6 ms·

Actually that's not what I'm saying at all. I'm critiquing the implementation of this for several reasons: -The JS crypto can be trivially MiTMed. Your approac

Actually that's not what I'm saying at all. I'm critiquing the implementation of this for several reasons: -The JS crypto can be trivially MiTMed. Your approach of checksumming the JS you outlined in another comment using external servers is laughably terrible -The OTR is pointless. The keys aren't being verified so, again anyone could MiTM the key exchange and trivially intercept messages, even if there was no JS. This is the main point of the app, and it's completely broken. -The entire application is relying on the security of the TLS PKI, which is horribly, horribly broken. This opens it up to attack by a huge number of people. -It's being run on a shared server, with access to the keys by the real owners. Not to mention VM memory-leaking attacks by other residents, etc. Having your entire application logic hosted online and delivered to your users every time they access the service has security ramifications, whether you'd like to believe it or not. So basically what YOU'RE saying is trusting 1 developer and trusting millions of people is the same because at some point you cannot verify every bit in the executable. Using browser crypto is worse than executables for the same reason PFS is better than non-PFS, you can't retro-actively hack or MiTM something. If both parties already have the executables stored locally (or delivered securely by an offline medium like USB stick and verified) the only way to intercept the data is compromise both end-points. TL;DR your hyperbolic "trust as slippery slope" argument is dumb

williamcotton 12y ago
All I'm doing is defending use cases for the Web Crypto API. Your arguments are just as hyperbolic, BTW. Meeting up in person with USB sticks for software updates? And questioning the security of TLS? And is JS checksumming more or less laughably terrible than publishing a checksum of an executable on a web site? And does your JS MiTMed scenario depend on broken TLS? You're going to need to do more than just call something "laughably terrible". I'd prefer if you took the conversation about JS checksumming to the specific thread so as to not complicate things. Software will always have updates and they happen automatically with increasing frequency on consumer computing environments like iOS, Mac and Windows. BTW, just who are you anyways and why are you so intent on making me look like a fool for attempting to discuss viable web-based cryptography? I see that your user account is brand new. Why would anyone be pursuing the Web Crypto API? Have you broached these issues with the W3C working groups? Don't you think they'd like to know that their work is futile? Shouldn't some manager on the Chrome team have stopped them from implementing such a pointless protocol? And no, I don't think "trust as slippery slope" is a stupid argument because we have to deal with that issue every day with every aspect of consumer computing. With all of the security holes in Windows, TLS, OpenSSL, SSH and in practically every other day-to-day usage of crypto... yet somehow people can still safely and securely do all sorts of things. There is a spectrum between "totally secure" and "usable by normal people". Your refusal to acknowledge this spectrum is asinine and attacking me for mentioning it is uncalled for. Wanna talk about trust? I don't trust you and I don't trust your approach to these arguments. I don't trust your faux-elite sounding hacker nickname. Maybe you or who you work for is threatened by the average person having end-to-end encryption in web applications? Maybe you're a marketer who needs that data. Maybe you're the NSA. Maybe you want to come across as an all-knowing crypto guru and charge obscene hourly rates to companies who you've scared shitless. Maybe you're just a troll armed with the same tired old arguments I've been hearing for years. Who knows. Again, you're using a brand new account. No one knows who you are or what your agenda is... "trust as slippery slope" indeed...
- deleted 12y ago
  [deleted]
- upperechelon 12y ago
  I find it hilarious you're still fixated on the idea of the trust chain and haven't addressed any of my actual points about the crypto, besides making a lot of hand-waving and saying "well it's not secure, BUT NOTHING'S SECURE SO THAT MEANS IT'S GOOD ENOUGH". This is not end-to-end, the OTR is broken and doesn't verify keys, end of discussion. The JS can be MiTMed, end of discussion. >And questioning the security of TLS? No, I'm questioning the TLS PKI which is what this is dependant on, please learn the difference. Currently any CA or anyone who hacks a CA will be able to make a fake cert, which has happened many many times. Everyone from Bruche Schneier and Moxie Marlinspike condemn the CA PKI, in fact according to Schneier it will cost only ~$700,000 by 2015 to make a SHA-1 collision and produce a fake certificate without any hacking at all. This is why real security solutions use pinned certificates. Blindly putting your faith in SSL/TLS to accomplish all your goals is really, really dumb. There have been several MAJOR (CRIME, BREACH, POODLE, Heartbleed, CCS) attacks against it in the last 3 years alone. >You're going to need to do more than just call something "laughably terrible" There's a reason no one else does this, because it's insecure and unsustainable. Someone could just detect your monitoring servers requests and serve it a 'good' version. Or better yet, only serve a 'bad' version to the people it wants to target. Or just DDoS your monitoring server. If they have the capabilities to intercept the TLS requests to Cyph then what's stopping them from intercepting the requests to your extrnal server? I think what you fail to understand is the interception would probably be client-side, not server-side. Not to mention every time your code actually changes you have to go manually verify that it's correct and not an attack. You're essentially hand-rolling your own signature scheme based on extremely shaky ground. You're going to need to do more than just conjuring up your own amateur solutions and dismissing all security concerns out of hand because "doesn't have to be perfect". >There is a spectrum between "totally secure" and "usable by normal people". Your refusal to acknowledge this spectrum is asinine and attacking me for mentioning it is uncalled for. Where did I do that exactly? You're also implying something can either be secure or useable. I acknowledged there is a spectrum of security, like I said earlier this is marginally better than talking over Facebook. In fact Facebook might be a little more secure because it has a dedicated security team that monitors intrusions. Ignoring the JS problems and the hosting problems, the end-to-end crypto doesn't verify keys, which makes it useless. It's like using a self-signed cert for your message encryption. If that's your line in the sand for "secure enough" than go right ahead and use this, but marketing it as private is irresponsible and deceptive. >With all of the security holes in Windows, TLS, OpenSSL, SSH and in practically every other day-to-day usage of crypto... yet somehow people can still safely and securely do all sorts of things Yes, because they were lucky or oblivious to the fact they got owned. This is like saying "I leave my car doors unlocked all the time and it hasn't been stolen yet" >Maybe you're the NSA. Maybe you want to come across as an all-knowing crypto guru and charge obscene hourly rates to companies who you've scared shitless. Maybe you're just a troll armed with the same tired old arguments I've been hearing for years. Who knows. Again, you're using a brand new account. No one knows who you are or what your agenda is. Ad hominem mixed with a little tinfoil, I like it. Maybe you and Cyph are the NSA and are in collaboration to promote broken crypto to the masses? Or does the fact that you self-aggrandize by using your real name on HN make you legitimate? Maybe you're a design-centric know-nothing who thinks that WebCrypto means "insta presto! the cloud is secure now! web 4.0 everything because 'it just works'" ?

