6 ms·

Yeah, I read your Matasano post, "Javascript crypto considered harmful", and I agree-- Javascript crypto is hard! But it's not impossible. The reason I chose

by dcposch 13y ago

Yeah, I read your Matasano post, "Javascript crypto considered harmful", and I agree-- Javascript crypto is hard! But it's not impossible. The reason I chose that route is because I want to make it as easy as possible for users to try out and adopt. Just testing it out? No installation required. I think that security is at least equal parts a technical problem and an adoption problem. The status quo is that nearly all email is searchable plaintext as far as strong adversaries are concernd. I want to fix that. > If you're going to build a browser extension, put the crypto code in the extension. The hard part is running known, trusted JS. Simply packaging the same HTML/CSS/JS as a browser extension was certainly my first impulse! The issue then is that you can never ship an update--users must proactively upgrade--unless you have an auto update mechanism for the extension (eg, Play Store) at which point you're again at the mercy of the server, no better than a web app. Once you get trusted code running on the client, you can bootstrap. The system I envision is as follows: you, a power user, download the browser extension. You verify the signatures. There are multiple signatures--not just my own--so that no one party can release a tampered client. A set of independent, trusted organizations around the world must sign each release. Let's call them the Signature Committee. The browser extension simply contains the public keys of each member of the signature committee, and a small bootstrap loader. When you run the browser extension, it gets the latest assets from the server, along with a signature file---and it checks that enough members of the signature committee have signed them. You know have trusted code, but the developer can still--with the consent of the signature committee--push out updates. I think that the Signature Committee concept has very cool properties. Currently, even security-critical client applications--for example, the Tor Browser Bundle--are usually only signed by a single organization--in that case, the Tor Foundation. Given that governments have shown themselves willing to coerce organizations to conspire against their users, and to do so in secret, we need something better. I envision a future where Scramble keeps improving continuously, but no one organization--not even any one country--can unilaterally ship an update. Thanks for your feedback!

