4 ms·

The fact that transcript consistency is waved aside, despite being an essential property of a messaging protocol especially in a group context, is problematic,

The fact that transcript consistency is waved aside, despite being an essential property of a messaging protocol especially in a group context, is problematic, from my perspective. Consider a group chat between Alice, Bob, and Carol. With this protocol, Alice can selectively send different messages to Bob and Carol with both of them thinking they got the same message. For example, Alice can tell Bob "The funds were transferred, thanks!" and tell Carol "Bob is stealing money." — and the protocol will ascribe integrity to the messages for both participants and label them as the same message. That said, I strongly respect Open Whisper Systems. They usually release very well thought-out material. Perhaps they should have paid more attention though to this particular issue.

sigil 12y ago
They're not waving aside transcript consistency with their protocol, near as I can tell. ("We believe that it is possible to provide transcript consistency while preserving an asynchronous orientation.") mpOTR, on the other hand, only shows transcript consistency at the end of a group chat session. This does seem problematic.
- kaeporan 12y ago
  Yes, per your quote, transcript consistency is discussed. But the discussion simply outlines problems with implementing it in their mobile use case — to my understanding the current version being offered to users doesn't have strong transcript consistency.
tptacek 12y ago
This post says that TextSecure implements transcript consistency in the protocol, and in a fashion objectively superior to that of mpOTR: the TextSecure protocol can provide continuous consistency checks, while mpOTR can do so only when the session is torn down. What the TextSecure client does not yet do is provide a UI for that feature of the protocol. Further, it's hard to understand how transcript consistency could be a serious objection while lack of forward secrecy in the messages isn't, especially given the deniable messaging semantics of OTR. So, to address your concluding sentence directly: it seems to me like Moxie has paid more attention to this issue than you have.
- kaeporan 12y ago
  I'm quite certain that the current TextSecure chat allows my proposed scenario with Alice, Bob and Carol to go through without issue. This is the main problem here. So while transcript consistency is discussed in the blog post, it remains the case that Alice can send a different message to Bob and Carol without being detected.
  - tptacek 12y ago
    This is a comment you could have written without even reading my comment. You haven't responded to anything I just wrote. I'm not surprised; your function in TextSecure threads seems to be to pop out and complain about TextSecure without mentioning that you're the author of Cryptocat, a competing (and inferior) offering.
    - kaeporan 12y ago
      I think TextSecure is an excellent and inspiring project. All I'm trying to do is identify an area of concern for me. I'm not sure why you're attacking me personally here. I think my initial point of concern stands and I hope the TextSecure developers will work on addressing it. And yes — I believe my work on Cryptocat does grant me some helpful perspective on the kind of issues faced in group chat. I'm more than happy try my best to offer some insight to other great open source projects. If I wanted to sneakily hide that I work on another encrypted messaging project (why would I? Open source projects discuss issues with one another all the time) it would have been simple for me to create another username.
      - tptacek 12y ago
        I'm not attacking you personally. I object to the fact that you didn't lead with the fact that you compete with TextSecure. As for your tone regarding the TextSecure project, here are all your messages regarding TextSecure: https://hn.algolia.com/?q=author%3Akaeporan#!/comment/forever/0/author%3Akaeporan%20textsecure https://hn.algolia.com/?q=author%3Akaeporan#!/comment/foreve... I am, however, happy to attack your project, Cryptocat, which I believe to be incompetently interviewed, debugged into existence, and dangerous to its users. Finally, you still haven't responded to my comment upthread.
sdevlin 12y ago
> For example, Alice can tell Bob "The funds were transferred, thanks!" and tell Carol "Bob is stealing money." — and the protocol will ascribe integrity to the messages for both participants and label them as the same message. Isn't this trivially possible in Cryptocat for anyone who controls the server?
- kaeporan 12y ago
  I don't think it would be trivial (it's likely possible to some degree, but authentication and integrity checks might make it slightly more difficult), but the issue with this protocol is that you don't even need server control — any client with TextSecure installed can do this. Note: I don't mean to disparage TextSecure by saying this. By all means, TextSecure is a kickass app and you should use it. I'm just trying to point out something that could be fixed in a future update.
  - sdevlin 12y ago
    It seems pretty trivial to me. Can't you just send different messages to different people?
    - kaeporan 12y ago
      I need to investigate this properly before I offer you an educated answer with details.
      - tptacek 12y ago
        Any progress on this, or is 'sdevlin simply correct?
- sc00bz 12y ago
  > Isn't this trivially possible in Cryptocat for anyone who controls the server? Yes this is a known bug since August 2013. When I found it and reported it. This was "patched" but if Mallory controls the server it is still possible. There were three ways to do this: block (which just doesn't send messages to blocked users), silent drop when invalid MAC, and silent drop when invalid tag. Block was turned into ignore and these three cases now display a warning message stating something about integrity. I seem to not be able to find me or anyone stating that "if Mallory controls the server it is still possible". So I guess it was only said in person. Technically it's known but not publicly known :). P.S. This was a "clamp the artery until the mpOTR protocol is finished".

