6 ms·

Matasano's "Javascript Cryptography Considered Harmful" is yet again applicable. http://matasano.com/articles/javascript-cryptography/ http://matasano.com/artic

Matasano's "Javascript Cryptography Considered Harmful" is yet again applicable. http://matasano.com/articles/javascript-cryptography/ http://matasano.com/articles/javascript-cryptography/ These statements are mutually exclusive: End to end encrypted: Nobody, not even us, can read or listen into your conversations. Works everywhere: Visit subrosa.io from any computer. No download or install needed.

phibit 12y ago
Can you explain how these two statements are mutually exclusive? These statements are mutually exclusive: End to end encrypted: Nobody, not even us, can read or listen into your conversations. Works everywhere: Visit subrosa.io from any computer. No download or install needed.
- CJefferson 12y ago
  subrosa can choose at any time to send you javascript which will send your password back to them. You have no way of checking for this (well, except reading all the javascript, every time you log in)
  - phibit 12y ago
    Ah yes, that makes sense, thanks!
  - technomancy 12y ago
    Except it's a GPL'd web application, so you're free to run your own server.
    - schoen 12y ago
      Sure, but if you run your own server, then the site's claim that there was "no download or install needed" doesn't apply to you. If you don't run your own server, the site's claim that "nobody, not even us, can read or listen into your conversations" doesn't apply to you. There's nobody to whom both claims apply at the same time!
      - technomancy 12y ago
        If you run your own server, you can make trusted calls from machines that don't have any client software set up, as can others using your server. Seems straightforward enough. It's clear the "no install" claims are about the client.
        schoen 12y ago
        I read the claims on their home page as referring to the use case where someone starts using it immediately. (The benefit that they mention on the home page from open source is third-party auditability; the home page doesn't even mention the ability to create your own instance!) The developers might well be thinking along the lines that you describe, but I don't think that a visitor to the site is likely to understand the threats that way. Edit: Looking at https://subrosa.io/security https://subrosa.io/security I think it's even more clear that they're making these claims for their own hosted instance of their software -- and that's what people here are most skeptical of.
        acveilleux 12y ago
        You can use github or you can run a private gitorious install (assume here function parity.) Most people will choose github because that's where the people are. Subrosa's value proposition is more as a meeting place then as a "secure" chat software.
hluska 12y ago
That is such a good article and I cannot believe that I am just reading it for the first time now. Thank you so much for posting the article and your explanation of the two mutually exclusive statements. Crypto is just about the coolest thing I have ever heard of and I love learning about different types of attacks!
- explorigin 12y ago
  This is not a "good" article. It's very hand wavey with lots of fud. For example, he talks about the chicken and egg problem of delivering javascript over an insecure connection and then solves it later with SSL/TLS (but he doesn't acknowledge that this is a valid solution). Furthermore, we're all harping on javascript when you can't download PuTTY over an SSL connection. He talks about browser cache but says that javascript can't control it. That doesn't mean it can't be controlled (see MANIFEST file). I could go on, but the point is made, there are answers to the problems raised in the article. They may not be _easy_ (as the article complains some things are complex), but it's security on wildly complex systems...of course it's hard.
  - dublinben 12y ago
    >we're all harping on javascript when you can't download PuTTY over an SSL connection This shouldn't matter, and would just provide a false sense of security. You ought to be verifying the signature of any program you're installing before you use it. Since you're running Windows the point is probably moot, but it is possible to install software reasonably securely.
    - jimktrains2 12y ago
      But those sigs are also coming over a non-ssl connection:-p Honestly, whenever you download anything, evne over SSL, you're essentially trusting that the remote computer is not only who you think the computer is, but the person you expect to be controlling it is the only person controlling it. Out-of-band communication built out-of in-person trust are really the only way around that (i.e. trusting someone who trusts the PuTTY devs and gets you the hash/sig).
api 12y ago
Everything this article says is true. That being said, it also applies to any regular application that can be upgraded automatically or that's upgraded at all by a third party. Anything you get off an app store can have its code switched out from under it with minimal and routine or in some cases even no user interaction. All someone has to do is compromise the signing key, which is probably not that hard in many cases.
- Scaevolus 12y ago
  Scarily true. The amount of damage malicious actors with keys can do is greatly magnified by the auto-update mechanisms that developers love.
  - api 12y ago
    I have an app with auto-update, and one day I realized that I had (more or less) root on hundreds of users' machines. I'm not special in this regard. I take fairly strong precautions with my keys: offline storage, encrypted, signing on an air-gapped machine. I'd bet you money that most people aren't so careful. There are probably a lot of secret signing keys sitting in DropBox.
- jtheory 12y ago
  Sure; but there's a world of difference between communicating with a webapp that claims to protect your privacy even from the NSA (but actually cannot) vs. "any regular application", which makes no such security claims, and from whom savvy users won't expect that kind of protection. People with important information to communicate that they must protect from the powers that be (quite possibly to protect their own lives) will seek out secure methods; at the same time, the powers they're avoiding will be targeting secure communication methods.
  - tptacek 12y ago
    This application doesn't protect communications from the owners of the application under any circumstances. Forget about the NSA.

phibit 12y ago

Can you explain how these two statements are mutually exclusive? These statements are mutually exclusive: End to end encrypted: Nobody, not even us, can read or listen into your conversations. Works everywhere: Visit subrosa.io from any computer. No download or install needed.

