12 ms·

Twitter’s DM encryption is a modest security improvement over the status quo

146 points by areoform 3y ago

mjg59 3y ago
For anyone who's interested in a technical writeup of the implementation, I did one here: https://mjg59.dreamwidth.org/66791.html https://mjg59.dreamwidth.org/66791.html . There's code in the iOS app that would mitigate the MITM issue, but would also restrict users to only being able to read encrypted DMs on a single device, and it seems like they decided functionality was more important than security in this respect (which is not an unreasonable tradeoff, as long as it's well-communicated to users). Group conversations are also unsupported in the deployed codebase, so the concerns I had there may end up handled in some other way (though it's going to be difficult to manage that and also retain reasonable user experience). The perils of reviewing code before you can actually test the feature. Overall I think my original conclusion still holds. If you're going to use Twitter DMs, turning on encryption is better than not doing so. But right now it's protecting against someone with opportunistic access to the Twitter prod databases, not an advanced attacker or someone with subpoena powers, and if you have to worry about that you should definitely use Signal instead. (Edit: someone asked whether working on fruitflies would have been more relaxing than reverse engineering weird encryption, and I wrote this reply, but they'd deleted the comment. You get the reply anyway: Reverse engineering fruitflies means reverse engineering something that's almost entirely undocumented, what documentation does exist is frequently wrong, that has almost 4 billion years of tech debt, that relies on self-modifying code, executed on a series of components that aren't fully deterministic, that can only be bootstrapped from existing fruitflies, that has no debugger, that had no functional specification, that has an instruction set where the behaviour of an instruction can depend on the three dimensional structure of the encoding of those instructions and so be influenced by instructions that are several thousand (if not million) instructions away in what looks like an entirely separate compilation unit, and if you change the temperature or humidity or any number of other apparently irrelevant factors will just behave entirely differently. And, if you fuck up, you suddenly have a room full of fruitflies. So, yes, reverse engineering Java is definitely more relaxing.)
- deleted 3y ago
  [deleted]
- NeuroCoder 3y ago
  That last bit is how I sometimes feel about figuring out how the brain works compared to casually learning computer science stuff on the side. I love being a part of improving our knowledge of how the brain develops and sometimes goes wrong, but it's way easier to debug obscure source code than the brain.
- canadiantim 3y ago
  I’d just add that reverse engineering fruit flies (realistically some component thereof) is actually much easier and relaxing than you suggest. Because fruit flies are a model organism, they are therefore one of the most studied organisms in the world. We arguably know more about fruit flies than humans and try to extrapolate what we know about fruit flies to humans (with varying success). I guess my point is that reverse engineering fruit flies is actually very well documented (in the biological literature, and even textbooks, very well established for decades now).
  - thaumasiotes 3y ago
    There is a lot of documentation on fruit flies. However, the share of fruit fly functionality that is documented is much less than 0.001%. This is fairly described as "undocumented".
  - twic 3y ago
    An unavoidable pain point when working with fruit flies is that there is no way to store them. A fruit fly is either alive, crawling around in a glass tube eating banana paste, or dead. Once it's dead, you can't do experiments on it, and you can't breed it. Fruit flies are used because it is easy to do genetics on them. Genetics means causing random mutations, selecting for something, then breeding them true to make a mutant strain, then crossbreeding, making further mutants, and doing experiments on all the results. Each of those mutant strains is part of your scientific 'capital', something you've invested in and want to extract returns from. You have to preserve it. And to preserve it, you need to transfer ('flip') flies of that strain to a fresh tube of banana paste every three weeks. For all of your strains. Without ever missing a flip. So i'm not sure that working on fruit flies is relaxing, exactly. Maybe if you can afford a technician to look after them for you!
aaron695 3y ago
Elon's 7 months into a 17 year old company we finally have encryption. But that's not fast enough because it's not perfect yet? Do we think there's more dead wood Imposters that needs to be fired at Twitter to get progress even faster? > Then they'd have the corresponding private key, and would be able to obtain the message encryption key. This is technically wrong or badly worded. Is it just saying since you run their software on your device they could steal your private key? Same as WhatsApp or Signal? Not sure I get this point. If app developer turns evil and no one notices you are always stuffed.
- mjg59 3y ago
  > This is technically wrong or badly worded Could you explain why? > Is it just saying since you run their software on your device they could steal your private key? No. It's saying that because there's no indication of which keys the conversation key is being sent to, if Twitter added an additional public key to a users's set of registered keys, anyone who initiated a DM with that user would have no way of knowing that they were sending a copy of the conversation key to Twitter. This doesn't involve any modification of the client code.
  - aaron695 3y ago
    [dead]
- protocolture 3y ago
  Theres no situation where Twitter develops and deploys E2E encryption. Musk has already proven he is more likely to snitch on users for the government than the previous admin. From there you can only extrapolate that this will be delivered with a government backdoor on the app side. If Musk actually manages to lure in whistleblowers to his platform with these antics those whistleblowers will have their asses hanging in the wind waiting for a government assistance request. Hopefully they arent as stupid as to trust musk.