sigil 12y ago

They're not waving aside transcript consistency with their protocol, near as I can tell. ("We believe that it is possible to provide transcript consistency while preserving an asynchronous orientation.") mpOTR, on the other hand, only shows transcript consistency at the end of a group chat session. This does seem problematic.

kaeporan 12y ago
Yes, per your quote, transcript consistency is discussed. But the discussion simply outlines problems with implementing it in their mobile use case — to my understanding the current version being offered to users doesn't have strong transcript consistency.

tptacek 12y ago

This post says that TextSecure implements transcript consistency in the protocol, and in a fashion objectively superior to that of mpOTR: the TextSecure protocol can provide continuous consistency checks, while mpOTR can do so only when the session is torn down. What the TextSecure client does not yet do is provide a UI for that feature of the protocol. Further, it's hard to understand how transcript consistency could be a serious objection while lack of forward secrecy in the messages isn't, especially given the deniable messaging semantics of OTR. So, to address your concluding sentence directly: it seems to me like Moxie has paid more attention to this issue than you have.

kaeporan 12y ago
I'm quite certain that the current TextSecure chat allows my proposed scenario with Alice, Bob and Carol to go through without issue. This is the main problem here. So while transcript consistency is discussed in the blog post, it remains the case that Alice can send a different message to Bob and Carol without being detected.
- tptacek 12y ago
  This is a comment you could have written without even reading my comment. You haven't responded to anything I just wrote. I'm not surprised; your function in TextSecure threads seems to be to pop out and complain about TextSecure without mentioning that you're the author of Cryptocat, a competing (and inferior) offering.
  - kaeporan 12y ago
    I think TextSecure is an excellent and inspiring project. All I'm trying to do is identify an area of concern for me. I'm not sure why you're attacking me personally here. I think my initial point of concern stands and I hope the TextSecure developers will work on addressing it. And yes — I believe my work on Cryptocat does grant me some helpful perspective on the kind of issues faced in group chat. I'm more than happy try my best to offer some insight to other great open source projects. If I wanted to sneakily hide that I work on another encrypted messaging project (why would I? Open source projects discuss issues with one another all the time) it would have been simple for me to create another username.
    - tptacek 12y ago
      I'm not attacking you personally. I object to the fact that you didn't lead with the fact that you compete with TextSecure. As for your tone regarding the TextSecure project, here are all your messages regarding TextSecure: https://hn.algolia.com/?q=author%3Akaeporan#!/comment/forever/0/author%3Akaeporan%20textsecure https://hn.algolia.com/?q=author%3Akaeporan#!/comment/foreve... I am, however, happy to attack your project, Cryptocat, which I believe to be incompetently interviewed, debugged into existence, and dangerous to its users. Finally, you still haven't responded to my comment upthread.

sdevlin 12y ago

> For example, Alice can tell Bob "The funds were transferred, thanks!" and tell Carol "Bob is stealing money." — and the protocol will ascribe integrity to the messages for both participants and label them as the same message. Isn't this trivially possible in Cryptocat for anyone who controls the server?

kaeporan 12y ago
I don't think it would be trivial (it's likely possible to some degree, but authentication and integrity checks might make it slightly more difficult), but the issue with this protocol is that you don't even need server control — any client with TextSecure installed can do this. Note: I don't mean to disparage TextSecure by saying this. By all means, TextSecure is a kickass app and you should use it. I'm just trying to point out something that could be fixed in a future update.
- sdevlin 12y ago
  It seems pretty trivial to me. Can't you just send different messages to different people?
  - kaeporan 12y ago
    I need to investigate this properly before I offer you an educated answer with details.
    - tptacek 12y ago
      Any progress on this, or is 'sdevlin simply correct?
sc00bz 12y ago
> Isn't this trivially possible in Cryptocat for anyone who controls the server? Yes this is a known bug since August 2013. When I found it and reported it. This was "patched" but if Mallory controls the server it is still possible. There were three ways to do this: block (which just doesn't send messages to blocked users), silent drop when invalid MAC, and silent drop when invalid tag. Block was turned into ignore and these three cases now display a warning message stating something about integrity. I seem to not be able to find me or anyone stating that "if Mallory controls the server it is still possible". So I guess it was only said in person. Technically it's known but not publicly known :). P.S. This was a "clamp the artery until the mpOTR protocol is finished".