4 ms·

The Practical Limitations of End-to-End Encryption

44 points by todsacerdoti 2y ago

PaulHoule 2y ago
You can't underestimate how much people will screw up operational security (opsec.) Arch-revolutionary Che Guevara was tracked down and assassinated because the NSA cracked his "unbreakable" one time pads which would have been unbreakable if he'd only used them once. https://www.kopaldev.de/2022/04/27/cryptography-for-everybody-the-straddling-checkerboard-cipher-and-che-guevara/ https://www.kopaldev.de/2022/04/27/cryptography-for-everybod...
gadilif 2y ago
The author writes "I do not foresee any smartphone app ever being approved for this purpose." (the purpose is 'passing classified information for military operations'), while in fact, I'm not sure I see the issue - all the app (any one of them, including WhatsApp, Signal, etc.) needs to add is what is referred to as 'conditional access' to some chats. Meaning, you can define chats as only authorized for users whose identity is provided by a trusted Identity Provider, or are running on certified devices. This type of security is already implemented in many enterprises, supported by browsers (to some extent, at least), and can be relatively easily be supported by applications. Custom made chat apps already use this (e.g. Workplace Chat, which is used by Meta), and so I'm not sure it's something we won't see supported by other commercial apps messaging apps.
- perching_aix 2y ago
  If I read it correctly it's because they think phones are a no-go from the outset, so clearly apps for those phones are out, too: > When government and military officials want to discuss operations, they’re typically required to go into a SCIF (Sensitive Compartmented Information Facility), which ensures: > > - That they are not being wiretapped. (To this end, mobile phones are not permitted in a SCIF.) Whether this is actually true or not I wouldn't know and can't be arsed to research, but it makes sense to me. Whether it's reasonable to assume based on this that phones are completely out I also don't know.
- kayfox 2y ago
  What he means by "I do not foresee any smartphone app ever being approved for this purpose." is that a commodity smart phone is an insecure platform, so the military will not be approving any app designed for a commodity smart phone. And by insecure here, he and I mean that its not a platform designed and manufactured to meet the large number of requirements for handing classified information. It may be secure in the sense of industry standards or conventions, but its not secure in the sense of military information security.
hypeatei 2y ago
Related: https://news.ycombinator.com/item?id=43462783 https://news.ycombinator.com/item?id=43462783 "The Trump Administration Accidentally Texted Me Its War Plans" (1043 points, 325 comments)
perching_aix 2y ago
> Switching to Matrix would have only helped if you consider “unable to decrypt message” helping. Why would I not?
- chc4 2y ago
  They're making a joke about how Matrix e2e is so high friction and unreliable that even if you should have access to a channel you'll get "unable to decrypt message" errors from key or identity issues - not that they would be rightfully unable to be decrypted by third parties (all the e2e programs they mention have that property).
  - perching_aix 2y ago
    Oh I see, thanks.
    - some_furry 2y ago
      Sorry, I wish sarcasm had a font face so I could make it more obvious.
  - johnisgood 2y ago
    Oh yes, I remember having this issue many times before. :D
throw9494jri 2y ago
[flagged]
- Braxton1980 2y ago
  No he didn't, this is a complete lie. He did have a Blackberry that was approved through proper channels and modified https://www.nytimes.com/2009/01/23/us/politics/23berry.html https://www.nytimes.com/2009/01/23/us/politics/23berry.html
  - throw8394948999 2y ago
    > allows him to stay in touch with senior staff > First, only a select circle of people will have his address, creating a true hierarchy for who makes the cut and who does not. > receive his e-mail address must first receive a briefing So he still has a blackberry, regular email address that is kept secret, but everyone who gets his address must have a briefing! Where exactly is there a complete lie in this?! Senior staff is responsible for toilet cleaning or making lunches?!
    - Braxton1980 2y ago
      You implied bombing plans were discussed on the Blackberry
krupan 2y ago
If you aren't listening to the Darknet Diaries podcast yet, you really should be. Episode 146 talks about a signal-like "secure messaging" app that the FBI enticed people to use that secretly had the FBI as a member of every chat, so they would get a copy of every message sent. This story strongly reminds me of that. https://darknetdiaries.com/episode/146/ https://darknetdiaries.com/episode/146/
- Cthulhu_ 2y ago
  Which app was that? There's been a few instances like that, Encrochat, ANOM and Sky ECC were all intercepted in one way or another by law enforcement. Of course, the real question is whether these led to any convictions. They did lead to a few prevented murders and the like, but given they're all sweeping / non targeted sting operations, they're not admissible in court in a lot of cases.
- goblin89 2y ago
  Darknet Diaries is not a good podcast. Each episode is chewed up slowly to the lowest common denominator, meaning half of an episode is condescending explanation of trivial matter. The misplaced air of faux mystery, true crime podcast style, does not help. The narrator being occasionally a free speech absolutist and explicitly in favour of money laundering services does not help. Risky Biz covered Anom in https://risky.biz/RB751/ https://risky.biz/RB751/ via a dense if a bit short interview with Joseph Cox, who wrote a book about it, starting around minute 35. Listen to that and respective Darknet Diaries episode to compare. In general Risky Biz offers more balanced, less boring, and up-to-date takes on cybercrime (sans interviews with actual criminals).
  - some_furry 2y ago
    Author of TFA here: I like Risky Biz a lot.
  - sokka_h2otribe 2y ago