  - mjg59 3y ago
    It's actually plausible to audit the app for backdoor mechanisms, even without access to the source code. Right now there's no indication of one being present. I'm very very much not a fan of Elon, but in terms of the disparity between what's promised vs what's implemented right now everything points towards incompetence rather than malice.
threeseed 3y ago
Fascinating that Musk continues to run Twitter in a "move fast and break things" mode. When the entities that affect the company's existence the most i.e. regulators and advertisers are asking for more thoughtful, measured and safe changes. And instead he's obsessed with adding end-user features which based on the woeful Twitter Blue subscription numbers seems like a dead-end strategy.
- monero-xmr 3y ago
  He’s the richest person on earth and has a very solid track record. I’m betting he knows more than the average bitter commenter.
  - simonw 3y ago
    His track record at running Twitter has been abysmal so far.
    - chasd00 3y ago
      Twitter works fine for me.
      - simonw 3y ago
        That's not incompatible with what I said. It mostly "works fine" for me too.
        lazyeye 3y ago
        Works fine for me too. And am looking forward to all the new features they now have in the pipeline.
        foderking 3y ago
        same
  - 3y ago
diebeforei485 3y ago
Twitter has said this is an early version that shouldn't be trusted yet - https://twitter.com/elonmusk/status/1656570790039678976?s=20 https://twitter.com/elonmusk/status/1656570790039678976?s=20
- cmckn 3y ago
  Coming from the man behind the FSD “beta”, this is par for the course; but I still find it questionable to turn this sort of feature on in prod (for paying customers, no less) while simultaneously admitting it’s not trustworthy.
  - robertlagrant 3y ago
    Perhaps it depends on what is meant by untrustworthy, but I don't see how it's a downgrade for users. Or are your concerns just PR-related?
    - mjg59 3y ago
      It's an improvement over the status-quo. But given what was communicated before the feature was launched, it's very easy to believe that users might believe that the expectations around privacy and security are stronger than they actually are. Ideally you don't need to put any meaningful trust in the service provider, but in this case you do.
      - robertlagrant 3y ago
        Well, I think if comms have been over-zealous then a correction is appropriate. But either way, this just seems now commentary on their PR chops, rather than anything fundamental about their technical implementation, so I'll colour myself unworried again.
  - diebeforei485 3y ago
    It's better than the current product where it's readable in plaintext to Twitter employees, and to some outside contractors as well. For those who already use Twitter DM's (which is a lot of people), this is an improvement.
baby 3y ago
Putting this out there. But I’ve audited a number of implementations of Signal and of close similar protocols proposed by some of the big players. Found a bug that broke Matrix e2e encryption[1]. Wrote the chapter on e2e encryption in the real world cryptography book including the only explanation of Signal in a book[2]. All I’m saying is that twitter, if you’re reading this, know that I have the blue checkmark ;) and that I’m available for pentesting your e2e encryption implementation! [1]: https://matrix.org/hall-of-fame https://matrix.org/hall-of-fame [2]: https://www.manning.com/books/real-world-cryptography https://www.manning.com/books/real-world-cryptography
- tptacek 3y ago
  Hey, David! Given the details we know right now about the implementation --- a single P-curve static-ephemeral key exchange for a long-lived GCM key --- would you sign off on that design? Is that how you'd implement encrypted messaging on a platform like Twitter? I mean, let's agree in advance that you might not do Signal Protocol given the expectations users would have. But is that how you'd do it?
  - baby 3y ago
    Hey I’m not doing this for free! Hehe
russnes 3y ago
I'd say one of the best features for private messaging is having disappearing messages. Then you lower your chances of leaking the messages to someone gaining illegitimate access right now, instead of leaking the database at any time in the future
- papito 3y ago
  Are you positive that the massages disappear from your device AND from the servers? These companies notoriously do not delete anything ever. I am sure that even the things they are required to delete by law are removed, compressed and stashed somewhere.
SilverBirch 3y ago
As the reporting makes clear, it's kind of confusing who encrypted DMs are really for. Twitter finds itself in a position where it now answers to a man who is extremely vulnerable to state actors threatening his livelihood. In Turkey he became a fascist collaborator with virtually 0 push back. How much will he stand up for users of his platform if the CCP come knocking and want to unmask pesky protestors or users? Previously Twitter was blocked in China because they wouldn't follow the CCPs wishes. Well that was fine when twitter was independent they could stand behind their principles and China had no more leverage. Well what happens now that the CCP can shut down Tesla's Shanghai factory? Or even better, turn it over to a friendly local CEO? What happens when Elon Musk's line on "free speech is literally just what any local jurisdiction tells me" collides with US state bans on abortion, or LGTBQ rights? Sure would be awkward if the US suddenly had a lurch towards governors of right wing states introducing legislation to interfere with the operations of companies they don't like. All the technical details of it are kind of moot, because fundamentally any attack on Twitter won't be technical, it'll be a practical application of pressure on Musk.
- neom 3y ago
  Elon covers it a bit in his interview with Tucker. Whole interview is interesting-ish, but he talks about who it's for around 23:00 on: https://www.youtube.com/watch?v=LCOe3a9EHJs https://www.youtube.com/watch?v=LCOe3a9EHJs
rsynnott 3y ago
The post title is an… impressive spin on the actual headline.
davidgerard 3y ago
Fake headline. Real headline is: "Why you can't trust Twitter's encrypted DMs"

