4 ms·

This is great an all but it doesn't really address the big problem with end to end encrypted messaging. That would be the usability issue. There is no point in

This is great an all but it doesn't really address the big problem with end to end encrypted messaging. That would be the usability issue. There is no point in constantly designing new protocols if very few people will ever be able to use the resulting systems. We make these things and then wait for someone to come along and make them usable. That never seems to happen. I think we really have to turn things around the other way. First determine what a usable system would look like and then only after that is determined start thinking about the cryptography that would work for that system. After all, the cryptography aspect seems to be the relatively easy problem. We solve it over and over again.

palata 4y ago
So that was my question: is this supposed to be some kind of interoperable e2ee? If yes, then that would be some equivalent of TLS but for e2ee, somehow. But then we need a protocol on top of that (for TLS that's HTTPS) to actually have interoperability at the application level, right? But then it feels similar to saying "let's all agree to use the Signal Protocol and write interoperable clients, doesn't it? If I want a slightly different experience that requires a sightly different protocol, then suddenly I cannot interoperate anymore... Or am I missing something?
kitkat_new 4y ago
WhatsApp is used by billions, and uses (at least in theory) e2ee, so I don't think usability is a real problem for e2ee
- upofadown 4y ago
  So what percentage of those billions are correctly using the ridiculously long numbers (60 decimal digits) used to represent identities (WhatsApp calls them "security codes") in that system to ensure they are actually communicating end to end? WhatsApp doesn't even inform the user of changes to these numbers by default[1] so my guess would be that practically no WhatsApp users are working end to end. WhatsApp can intercept messages at will. I am not singling out WhatsApp here. In a usability study involving Signal[2], 21 out of 28 computer science students failed to establish and maintain a secure end to end encrypted connection. [1] https://faq.whatsapp.com/1524220618005378 https://faq.whatsapp.com/1524220618005378 [2] https://www.ndss-symposium.org/wp-content/uploads/2018/03/09-when-signal-hits-the-fan-on-the-usability-and-security-of-state-of-the-art-secure-mobile-messaging.pdf https://www.ndss-symposium.org/wp-content/uploads/2018/03/09...
  - kitkat_new 4y ago
    > WhatsApp doesn't even inform the user of changes to these numbers by default[1] is this everything?
  - ajconway 4y ago
    > what percentage of those billions are correctly using the ridiculously long numbers (60 decimal digits) used to represent identities (WhatsApp calls them "security codes") in that system to ensure they are actually communicating end to end? Assuming one of those billions users is a motivated security enthusiast, WhatsApp is not able to perform MITM attacks at scale, as it would be trivial to prove. If WhatsApp decides to MITM your chats, it can't do so retroactively due to the properties of the protocol. If you're a high-profile target, you should verify your keys.
    - upofadown 4y ago
      >If WhatsApp decides to MITM your chats, it can't do so retroactively due to the properties of the protocol. Can't they just set you up as a new device? The user wouldn't know if they left the notification at the default setting. Whatsapp would not MITM ever single user. They would carefully target particular individuals.
      - kitkat_new 4y ago
        I think they could do literally anything, because it is closed source; including forging random keys or ignoring the notification setting, ...
      - palata 4y ago
        Well it's difficult for WhatsApp because it's closed source, so they can do whatever they want. But let's assume the client app was open source, and WhatsApp decided to reset the key for some targeted users. Most users wouldn't realize, but if one did, then that would be very bad for WhatsApp. It would be all over the media. That's why it cannot be done at scale. That's why it cannot be done at scale with Signal, too. Even if the users mostly ignore the "new key exchange" notification. If Signal MITM conversations and one person manages to prove it, then Signal is done. That's a pretty strong incentive for them not to do it.
tptacek 4y ago
We absolutely do not solve messaging cryptography over and over; the field is littered with corpses, many of them quite fresh.
walterbell 4y ago
Wire was a contributor to the MLS spec and their free app is usable without a phone number. For each person you are communicating with, there is a list of devices with a toggle button for "Verified". Once a conversation is taking place among verified devices, the addition of a new unverified device will block new messages and present the user with a warning to verify the device or override ("Send Anyway"). MLS E2EE is deployed in production today by Cisco WebEx.