    Could you reference some of this free speech absolutist background? I'm willing to reexamine my appreciation for the darknet diaries,but I have never gotten this political take from the content itself. Rather he seems to simply be willing to engage with folks he disagrees with morally, as a matter similar to any journalist might. He does not engage with active crime or anything like that either. I really like darknet diaries. I don't think it is just about cyber crime though. More like a human social journalism with a heavy cyber crime angle. So that's how you have such a range of content in my opinion. Also, maybe listen at 1.3X? That makes the explanations and pacing imo easier
SAI_Peregrinus 2y ago
Signal's cryptography is quite secure. Signal's user management (restricting users you can chat with only to members of your organization) is nonexistent since it's not a goal. There's no requirement to have your common access card to get into a Signal group, there's no check for appropriate clearance enforced by Signal, so it's fundamentally unsuited to handling military information.
- JumpCrisscross 2y ago
  > no requirement to have your common access card to get into a Signal group, there's no check for appropriate clearance enforced by Signal, so it's fundamentally unsuited to handling military information It's also running on a device that's had who knows what websites visited on it today.
  - profmonocle 2y ago
    In the early days of the iPhone, there was a vulnerability that allowed you to jailbreak your phone by visiting a specific web site. IIRC it was some vulnerability in the TIFF handling code. The same vulnerability could have been used to silently install spyware with root level access. No need to break signal's crypto if you can just silently capture screenshots. It's not hard to imagine some foreign intelligence agency is sitting on some severe zero-day vulnerability, waiting to use it on very high value targets, such as senior administration staff.
    - proxynoproxy 2y ago
      You don’t have to imagine. This is a billion dollar intel industry that pays out millions of dollars for vulns, and charges corrupt governments more for access to hack their citizens most private data. Those unscrupulous enough to sell the vulnerability to the exploiters, there is gold. Of course we would rather they did the right thing and got the bugs fixed.
    - immibis 2y ago
      > No need to break signal's crypto if you can just silently capture screenshots. This is also something that comes up with esoteric cryptography schemes. There are systems designed so that you could theoretically deny whatever property, but in reality, the bad guy looks at your phone and believes whatever is on the screen anyway.
profmonocle 2y ago
Endpoint integrity is also critical. If Apple or Google were compromised, they could silently push an update that replaces the real Signal app with a modified version that forwards everything to an adversary. Any system where the government doesn't have total control over software deployment will never be viable for handling claasified information.
- inahga 2y ago
  Signal on Android is reproducible https://github.com/signalapp/Signal-Android/tree/main/reproducible-builds https://github.com/signalapp/Signal-Android/tree/main/reprod..., so _theoretically_ the play store version could be monitored to detect tampering by Google (or whoever). That is, if the reproducible build didn't constantly break https://github.com/signalapp/Signal-Android/issues/13565 https://github.com/signalapp/Signal-Android/issues/13565. It also ignores the fact that the vendor could send updates targeted to specific devices.
- deleted 2y ago
  [deleted]
patwolf 2y ago
> Point being: SCIFs are the right tool for the job. Smartphone apps like Signal are not. The job in this case seems to be secure, ad-hoc communication between multiple parties while on the road (the VP at least was doing an event in Michigan). Clearly a public smartphone app isn't the right tool for the job. Is a SCIF the right tool though? I always thought of SCIFs as purpose-built rooms. It seems impractical that every time a message needs to be communicated, the parties have to be whisked away to a SCIF.
- profmonocle 2y ago
  There are portable SCIFs, basically specially designed trailers, to allow senior staff to communicate securely on the road. It's very likely Vance had one of these nearby.
  - Sanzig 2y ago
    Not to mention plenty of DoD facilities from coast-to-coast with SCIFs - even without a portable SCIF, he likely wasn't far from one. Failing that, these people almost certainly have laptops connected to DoD networks at a lower COMSEC level than a true SCIF (indeed, "high-side laptops" were mentioned in the Signal thread). They could have communicated with those. I don't know about DoD policy if those would be acceptable or not for discussions about planned strikes, but it'd be a hell of a lot more secure than unsecured public smartphones.
  - throw0101c 2y ago
    > There are portable SCIFs, basically specially designed trailers […] There are 'tents' as well; Obama in one: * https://www.bbc.com/news/world-us-canada-12810675 https://www.bbc.com/news/world-us-canada-12810675 * http://archive.is/https://www.nytimes.com/2013/11/10/us/politics/obamas-portable-zone-of-secrecy-some-assembly-required.html http://archive.is/https://www.nytimes.com/2013/11/10/us/poli...
- johnisgood 2y ago
  > Smartphone ... It should have ended there. Smartphones are not secure and you must not trust them.
amai 2y ago
On the other hand the military of Ukraine is using Signal. And are hacked by Russia: https://www.politico.eu/article/russian-hackers-snoop-ukrainian-signal-accounts-google-report/ https://www.politico.eu/article/russian-hackers-snoop-ukrain...
- some_furry 2y ago
  From the article: "In some cases, Google has found Russia's notorious, stealthy hacking group Sandworm (or APT44, part of the military intelligence agency GRU), to work with Russian military staff on the front lines to link Signal accounts on devices captured on the battlefield to their own systems, allowing the espionage group to keep tracking the communication channels." "In other cases, hackers have tricked Ukrainians into scanning malicious QR codes that, once scanned, link a victim’s account to the hacker’s interface, meaning future messages will be delivered both to the victim and the hackers in real time." Gee, I dunno, sounds like hacking the endpoint to me (which always defeats end-to-end encryption).