146 points by areoform 3y ago

For anyone who's interested in a technical writeup of the implementation, I did one here: https://mjg59.dreamwidth.org/66791.html https://mjg59.dreamwidth.org/66791.html . There's code in the iOS app that would mitigate the MITM issue, but would also restrict users to only being able to read encrypted DMs on a single device, and it seems like they decided functionality was more important than security in this respect (which is not an unreasonable tradeoff, as long as it's well-communicated to users). Group conversations are also unsupported in the deployed codebase, so the concerns I had there may end up handled in some other way (though it's going to be difficult to manage that and also retain reasonable user experience). The perils of reviewing code before you can actually test the feature. Overall I think my original conclusion still holds. If you're going to use Twitter DMs, turning on encryption is better than not doing so. But right now it's protecting against someone with opportunistic access to the Twitter prod databases, not an advanced attacker or someone with subpoena powers, and if you have to worry about that you should definitely use Signal instead. (Edit: someone asked whether working on fruitflies would have been more relaxing than reverse engineering weird encryption, and I wrote this reply, but they'd deleted the comment. You get the reply anyway: Reverse engineering fruitflies means reverse engineering something that's almost entirely undocumented, what documentation does exist is frequently wrong, that has almost 4 billion years of tech debt, that relies on self-modifying code, executed on a series of components that aren't fully deterministic, that can only be bootstrapped from existing fruitflies, that has no debugger, that had no functional specification, that has an instruction set where the behaviour of an instruction can depend on the three dimensional structure of the encoding of those instructions and so be influenced by instructions that are several thousand (if not million) instructions away in what looks like an entirely separate compilation unit, and if you change the temperature or humidity or any number of other apparently irrelevant factors will just behave entirely differently. And, if you fuck up, you suddenly have a room full of fruitflies. So, yes, reverse engineering Java is definitely more relaxing.)

