5 ms·

I can never get excited about E2EE encryption... It's not because it isn't important, it's because while I've lived I've had 2 phones die in my hands, 2 family

I can never get excited about E2EE encryption... It's not because it isn't important, it's because while I've lived I've had 2 phones die in my hands, 2 family members have lost phones (one of which is sitting at the bottom of an ocean and is clearly unrecoverable), and phones are consumables that change every few years. I see there's some effort here on history sharing. Does that effort allow recovery of a chat history after an unrecoverable death of a primary phone? That's (honestly) the only usability thing I care about when it comes to E2EE.

klausa 3y ago
https://engineering.fb.com/wp-content/uploads/2023/12/TheLabyrinthEncryptedMessageStorageProtocol_12-6-2023.pdf https://engineering.fb.com/wp-content/uploads/2023/12/TheLab... Page 33 and 34.
sdeframond 3y ago
I backup my (encrypted) Signal conversations and sync them to some computers with Syncthing. I think it covers the "phone is at the bottom of the ocean" case. To be fair I haven't done any disaster recovery yet, so it might not work that well...
- laserbeam 3y ago
  That's not something you can ask of a casual user though. Not saying I'm one but I can already not recommend Signal to random friends and family that are not tech savy for reasons like this one.
  - sdeframond 3y ago
    Yep, that's the old convenience vs. privacy dilemma...
    - AniseAbyss 3y ago
      [dead]
- Obscurity4340 3y ago
  How do you backup Signal stuff? Is it included in local "iTunes" Backups?
  - sdeframond 3y ago
    Apparently it is not possible to automatically backup your message on iOS. (I run Android.) Source: https://support.signal.org/hc/en-us/articles/360007059752-Backup-and-Restore-Messages https://support.signal.org/hc/en-us/articles/360007059752-Ba...
    - Obscurity4340 3y ago
      K what about via Android, is it more flexible on that side?
modeless 3y ago
The solution to this is to encrypt the cloud backup with a key derived from a password that the user remembers and can enter into a new phone. The password has to be strong because the cloud provider has the encrypted data and has unlimited time to do a brute force attack. Unfortunately strong passwords are hard to remember and users hate them. But there is a trick to prevent brute forcing of a weak and easy to remember password like your four digit phone unlock PIN. The trick is to have a secure element chip in the datacenter, with storage encrypted by a private key that can't be extracted from the chip. The chip stores an encryption key that unlocks your backup, but it can't be extracted from the chip unless you present it with the right weak password. The chip's firmware rate limits and caps the number of attempts to unlock the backup, and if too many attempts are made it ultimately erases the key and your backup is permanently lost. So you're protected against brute forcing even with a weak four digit unlock code. If you know the unlock code from your old phone and enter it into your new phone, the secure element validates it and releases the key so you can restore the backup. Obviously you have to trust the manufacturer of the secure element for this to work, but it's probably a good compromise for most users because losing your backups when your phone dies is quite bad. I know Google's Android backup uses this method and I believe iCloud does as well. It seems like Messenger supports this too but you have to choose your own PIN because Messenger doesn't have access to your main phone unlock code.
- michaelt 3y ago
  > The trick is to have a secure element chip in the datacenter, with storage encrypted by a private key that can't be extracted from the chip. Ah yes, a HSM. Thus transferring the foundational "trust me bro" from Apple to someone like Thales Group. Let's hope the HSM supports secret backup well enough to protect against server failure, and yet not so well as to allow the unlock attempt limiter to be bypassed.
  - kibibyte 3y ago
    > Let's hope the HSM supports secret backup well enough Secrets backup for HSMs from a certain vendor—that you may or may not have named in your comment—I've worked with is actually the easy part. You just make copies of it and all the key data and check it into a git repo, because all of that data is protected by an HSM secret. Distributing that HSM secret among several HSMs for redundancy is also pretty easy. The hard part is all the administration around it, specifically around custody of the smart cards that contain chunks of the HSM secret: where are they protected, where are the backups of the cards, who has access to them, coordinating sufficient card custodians to meet quorum, etc. You need to meet quorum to provision HSMs with the same secret. The real "trust me" part of this is arguably less that the vendor backdoored the HSMs, and more that Apple pays the vendor support contracts (that hardware eventually fails) and maintains the knowledge continuity for the teams responsible for administering these HSMs as people join or leave those teams over time. For what it's worth, this is pretty much why you don't see HSMs used often at less mature companies.
poisonborz 3y ago
You can export all your FB data easily anytime, in the sense that is also easy for casual users.
supermatt 3y ago
Yes, the storage back-chains epoch secrets specifically for this purpose of restoring history.