44 points by todsacerdoti 2y ago

You can't underestimate how much people will screw up operational security (opsec.) Arch-revolutionary Che Guevara was tracked down and assassinated because the NSA cracked his "unbreakable" one time pads which would have been unbreakable if he'd only used them once. https://www.kopaldev.de/2022/04/27/cryptography-for-everybody-the-straddling-checkerboard-cipher-and-che-guevara/ https://www.kopaldev.de/2022/04/27/cryptography-for-everybod...

gadilif 2y ago

The author writes "I do not foresee any smartphone app ever being approved for this purpose." (the purpose is 'passing classified information for military operations'), while in fact, I'm not sure I see the issue - all the app (any one of them, including WhatsApp, Signal, etc.) needs to add is what is referred to as 'conditional access' to some chats. Meaning, you can define chats as only authorized for users whose identity is provided by a trusted Identity Provider, or are running on certified devices. This type of security is already implemented in many enterprises, supported by browsers (to some extent, at least), and can be relatively easily be supported by applications. Custom made chat apps already use this (e.g. Workplace Chat, which is used by Meta), and so I'm not sure it's something we won't see supported by other commercial apps messaging apps.

perching_aix 2y ago
If I read it correctly it's because they think phones are a no-go from the outset, so clearly apps for those phones are out, too: > When government and military officials want to discuss operations, they’re typically required to go into a SCIF (Sensitive Compartmented Information Facility), which ensures: > > - That they are not being wiretapped. (To this end, mobile phones are not permitted in a SCIF.) Whether this is actually true or not I wouldn't know and can't be arsed to research, but it makes sense to me. Whether it's reasonable to assume based on this that phones are completely out I also don't know.
kayfox 2y ago
What he means by "I do not foresee any smartphone app ever being approved for this purpose." is that a commodity smart phone is an insecure platform, so the military will not be approving any app designed for a commodity smart phone. And by insecure here, he and I mean that its not a platform designed and manufactured to meet the large number of requirements for handing classified information. It may be secure in the sense of industry standards or conventions, but its not secure in the sense of military information security.