deleted 3y ago
[deleted]
NeuroCoder 3y ago
That last bit is how I sometimes feel about figuring out how the brain works compared to casually learning computer science stuff on the side. I love being a part of improving our knowledge of how the brain develops and sometimes goes wrong, but it's way easier to debug obscure source code than the brain.
canadiantim 3y ago
I’d just add that reverse engineering fruit flies (realistically some component thereof) is actually much easier and relaxing than you suggest. Because fruit flies are a model organism, they are therefore one of the most studied organisms in the world. We arguably know more about fruit flies than humans and try to extrapolate what we know about fruit flies to humans (with varying success). I guess my point is that reverse engineering fruit flies is actually very well documented (in the biological literature, and even textbooks, very well established for decades now).
- thaumasiotes 3y ago
  There is a lot of documentation on fruit flies. However, the share of fruit fly functionality that is documented is much less than 0.001%. This is fairly described as "undocumented".
- twic 3y ago
  An unavoidable pain point when working with fruit flies is that there is no way to store them. A fruit fly is either alive, crawling around in a glass tube eating banana paste, or dead. Once it's dead, you can't do experiments on it, and you can't breed it. Fruit flies are used because it is easy to do genetics on them. Genetics means causing random mutations, selecting for something, then breeding them true to make a mutant strain, then crossbreeding, making further mutants, and doing experiments on all the results. Each of those mutant strains is part of your scientific 'capital', something you've invested in and want to extract returns from. You have to preserve it. And to preserve it, you need to transfer ('flip') flies of that strain to a fresh tube of banana paste every three weeks. For all of your strains. Without ever missing a flip. So i'm not sure that working on fruit flies is relaxing, exactly. Maybe if you can afford a technician to look after them for you!

aaron695 3y ago

Elon's 7 months into a 17 year old company we finally have encryption. But that's not fast enough because it's not perfect yet? Do we think there's more dead wood Imposters that needs to be fired at Twitter to get progress even faster? > Then they'd have the corresponding private key, and would be able to obtain the message encryption key. This is technically wrong or badly worded. Is it just saying since you run their software on your device they could steal your private key? Same as WhatsApp or Signal? Not sure I get this point. If app developer turns evil and no one notices you are always stuffed.

mjg59 3y ago
> This is technically wrong or badly worded Could you explain why? > Is it just saying since you run their software on your device they could steal your private key? No. It's saying that because there's no indication of which keys the conversation key is being sent to, if Twitter added an additional public key to a users's set of registered keys, anyone who initiated a DM with that user would have no way of knowing that they were sending a copy of the conversation key to Twitter. This doesn't involve any modification of the client code.
- aaron695 3y ago
  [dead]
protocolture 3y ago
Theres no situation where Twitter develops and deploys E2E encryption. Musk has already proven he is more likely to snitch on users for the government than the previous admin. From there you can only extrapolate that this will be delivered with a government backdoor on the app side. If Musk actually manages to lure in whistleblowers to his platform with these antics those whistleblowers will have their asses hanging in the wind waiting for a government assistance request. Hopefully they arent as stupid as to trust musk.
- mjg59 3y ago
  It's actually plausible to audit the app for backdoor mechanisms, even without access to the source code. Right now there's no indication of one being present. I'm very very much not a fan of Elon, but in terms of the disparity between what's promised vs what's implemented right now everything points towards incompetence rather than malice.

threeseed 3y ago

Fascinating that Musk continues to run Twitter in a "move fast and break things" mode. When the entities that affect the company's existence the most i.e. regulators and advertisers are asking for more thoughtful, measured and safe changes. And instead he's obsessed with adding end-user features which based on the woeful Twitter Blue subscription numbers seems like a dead-end strategy.

