gist of the issue of yesteryear with Guardian and WhatsApp, right? How is this in practice different? User see a warning and ignores it (as people change their phones thus their keys all the time). I’m not trying to be snarky but actually asking a question

by est31 4y ago

tptacek 4y ago

I think this is an amazing response. The researchers demonstrated that a malicious server can inject itself into arbitrary Matrix groups, and thus get all the keys required to decrypt messages. The response: "we'll just try to have an alert pop up that tells you the server is reading your messages". Anyways, my point is just: this is a good illustration of the phenomenon described by the root comment.

est31 4y ago
> The response: "we'll just try to have an alert pop up that tells you the server is reading your messages". First, they have not said they will add alerts, they say that such alerts are already there. Second, they did admit that the current situation can be improved, and have said they will add cryptographic signatures to membership events in the future. To my reading that would be precisely what the researchers were missing, aka if new folks show up, even with support of the homeserver, they still need to present a signed invite from one of the group members to be given the keys.
shp0ngle 4y ago
An honest question, not trying to be argumentative. If Signal server is evil and starts to MITM a communication between two parties, replacing each of the parties keys with their own keys and decrypting in the middle, both of the participants will also just get warning “the other party changed their key”, right? That was the gist of the issue of yesteryear with Guardian and WhatsApp, right? How is this in practice different? User see a warning and ignores it (as people change their phones thus their keys all the time). I’m not trying to be snarky but actually asking a question