hypeatei 2y ago

Related: https://news.ycombinator.com/item?id=43462783 https://news.ycombinator.com/item?id=43462783 "The Trump Administration Accidentally Texted Me Its War Plans" (1043 points, 325 comments)

perching_aix 2y ago

> Switching to Matrix would have only helped if you consider “unable to decrypt message” helping. Why would I not?

chc4 2y ago
They're making a joke about how Matrix e2e is so high friction and unreliable that even if you should have access to a channel you'll get "unable to decrypt message" errors from key or identity issues - not that they would be rightfully unable to be decrypted by third parties (all the e2e programs they mention have that property).
- perching_aix 2y ago
  Oh I see, thanks.
  - some_furry 2y ago
    Sorry, I wish sarcasm had a font face so I could make it more obvious.
- johnisgood 2y ago
  Oh yes, I remember having this issue many times before. :D

throw9494jri 2y ago

[flagged]

Braxton1980 2y ago
No he didn't, this is a complete lie. He did have a Blackberry that was approved through proper channels and modified https://www.nytimes.com/2009/01/23/us/politics/23berry.html https://www.nytimes.com/2009/01/23/us/politics/23berry.html
- throw8394948999 2y ago
  > allows him to stay in touch with senior staff > First, only a select circle of people will have his address, creating a true hierarchy for who makes the cut and who does not. > receive his e-mail address must first receive a briefing So he still has a blackberry, regular email address that is kept secret, but everyone who gets his address must have a briefing! Where exactly is there a complete lie in this?! Senior staff is responsible for toilet cleaning or making lunches?!
  - Braxton1980 2y ago
    You implied bombing plans were discussed on the Blackberry

krupan 2y ago

If you aren't listening to the Darknet Diaries podcast yet, you really should be. Episode 146 talks about a signal-like "secure messaging" app that the FBI enticed people to use that secretly had the FBI as a member of every chat, so they would get a copy of every message sent. This story strongly reminds me of that. https://darknetdiaries.com/episode/146/ https://darknetdiaries.com/episode/146/

Cthulhu_ 2y ago
Which app was that? There's been a few instances like that, Encrochat, ANOM and Sky ECC were all intercepted in one way or another by law enforcement. Of course, the real question is whether these led to any convictions. They did lead to a few prevented murders and the like, but given they're all sweeping / non targeted sting operations, they're not admissible in court in a lot of cases.
goblin89 2y ago
Darknet Diaries is not a good podcast. Each episode is chewed up slowly to the lowest common denominator, meaning half of an episode is condescending explanation of trivial matter. The misplaced air of faux mystery, true crime podcast style, does not help. The narrator being occasionally a free speech absolutist and explicitly in favour of money laundering services does not help. Risky Biz covered Anom in https://risky.biz/RB751/ https://risky.biz/RB751/ via a dense if a bit short interview with Joseph Cox, who wrote a book about it, starting around minute 35. Listen to that and respective Darknet Diaries episode to compare. In general Risky Biz offers more balanced, less boring, and up-to-date takes on cybercrime (sans interviews with actual criminals).
- some_furry 2y ago
  Author of TFA here: I like Risky Biz a lot.
- sokka_h2otribe 2y ago
  Could you reference some of this free speech absolutist background? I'm willing to reexamine my appreciation for the darknet diaries,but I have never gotten this political take from the content itself. Rather he seems to simply be willing to engage with folks he disagrees with morally, as a matter similar to any journalist might. He does not engage with active crime or anything like that either. I really like darknet diaries. I don't think it is just about cyber crime though. More like a human social journalism with a heavy cyber crime angle. So that's how you have such a range of content in my opinion. Also, maybe listen at 1.3X? That makes the explanations and pacing imo easier

SAI_Peregrinus 2y ago

Signal's cryptography is quite secure. Signal's user management (restricting users you can chat with only to members of your organization) is nonexistent since it's not a goal. There's no requirement to have your common access card to get into a Signal group, there's no check for appropriate clearance enforced by Signal, so it's fundamentally unsuited to handling military information.