williamcotton 12y ago

All I'm doing is defending use cases for the Web Crypto API. Your arguments are just as hyperbolic, BTW. Meeting up in person with USB sticks for software updates? And questioning the security of TLS? And is JS checksumming more or less laughably terrible than publishing a checksum of an executable on a web site? And does your JS MiTMed scenario depend on broken TLS? You're going to need to do more than just call something "laughably terrible". I'd prefer if you took the conversation about JS checksumming to the specific thread so as to not complicate things. Software will always have updates and they happen automatically with increasing frequency on consumer computing environments like iOS, Mac and Windows. BTW, just who are you anyways and why are you so intent on making me look like a fool for attempting to discuss viable web-based cryptography? I see that your user account is brand new. Why would anyone be pursuing the Web Crypto API? Have you broached these issues with the W3C working groups? Don't you think they'd like to know that their work is futile? Shouldn't some manager on the Chrome team have stopped them from implementing such a pointless protocol? And no, I don't think "trust as slippery slope" is a stupid argument because we have to deal with that issue every day with every aspect of consumer computing. With all of the security holes in Windows, TLS, OpenSSL, SSH and in practically every other day-to-day usage of crypto... yet somehow people can still safely and securely do all sorts of things. There is a spectrum between "totally secure" and "usable by normal people". Your refusal to acknowledge this spectrum is asinine and attacking me for mentioning it is uncalled for. Wanna talk about trust? I don't trust you and I don't trust your approach to these arguments. I don't trust your faux-elite sounding hacker nickname. Maybe you or who you work for is threatened by the average person having end-to-end encryption in web applications? Maybe you're a marketer who needs that data. Maybe you're the NSA. Maybe you want to come across as an all-knowing crypto guru and charge obscene hourly rates to companies who you've scared shitless. Maybe you're just a troll armed with the same tired old arguments I've been hearing for years. Who knows. Again, you're using a brand new account. No one knows who you are or what your agenda is... "trust as slippery slope" indeed...