CJefferson 12y ago
subrosa can choose at any time to send you javascript which will send your password back to them. You have no way of checking for this (well, except reading all the javascript, every time you log in)
- phibit 12y ago
  Ah yes, that makes sense, thanks!
- technomancy 12y ago
  Except it's a GPL'd web application, so you're free to run your own server.
  - schoen 12y ago
    Sure, but if you run your own server, then the site's claim that there was "no download or install needed" doesn't apply to you. If you don't run your own server, the site's claim that "nobody, not even us, can read or listen into your conversations" doesn't apply to you. There's nobody to whom both claims apply at the same time!
    - technomancy 12y ago
      If you run your own server, you can make trusted calls from machines that don't have any client software set up, as can others using your server. Seems straightforward enough. It's clear the "no install" claims are about the client.
      - schoen 12y ago
        I read the claims on their home page as referring to the use case where someone starts using it immediately. (The benefit that they mention on the home page from open source is third-party auditability; the home page doesn't even mention the ability to create your own instance!) The developers might well be thinking along the lines that you describe, but I don't think that a visitor to the site is likely to understand the threats that way. Edit: Looking at https://subrosa.io/security https://subrosa.io/security I think it's even more clear that they're making these claims for their own hosted instance of their software -- and that's what people here are most skeptical of.
      - acveilleux 12y ago
        You can use github or you can run a private gitorious install (assume here function parity.) Most people will choose github because that's where the people are. Subrosa's value proposition is more as a meeting place then as a "secure" chat software.

hluska 12y ago

That is such a good article and I cannot believe that I am just reading it for the first time now. Thank you so much for posting the article and your explanation of the two mutually exclusive statements. Crypto is just about the coolest thing I have ever heard of and I love learning about different types of attacks!

explorigin 12y ago
This is not a "good" article. It's very hand wavey with lots of fud. For example, he talks about the chicken and egg problem of delivering javascript over an insecure connection and then solves it later with SSL/TLS (but he doesn't acknowledge that this is a valid solution). Furthermore, we're all harping on javascript when you can't download PuTTY over an SSL connection. He talks about browser cache but says that javascript can't control it. That doesn't mean it can't be controlled (see MANIFEST file). I could go on, but the point is made, there are answers to the problems raised in the article. They may not be _easy_ (as the article complains some things are complex), but it's security on wildly complex systems...of course it's hard.
- dublinben 12y ago
  >we're all harping on javascript when you can't download PuTTY over an SSL connection This shouldn't matter, and would just provide a false sense of security. You ought to be verifying the signature of any program you're installing before you use it. Since you're running Windows the point is probably moot, but it is possible to install software reasonably securely.
  - jimktrains2 12y ago
    But those sigs are also coming over a non-ssl connection:-p Honestly, whenever you download anything, evne over SSL, you're essentially trusting that the remote computer is not only who you think the computer is, but the person you expect to be controlling it is the only person controlling it. Out-of-band communication built out-of in-person trust are really the only way around that (i.e. trusting someone who trusts the PuTTY devs and gets you the hash/sig).

api 12y ago

Everything this article says is true. That being said, it also applies to any regular application that can be upgraded automatically or that's upgraded at all by a third party. Anything you get off an app store can have its code switched out from under it with minimal and routine or in some cases even no user interaction. All someone has to do is compromise the signing key, which is probably not that hard in many cases.

Scaevolus 12y ago
Scarily true. The amount of damage malicious actors with keys can do is greatly magnified by the auto-update mechanisms that developers love.
- api 12y ago
  I have an app with auto-update, and one day I realized that I had (more or less) root on hundreds of users' machines. I'm not special in this regard. I take fairly strong precautions with my keys: offline storage, encrypted, signing on an air-gapped machine. I'd bet you money that most people aren't so careful. There are probably a lot of secret signing keys sitting in DropBox.
jtheory 12y ago
Sure; but there's a world of difference between communicating with a webapp that claims to protect your privacy even from the NSA (but actually cannot) vs. "any regular application", which makes no such security claims, and from whom savvy users won't expect that kind of protection. People with important information to communicate that they must protect from the powers that be (quite possibly to protect their own lives) will seek out secure methods; at the same time, the powers they're avoiding will be targeting secure communication methods.
- tptacek 12y ago
  This application doesn't protect communications from the owners of the application under any circumstances. Forget about the NSA.