tptacek 13y ago
It is impossible. The features required to make browser Javascript safe for crypto aren't even on the roadmaps of browser vendors. Your reason for using browser Javascript for crypto --- here, Recurity's JS PGP implementation --- is the same as every other JS crypto project's reason: doing everything in the browser makes it easier for users to adopt your project. You are not the first person to point this out and you won't be the last. The problem is, you acknowledge one side of this design ("it's super easy for users") and ignore the other ("it's fatal to security"). Here, you even acknowledge that there was a simple mechanism available to you that might have marginally improved security (packaging the whole application as a Chrome extension). But that made your life too hard! So you abandoned that idea and just made all the crypto downloadable from the server on HTML pages!
- dcposch 13y ago
  > it's fatal to security I'll respectfully disagree. > But that made your life too hard! So you abandoned that idea We haven't abandoned the Chrome extension idea at all. We just think there's a better approach than "packaging the whole application as a Chrome extension". Doesn't sound like you read my reply.
  - tptacek 13y ago
    You (a) don't have a Chrome extension that verifies anything right now, (b) are currently publishing the pure- browser- JS version of your application, and (c) envision a future in which a small number of "power users" can "safely" use the system while the majority of users, who you correctly note will not install your extension, will be at the mercy of attackers or, for that matter, your own server. You're essentially asking to be the next Lavabit. You've added a verification component that probably won't work even for the verifiers. But that doesn't even matter, because the majority of your users won't even be doing that verification.
- hershel 13y ago
  But doesn't this approach if implemented the best we can , at least blocks dragnet surveillance ? isn't that valuable ?
  - peterwwillis 13y ago
    How are you going to block dragnet surveillance if they can surveil the method of your delivering encrypted messages? NSA can already see, and modify, the JS used to create encrypted messages (because they've owned the HTTPS gateways), so they can see, and modify, the encrypted messages.
    - jaekwon 13y ago
      If they do this for many users, then those who don't have a secure environment (including the browser extension) are vulnerable, but it would be easy to detect that this is happening on a large scale -- those running the extension would be notified. If they don't do this for every user, then it wouldn't be effective dragnet surveillance, and Scramble would have a made a dent in dragnet ability.
jahewson 13y ago
Two big questions: 1. How do you revoke a compromised signature comitee certificate embedded in the browser extension? 2. How can you prevent a hostile browser extension from hijacking the validation process?
- woah 13y ago
  3. How do you prevent secret agents from looking in your window with binoculars?
  - jmccree 13y ago
    Curtains.
- jaekwon 13y ago
  Hi! These are good questions. 1. We could require the signatures to be recent, and if there are any certificates that need to be revoked, we could require that all signers include that information in the data signed. What do you think? 2. If other hostile browser extensions can hijack the validation process, then the only solution is to not have other browser extensions. Paranoid users who need strong security should boot from a fixed image that has a vetted browser with only one browser extension already installed.
  - jahewson 13y ago
    Re: 1. Yuck - that leaves a window of vulnerability as long as "recent". It also opens up the possibility of hijacking "recent" via NTP to change the client's clock for just the duration of the HTTP GET to the update server - this is not as difficult as it sounds. A better approach would be to have the client pull a list of revoked certs along with the JS source/hash. You'll need a majority wins system for the revocation otherwise the compromised cert could be used to revoke all other certs. Also you need to avoid replay attacks, so you'll have to embed a chain of all previously signed hashes/revocations as well (just being "recent" is not good enough). Re: 2. Yes, you can't have any other browser extensions. But that is totally unrealistic. It's just a a complete showstopper. Even a bookmarklet could bypass your cryptosystem!
dcposch 13y ago
PS: Most users are not power users, and won't download the extension and manually check signatures. As mentioned in the writeup, there's a beautiful way you can protect even non-power-users. Because the extension downloads and verifies the webapp HTML, CSS and JS every time it runs, the web app is constantly being validated. As long as you have a critical mass of power users who installed the extension, an adversary cannot tamper with the web application without immediately being noticed. A strong adversary could still commandeer the server and serve tampered JS to a specific IP without being detected. Users who are specially targeted by such an adversary must either install the extension, use Tor, or both. My goal is to make Scramble usable by a wide range of people. For a nontechnical user, it's just as easy as using Gmail--and at a minimum, they get the advantage that Scramble servers never store plaintext. A user with stronger requirements can do more, and can get stronger security guarantees.
- tptacek 13y ago
  WAT. This is a PGP application that works as long as a specific user isn't targeted. PGP did better than that in 1995: keep your key safe, and if the NSA has a 50 foot poster of your head shot hanging in the lobby of Fort Meade, they still can't decrypt the message. When you build and promote a system like this, you are assuming a responsibility on behalf of your users. You should take that responsibility more seriously.
  - jaekwon 13y ago
    This is also a PGP application that most people can benefit from immediately (compared to using Hotmail), and one that can be used by even the most targeted users if their environment is set up correctly once the extension is out.
    - tptacek 13y ago
      You say that because you want it to be true, not because you have any real confidence that it is true.
      - 13y ago
hershel 13y ago
>> I want to make it as easy as possible for users to try out and adopt. Just testing it out? No installation required. Why not offer an option to try it out in the browser(with same GUI), and if they want security tell them to install it(and verify)? It would be just a bit harder than installing the extension. BTW:there's another use case for extension based encryption: As the backbone for private messaging for various sites(which requires integration with the browser) , for example reddit. private messages in reddit are : (a)viewable to sniffers due to http usage (b)can be viewed by reddit staff (c)can be viewed by dragnet and targeted surveillance An extension would definetly reduce attack scenarios, and has a good viral marketing vector. In fact implement the right way i could see it being a very reliable way to making something like this popular.
- eli 13y ago
  I think you can do that now with one of the GPG browser plugins (or just copy/pasting from a GPG app)
  - hershel 13y ago
    It's different when everything is integrated , drive much much more usage, which is the whole point.
    - eli 13y ago
      It's been a while since I've tried, but I think there are GPG plugins that add buttons for encryption/decryption right to web forms... FireGPG used to integrate directly with GMail but I don't think it works any more.

by dcposch 13y ago

tptacek 13y ago

It is impossible. The features required to make browser Javascript safe for crypto aren't even on the roadmaps of browser vendors. Your reason for using browser Javascript for crypto --- here, Recurity's JS PGP implementation --- is the same as every other JS crypto project's reason: doing everything in the browser makes it easier for users to adopt your project. You are not the first person to point this out and you won't be the last. The problem is, you acknowledge one side of this design ("it's super easy for users") and ignore the other ("it's fatal to security"). Here, you even acknowledge that there was a simple mechanism available to you that might have marginally improved security (packaging the whole application as a Chrome extension). But that made your life too hard! So you abandoned that idea and just made all the crypto downloadable from the server on HTML pages!