deleted 12y ago
[deleted]
upperechelon 12y ago
I find it hilarious you're still fixated on the idea of the trust chain and haven't addressed any of my actual points about the crypto, besides making a lot of hand-waving and saying "well it's not secure, BUT NOTHING'S SECURE SO THAT MEANS IT'S GOOD ENOUGH". This is not end-to-end, the OTR is broken and doesn't verify keys, end of discussion. The JS can be MiTMed, end of discussion. >And questioning the security of TLS? No, I'm questioning the TLS PKI which is what this is dependant on, please learn the difference. Currently any CA or anyone who hacks a CA will be able to make a fake cert, which has happened many many times. Everyone from Bruche Schneier and Moxie Marlinspike condemn the CA PKI, in fact according to Schneier it will cost only ~$700,000 by 2015 to make a SHA-1 collision and produce a fake certificate without any hacking at all. This is why real security solutions use pinned certificates. Blindly putting your faith in SSL/TLS to accomplish all your goals is really, really dumb. There have been several MAJOR (CRIME, BREACH, POODLE, Heartbleed, CCS) attacks against it in the last 3 years alone. >You're going to need to do more than just call something "laughably terrible" There's a reason no one else does this, because it's insecure and unsustainable. Someone could just detect your monitoring servers requests and serve it a 'good' version. Or better yet, only serve a 'bad' version to the people it wants to target. Or just DDoS your monitoring server. If they have the capabilities to intercept the TLS requests to Cyph then what's stopping them from intercepting the requests to your extrnal server? I think what you fail to understand is the interception would probably be client-side, not server-side. Not to mention every time your code actually changes you have to go manually verify that it's correct and not an attack. You're essentially hand-rolling your own signature scheme based on extremely shaky ground. You're going to need to do more than just conjuring up your own amateur solutions and dismissing all security concerns out of hand because "doesn't have to be perfect". >There is a spectrum between "totally secure" and "usable by normal people". Your refusal to acknowledge this spectrum is asinine and attacking me for mentioning it is uncalled for. Where did I do that exactly? You're also implying something can either be secure or useable. I acknowledged there is a spectrum of security, like I said earlier this is marginally better than talking over Facebook. In fact Facebook might be a little more secure because it has a dedicated security team that monitors intrusions. Ignoring the JS problems and the hosting problems, the end-to-end crypto doesn't verify keys, which makes it useless. It's like using a self-signed cert for your message encryption. If that's your line in the sand for "secure enough" than go right ahead and use this, but marketing it as private is irresponsible and deceptive. >With all of the security holes in Windows, TLS, OpenSSL, SSH and in practically every other day-to-day usage of crypto... yet somehow people can still safely and securely do all sorts of things Yes, because they were lucky or oblivious to the fact they got owned. This is like saying "I leave my car doors unlocked all the time and it hasn't been stolen yet" >Maybe you're the NSA. Maybe you want to come across as an all-knowing crypto guru and charge obscene hourly rates to companies who you've scared shitless. Maybe you're just a troll armed with the same tired old arguments I've been hearing for years. Who knows. Again, you're using a brand new account. No one knows who you are or what your agenda is. Ad hominem mixed with a little tinfoil, I like it. Maybe you and Cyph are the NSA and are in collaboration to promote broken crypto to the masses? Or does the fact that you self-aggrandize by using your real name on HN make you legitimate? Maybe you're a design-centric know-nothing who thinks that WebCrypto means "insta presto! the cloud is secure now! web 4.0 everything because 'it just works'" ?