klausa 3y ago

https://engineering.fb.com/wp-content/uploads/2023/12/TheLabyrinthEncryptedMessageStorageProtocol_12-6-2023.pdf https://engineering.fb.com/wp-content/uploads/2023/12/TheLab... Page 33 and 34.

sdeframond 3y ago

I backup my (encrypted) Signal conversations and sync them to some computers with Syncthing. I think it covers the "phone is at the bottom of the ocean" case. To be fair I haven't done any disaster recovery yet, so it might not work that well...

laserbeam 3y ago
That's not something you can ask of a casual user though. Not saying I'm one but I can already not recommend Signal to random friends and family that are not tech savy for reasons like this one.
- sdeframond 3y ago
  Yep, that's the old convenience vs. privacy dilemma...
  - AniseAbyss 3y ago
    [dead]
Obscurity4340 3y ago
How do you backup Signal stuff? Is it included in local "iTunes" Backups?
- sdeframond 3y ago
  Apparently it is not possible to automatically backup your message on iOS. (I run Android.) Source: https://support.signal.org/hc/en-us/articles/360007059752-Backup-and-Restore-Messages https://support.signal.org/hc/en-us/articles/360007059752-Ba...
  - Obscurity4340 3y ago
    K what about via Android, is it more flexible on that side?

modeless 3y ago

The solution to this is to encrypt the cloud backup with a key derived from a password that the user remembers and can enter into a new phone. The password has to be strong because the cloud provider has the encrypted data and has unlimited time to do a brute force attack. Unfortunately strong passwords are hard to remember and users hate them. But there is a trick to prevent brute forcing of a weak and easy to remember password like your four digit phone unlock PIN. The trick is to have a secure element chip in the datacenter, with storage encrypted by a private key that can't be extracted from the chip. The chip stores an encryption key that unlocks your backup, but it can't be extracted from the chip unless you present it with the right weak password. The chip's firmware rate limits and caps the number of attempts to unlock the backup, and if too many attempts are made it ultimately erases the key and your backup is permanently lost. So you're protected against brute forcing even with a weak four digit unlock code. If you know the unlock code from your old phone and enter it into your new phone, the secure element validates it and releases the key so you can restore the backup. Obviously you have to trust the manufacturer of the secure element for this to work, but it's probably a good compromise for most users because losing your backups when your phone dies is quite bad. I know Google's Android backup uses this method and I believe iCloud does as well. It seems like Messenger supports this too but you have to choose your own PIN because Messenger doesn't have access to your main phone unlock code.

michaelt 3y ago
> The trick is to have a secure element chip in the datacenter, with storage encrypted by a private key that can't be extracted from the chip. Ah yes, a HSM. Thus transferring the foundational "trust me bro" from Apple to someone like Thales Group. Let's hope the HSM supports secret backup well enough to protect against server failure, and yet not so well as to allow the unlock attempt limiter to be bypassed.
- kibibyte 3y ago
  > Let's hope the HSM supports secret backup well enough Secrets backup for HSMs from a certain vendor—that you may or may not have named in your comment—I've worked with is actually the easy part. You just make copies of it and all the key data and check it into a git repo, because all of that data is protected by an HSM secret. Distributing that HSM secret among several HSMs for redundancy is also pretty easy. The hard part is all the administration around it, specifically around custody of the smart cards that contain chunks of the HSM secret: where are they protected, where are the backups of the cards, who has access to them, coordinating sufficient card custodians to meet quorum, etc. You need to meet quorum to provision HSMs with the same secret. The real "trust me" part of this is arguably less that the vendor backdoored the HSMs, and more that Apple pays the vendor support contracts (that hardware eventually fails) and maintains the knowledge continuity for the teams responsible for administering these HSMs as people join or leave those teams over time. For what it's worth, this is pretty much why you don't see HSMs used often at less mature companies.

poisonborz 3y ago

You can export all your FB data easily anytime, in the sense that is also easy for casual users.

supermatt 3y ago

Yes, the storage back-chains epoch secrets specifically for this purpose of restoring history.