dcposch 13y ago
> it's fatal to security I'll respectfully disagree. > But that made your life too hard! So you abandoned that idea We haven't abandoned the Chrome extension idea at all. We just think there's a better approach than "packaging the whole application as a Chrome extension". Doesn't sound like you read my reply.
- tptacek 13y ago
  You (a) don't have a Chrome extension that verifies anything right now, (b) are currently publishing the pure- browser- JS version of your application, and (c) envision a future in which a small number of "power users" can "safely" use the system while the majority of users, who you correctly note will not install your extension, will be at the mercy of attackers or, for that matter, your own server. You're essentially asking to be the next Lavabit. You've added a verification component that probably won't work even for the verifiers. But that doesn't even matter, because the majority of your users won't even be doing that verification.
hershel 13y ago
But doesn't this approach if implemented the best we can , at least blocks dragnet surveillance ? isn't that valuable ?
- peterwwillis 13y ago
  How are you going to block dragnet surveillance if they can surveil the method of your delivering encrypted messages? NSA can already see, and modify, the JS used to create encrypted messages (because they've owned the HTTPS gateways), so they can see, and modify, the encrypted messages.
  - jaekwon 13y ago
    If they do this for many users, then those who don't have a secure environment (including the browser extension) are vulnerable, but it would be easy to detect that this is happening on a large scale -- those running the extension would be notified. If they don't do this for every user, then it wouldn't be effective dragnet surveillance, and Scramble would have a made a dent in dragnet ability.

jahewson 13y ago

Two big questions: 1. How do you revoke a compromised signature comitee certificate embedded in the browser extension? 2. How can you prevent a hostile browser extension from hijacking the validation process?

woah 13y ago
3. How do you prevent secret agents from looking in your window with binoculars?
- jmccree 13y ago
  Curtains.
jaekwon 13y ago
Hi! These are good questions. 1. We could require the signatures to be recent, and if there are any certificates that need to be revoked, we could require that all signers include that information in the data signed. What do you think? 2. If other hostile browser extensions can hijack the validation process, then the only solution is to not have other browser extensions. Paranoid users who need strong security should boot from a fixed image that has a vetted browser with only one browser extension already installed.
- jahewson 13y ago
  Re: 1. Yuck - that leaves a window of vulnerability as long as "recent". It also opens up the possibility of hijacking "recent" via NTP to change the client's clock for just the duration of the HTTP GET to the update server - this is not as difficult as it sounds. A better approach would be to have the client pull a list of revoked certs along with the JS source/hash. You'll need a majority wins system for the revocation otherwise the compromised cert could be used to revoke all other certs. Also you need to avoid replay attacks, so you'll have to embed a chain of all previously signed hashes/revocations as well (just being "recent" is not good enough). Re: 2. Yes, you can't have any other browser extensions. But that is totally unrealistic. It's just a a complete showstopper. Even a bookmarklet could bypass your cryptosystem!

dcposch 13y ago

PS: Most users are not power users, and won't download the extension and manually check signatures. As mentioned in the writeup, there's a beautiful way you can protect even non-power-users. Because the extension downloads and verifies the webapp HTML, CSS and JS every time it runs, the web app is constantly being validated. As long as you have a critical mass of power users who installed the extension, an adversary cannot tamper with the web application without immediately being noticed. A strong adversary could still commandeer the server and serve tampered JS to a specific IP without being detected. Users who are specially targeted by such an adversary must either install the extension, use Tor, or both. My goal is to make Scramble usable by a wide range of people. For a nontechnical user, it's just as easy as using Gmail--and at a minimum, they get the advantage that Scramble servers never store plaintext. A user with stronger requirements can do more, and can get stronger security guarantees.

tptacek 13y ago
WAT. This is a PGP application that works as long as a specific user isn't targeted. PGP did better than that in 1995: keep your key safe, and if the NSA has a 50 foot poster of your head shot hanging in the lobby of Fort Meade, they still can't decrypt the message. When you build and promote a system like this, you are assuming a responsibility on behalf of your users. You should take that responsibility more seriously.
- jaekwon 13y ago
  This is also a PGP application that most people can benefit from immediately (compared to using Hotmail), and one that can be used by even the most targeted users if their environment is set up correctly once the extension is out.
  - tptacek 13y ago
    You say that because you want it to be true, not because you have any real confidence that it is true.
    - 13y ago

hershel 13y ago

>> I want to make it as easy as possible for users to try out and adopt. Just testing it out? No installation required. Why not offer an option to try it out in the browser(with same GUI), and if they want security tell them to install it(and verify)? It would be just a bit harder than installing the extension. BTW:there's another use case for extension based encryption: As the backbone for private messaging for various sites(which requires integration with the browser) , for example reddit. private messages in reddit are : (a)viewable to sniffers due to http usage (b)can be viewed by reddit staff (c)can be viewed by dragnet and targeted surveillance An extension would definetly reduce attack scenarios, and has a good viral marketing vector. In fact implement the right way i could see it being a very reliable way to making something like this popular.

eli 13y ago
I think you can do that now with one of the GPG browser plugins (or just copy/pasting from a GPG app)
- hershel 13y ago
  It's different when everything is integrated , drive much much more usage, which is the whole point.
  - eli 13y ago
    It's been a while since I've tried, but I think there are GPG plugins that add buttons for encryption/decryption right to web forms... FireGPG used to integrate directly with GMail but I don't think it works any more.