JumpCrisscross 2y ago
> no requirement to have your common access card to get into a Signal group, there's no check for appropriate clearance enforced by Signal, so it's fundamentally unsuited to handling military information It's also running on a device that's had who knows what websites visited on it today.
- profmonocle 2y ago
  In the early days of the iPhone, there was a vulnerability that allowed you to jailbreak your phone by visiting a specific web site. IIRC it was some vulnerability in the TIFF handling code. The same vulnerability could have been used to silently install spyware with root level access. No need to break signal's crypto if you can just silently capture screenshots. It's not hard to imagine some foreign intelligence agency is sitting on some severe zero-day vulnerability, waiting to use it on very high value targets, such as senior administration staff.
  - proxynoproxy 2y ago
    You don’t have to imagine. This is a billion dollar intel industry that pays out millions of dollars for vulns, and charges corrupt governments more for access to hack their citizens most private data. Those unscrupulous enough to sell the vulnerability to the exploiters, there is gold. Of course we would rather they did the right thing and got the bugs fixed.
  - immibis 2y ago
    > No need to break signal's crypto if you can just silently capture screenshots. This is also something that comes up with esoteric cryptography schemes. There are systems designed so that you could theoretically deny whatever property, but in reality, the bad guy looks at your phone and believes whatever is on the screen anyway.

profmonocle 2y ago

Endpoint integrity is also critical. If Apple or Google were compromised, they could silently push an update that replaces the real Signal app with a modified version that forwards everything to an adversary. Any system where the government doesn't have total control over software deployment will never be viable for handling claasified information.

inahga 2y ago
Signal on Android is reproducible https://github.com/signalapp/Signal-Android/tree/main/reproducible-builds https://github.com/signalapp/Signal-Android/tree/main/reprod..., so _theoretically_ the play store version could be monitored to detect tampering by Google (or whoever). That is, if the reproducible build didn't constantly break https://github.com/signalapp/Signal-Android/issues/13565 https://github.com/signalapp/Signal-Android/issues/13565. It also ignores the fact that the vendor could send updates targeted to specific devices.
deleted 2y ago
[deleted]

patwolf 2y ago

> Point being: SCIFs are the right tool for the job. Smartphone apps like Signal are not. The job in this case seems to be secure, ad-hoc communication between multiple parties while on the road (the VP at least was doing an event in Michigan). Clearly a public smartphone app isn't the right tool for the job. Is a SCIF the right tool though? I always thought of SCIFs as purpose-built rooms. It seems impractical that every time a message needs to be communicated, the parties have to be whisked away to a SCIF.

profmonocle 2y ago
There are portable SCIFs, basically specially designed trailers, to allow senior staff to communicate securely on the road. It's very likely Vance had one of these nearby.
- Sanzig 2y ago
  Not to mention plenty of DoD facilities from coast-to-coast with SCIFs - even without a portable SCIF, he likely wasn't far from one. Failing that, these people almost certainly have laptops connected to DoD networks at a lower COMSEC level than a true SCIF (indeed, "high-side laptops" were mentioned in the Signal thread). They could have communicated with those. I don't know about DoD policy if those would be acceptable or not for discussions about planned strikes, but it'd be a hell of a lot more secure than unsecured public smartphones.
- throw0101c 2y ago
  > There are portable SCIFs, basically specially designed trailers […] There are 'tents' as well; Obama in one: * https://www.bbc.com/news/world-us-canada-12810675 https://www.bbc.com/news/world-us-canada-12810675 * http://archive.is/https://www.nytimes.com/2013/11/10/us/politics/obamas-portable-zone-of-secrecy-some-assembly-required.html http://archive.is/https://www.nytimes.com/2013/11/10/us/poli...
johnisgood 2y ago
> Smartphone ... It should have ended there. Smartphones are not secure and you must not trust them.

amai 2y ago

On the other hand the military of Ukraine is using Signal. And are hacked by Russia: https://www.politico.eu/article/russian-hackers-snoop-ukrainian-signal-accounts-google-report/ https://www.politico.eu/article/russian-hackers-snoop-ukrain...

some_furry 2y ago
From the article: "In some cases, Google has found Russia's notorious, stealthy hacking group Sandworm (or APT44, part of the military intelligence agency GRU), to work with Russian military staff on the front lines to link Signal accounts on devices captured on the battlefield to their own systems, allowing the espionage group to keep tracking the communication channels." "In other cases, hackers have tricked Ukrainians into scanning malicious QR codes that, once scanned, link a victim’s account to the hacker’s interface, meaning future messages will be delivered both to the victim and the hackers in real time." Gee, I dunno, sounds like hacking the endpoint to me (which always defeats end-to-end encryption).