monero-xmr 3y ago
He’s the richest person on earth and has a very solid track record. I’m betting he knows more than the average bitter commenter.
- simonw 3y ago
  His track record at running Twitter has been abysmal so far.
  - chasd00 3y ago
    Twitter works fine for me.
    - simonw 3y ago
      That's not incompatible with what I said. It mostly "works fine" for me too.
      - lazyeye 3y ago
        Works fine for me too. And am looking forward to all the new features they now have in the pipeline.
        foderking 3y ago
        same
- 3y ago

diebeforei485 3y ago

Twitter has said this is an early version that shouldn't be trusted yet - https://twitter.com/elonmusk/status/1656570790039678976?s=20 https://twitter.com/elonmusk/status/1656570790039678976?s=20

cmckn 3y ago
Coming from the man behind the FSD “beta”, this is par for the course; but I still find it questionable to turn this sort of feature on in prod (for paying customers, no less) while simultaneously admitting it’s not trustworthy.
- robertlagrant 3y ago
  Perhaps it depends on what is meant by untrustworthy, but I don't see how it's a downgrade for users. Or are your concerns just PR-related?
  - mjg59 3y ago
    It's an improvement over the status-quo. But given what was communicated before the feature was launched, it's very easy to believe that users might believe that the expectations around privacy and security are stronger than they actually are. Ideally you don't need to put any meaningful trust in the service provider, but in this case you do.
    - robertlagrant 3y ago
      Well, I think if comms have been over-zealous then a correction is appropriate. But either way, this just seems now commentary on their PR chops, rather than anything fundamental about their technical implementation, so I'll colour myself unworried again.
- diebeforei485 3y ago
  It's better than the current product where it's readable in plaintext to Twitter employees, and to some outside contractors as well. For those who already use Twitter DM's (which is a lot of people), this is an improvement.

baby 3y ago

Putting this out there. But I’ve audited a number of implementations of Signal and of close similar protocols proposed by some of the big players. Found a bug that broke Matrix e2e encryption[1]. Wrote the chapter on e2e encryption in the real world cryptography book including the only explanation of Signal in a book[2]. All I’m saying is that twitter, if you’re reading this, know that I have the blue checkmark ;) and that I’m available for pentesting your e2e encryption implementation! [1]: https://matrix.org/hall-of-fame https://matrix.org/hall-of-fame [2]: https://www.manning.com/books/real-world-cryptography https://www.manning.com/books/real-world-cryptography

tptacek 3y ago
Hey, David! Given the details we know right now about the implementation --- a single P-curve static-ephemeral key exchange for a long-lived GCM key --- would you sign off on that design? Is that how you'd implement encrypted messaging on a platform like Twitter? I mean, let's agree in advance that you might not do Signal Protocol given the expectations users would have. But is that how you'd do it?
- baby 3y ago
  Hey I’m not doing this for free! Hehe

russnes 3y ago

I'd say one of the best features for private messaging is having disappearing messages. Then you lower your chances of leaking the messages to someone gaining illegitimate access right now, instead of leaking the database at any time in the future

papito 3y ago
Are you positive that the massages disappear from your device AND from the servers? These companies notoriously do not delete anything ever. I am sure that even the things they are required to delete by law are removed, compressed and stashed somewhere.

SilverBirch 3y ago

As the reporting makes clear, it's kind of confusing who encrypted DMs are really for. Twitter finds itself in a position where it now answers to a man who is extremely vulnerable to state actors threatening his livelihood. In Turkey he became a fascist collaborator with virtually 0 push back. How much will he stand up for users of his platform if the CCP come knocking and want to unmask pesky protestors or users? Previously Twitter was blocked in China because they wouldn't follow the CCPs wishes. Well that was fine when twitter was independent they could stand behind their principles and China had no more leverage. Well what happens now that the CCP can shut down Tesla's Shanghai factory? Or even better, turn it over to a friendly local CEO? What happens when Elon Musk's line on "free speech is literally just what any local jurisdiction tells me" collides with US state bans on abortion, or LGTBQ rights? Sure would be awkward if the US suddenly had a lurch towards governors of right wing states introducing legislation to interfere with the operations of companies they don't like. All the technical details of it are kind of moot, because fundamentally any attack on Twitter won't be technical, it'll be a practical application of pressure on Musk.

neom 3y ago
Elon covers it a bit in his interview with Tucker. Whole interview is interesting-ish, but he talks about who it's for around 23:00 on: https://www.youtube.com/watch?v=LCOe3a9EHJs https://www.youtube.com/watch?v=LCOe3a9EHJs

rsynnott 3y ago

The post title is an… impressive spin on the actual headline.

davidgerard 3y ago

Fake headline. Real headline is: "Why you can't trust Twitter's encrypted DMs"