palata 4y ago

So that was my question: is this supposed to be some kind of interoperable e2ee? If yes, then that would be some equivalent of TLS but for e2ee, somehow. But then we need a protocol on top of that (for TLS that's HTTPS) to actually have interoperability at the application level, right? But then it feels similar to saying "let's all agree to use the Signal Protocol and write interoperable clients, doesn't it? If I want a slightly different experience that requires a sightly different protocol, then suddenly I cannot interoperate anymore... Or am I missing something?

kitkat_new 4y ago

WhatsApp is used by billions, and uses (at least in theory) e2ee, so I don't think usability is a real problem for e2ee

upofadown 4y ago
So what percentage of those billions are correctly using the ridiculously long numbers (60 decimal digits) used to represent identities (WhatsApp calls them "security codes") in that system to ensure they are actually communicating end to end? WhatsApp doesn't even inform the user of changes to these numbers by default[1] so my guess would be that practically no WhatsApp users are working end to end. WhatsApp can intercept messages at will. I am not singling out WhatsApp here. In a usability study involving Signal[2], 21 out of 28 computer science students failed to establish and maintain a secure end to end encrypted connection. [1] https://faq.whatsapp.com/1524220618005378 https://faq.whatsapp.com/1524220618005378 [2] https://www.ndss-symposium.org/wp-content/uploads/2018/03/09-when-signal-hits-the-fan-on-the-usability-and-security-of-state-of-the-art-secure-mobile-messaging.pdf https://www.ndss-symposium.org/wp-content/uploads/2018/03/09...
- kitkat_new 4y ago
  > WhatsApp doesn't even inform the user of changes to these numbers by default[1] is this everything?
- ajconway 4y ago
  > what percentage of those billions are correctly using the ridiculously long numbers (60 decimal digits) used to represent identities (WhatsApp calls them "security codes") in that system to ensure they are actually communicating end to end? Assuming one of those billions users is a motivated security enthusiast, WhatsApp is not able to perform MITM attacks at scale, as it would be trivial to prove. If WhatsApp decides to MITM your chats, it can't do so retroactively due to the properties of the protocol. If you're a high-profile target, you should verify your keys.
  - upofadown 4y ago
    >If WhatsApp decides to MITM your chats, it can't do so retroactively due to the properties of the protocol. Can't they just set you up as a new device? The user wouldn't know if they left the notification at the default setting. Whatsapp would not MITM ever single user. They would carefully target particular individuals.
    - kitkat_new 4y ago
      I think they could do literally anything, because it is closed source; including forging random keys or ignoring the notification setting, ...
    - palata 4y ago
      Well it's difficult for WhatsApp because it's closed source, so they can do whatever they want. But let's assume the client app was open source, and WhatsApp decided to reset the key for some targeted users. Most users wouldn't realize, but if one did, then that would be very bad for WhatsApp. It would be all over the media. That's why it cannot be done at scale. That's why it cannot be done at scale with Signal, too. Even if the users mostly ignore the "new key exchange" notification. If Signal MITM conversations and one person manages to prove it, then Signal is done. That's a pretty strong incentive for them not to do it.

tptacek 4y ago

We absolutely do not solve messaging cryptography over and over; the field is littered with corpses, many of them quite fresh.

walterbell 4y ago

Wire was a contributor to the MLS spec and their free app is usable without a phone number. For each person you are communicating with, there is a list of devices with a toggle button for "Verified". Once a conversation is taking place among verified devices, the addition of a new unverified device will block new messages and present the user with a warning to verify the device or override ("Send Anyway"). MLS E2EE is deployed in production today by Cisco WebEx.