Comment by pilif | Hacker News Reader

Comment by pilif | Hacker News Reader

What the article fails to mention:

1) I would assume Facebook still gets unencrypted access to my address book for use with their shadow profiles

2) We have zero control over what key the client encrypts the messages for. Is it only the other peer's phone? Or is it for the peer's phone plus Facebook for analysis of the messages?

Especially 2) is of some concern to me (against 1 I can't protect myself anyways because if people add me to their address books I'm screwed anyways). From that perspective, I'm still inclined to trust apple's iMessage a bit more especially after recent events.

The only safe solution right now is to compile your own signal client and use that, of course at the cost of reach because nobody else is on Signal.

WhatsApp might be a good compromise at least for only semi-important messages: The probability that any of your contacts has WhatsApp is much, much higher than the probability of them having Signal running. On the other hand, whatever you're sending over WhatsApp is likely going to be used by FB (and then possibly handed out to governments and/or stolen by attackers).

I think this is a reasonable analysis. I would refine it this way (examples are only for illustrative purposes):

Tier 1 secure messengers: all possible tradeoffs in favor of security made; use for worst-case adversaries:

- Signal/TextSecure - Pond - PGP† - OTR

Tier 2 secure messengers: serious secure messaging protocols that make some tradeoffs in favor of adoption and usability; use for normal messages of low sensitivity:

- WhatsApp - iMessage

Tier 3 secure messengers: secure messaging protocols with flaws, limited cryptanalysis, only content-controlled browser clients, &c

- Redacted to avoid flamewars.

Everything else: insecure; use only to bootstrap conversations to a Tier 2 protocol (knowing that if you're a state-level target, you're exposed even after you "upgrade")

- Google Talk - Facebook Messenger - AIM

I think WhatsApp would like to be a tier 1 secure messenger (they'd be the first mainstream tier 1 secure messenger!) and they have a shot at being that, but they're probably some years away from it.

† (I know PGP and OTR are cryptographically limited compared to Signal Protocol, but from an OPSEC perspective they're still a tier above iMessage.)

> - Redacted to avoid flamewars.

Aww... shucks.

My Twitter mentions are noisy enough already this week. :)

I'm assuming Telegram.

Don't forget Ricochet†, it only does synchronous communication but it does solve the problem of leaking meta-data. All the other clients except Pond leak meta-data.

† https://ricochet.im/

Ricochet appears to rely on Tor's encryption, with an additional custom RSA handshake. That's two added levels of "nope" for me, but other people might feel differently.

I can see that but I think the self authenticating nature of Tor Onion Services and therefore bypassing bgp, dns and CA weaknesses is worth something†.

Maybe in the future when prop224†† is implemented the encryption will be more solid.

† https://media.ccc.de/v/32c3-7322-tor_onion_services_more_use...

†† https://gitweb.torproject.org/user/asn/torspec.git/tree/prop...

Stipulate that Tor's encryption is modernized and drastically improved. I still don't think it's a good idea to build a messaging application directly on top of that, for some of the same reasons that it isn't a good idea to simply run a messaging application on top of TLS or Nacl. The service model and security requirements for a simple transport are different from those of a messenger.

That's what's so exciting about the WhatsApp announcement. WhatsApp is by all accounts a pretty great messaging application, and it doesn't just have decent encryption now; it has best in class encryption specifically designed to protect a messaging application, designed by experts who thought about this problem for a long time.

(I've updated the parent about bypassing bgp/dns etc. before I saw your reply)

The nice thing about using the onion address (transport layer) is that you have mandatory e2e authentication with only one id that solves multiple real world problems with bgp/dns/tls.

How would you propose to go further from current state-of-the-art WhatsApp to stop leaking meta-data? I know Ricochet is open to use a stronger encryption layer on top of Tor †.

† https://github.com/ricochet-im/ricochet/issues/72

I would place Signal in the same tier as WhatsApp here (Tier 2). They both upload your contacts to an intermediate server that gives you their public key, which you can optionally verify afterwards.

This means a malicious server could both store away your contacts and try to MITM you, risking detection if you do verify your fingerprint with the other party.

A messenger that really did "all possible tradeoffs in favor of security" would force you to verify the recipient, either in person or via a web of trust. I think not doing that is a perfectly acceptable tradeoff to protect 1 billion users from passive mass surveillance.

These are all UI issues though, the Signal protocol seems solid, and I'll be glad to see it used everywhere. Hopefully we will get clients that you could recommend to a journalist or lawyer and have confidence that they will be able to use it for secure authenticated communication.

That's something that's at least somewhat true of OTR and PGP too, in their normal use, and in all three cases if you're serious about OPSEC you can completely mitigate the problem. So in my evaluation, Signal's a tier 1 option, and WhatsApp is tier 2.

Reasonable people can disagree, of course.

I hope it's obvious that, since OTR is in tier 1, these tiers aren't an analysis of how much I like different messengers. :)

> That's something that's at least somewhat true of OTR and PGP too

Well, OTR is just the protocol, implementations vary in how well they make you authenticate your conversation partner. And PGP will whine at you a lot if you haven't marked a key as trusted. But somewhat agreed. A bad UI can ruin the security of otherwise solid crypto.

I just don't see how the security of Signal and WhatsApp are different. Assuming for a moment (very optimistically) that the user verifies the fingerprint and enables the alert for changed keys, they are using the same protocol with the same guarantees.

Are you factoring in some level of trust in their ability to write a secure client or run secure servers?

Its probably only a half-step up, but signal's client (and server?) are open source. You could compile your own to avoid problems with the binary blob being different. Maybe you could run your own server to dish out keys, but that may be a stretch.

Does signal still rely on Google's marketplace and services being installed?

Yes

> I would place Signal in the same tier as WhatsApp here (Tier 2). They both upload your contacts to an intermediate server that gives you their public key, which you can optionally verify afterwards.

The last time this came up, inspired by a post by pbsd, I submitted a detailed write-up of a protocol Signal could use to avoid requiring users to submit their contact information: https://news.ycombinator.com/item?id=11289223

It's a solved problem.

> A messenger that really did "all possible tradeoffs in favor of security" would force you to verify the recipient, either in person or via a web of trust. I think not doing that is a perfectly acceptable tradeoff to protect 1 billion users from passive mass surveillance.

Except it introduces another point of security failure. I would prefer to use a system like SDSI/SPKI's friend-of-a-friend naming, with a contact-sharing mechanism so that I could, say, know that I was talking to 'Sheila's Dad' or 'My Boss's Jim's Phone' (presented in a somewhat more user-friendly way, maybe 'My Boss → Jim → Phone' or something).

What are WhatsApp's tradeoffs in favor of adoption and usability, compared to Signal?

Signal is pretty simple. Even my relatively technologically illiterate mother uses Signal.

> whatever you're sending over WhatsApp is likely going to be used by FB

The article links to the technical white paper[0] which explains why your points are invalid.

> I'm still inclined to trust apple's iMessage a bit more

Do you have any proof why iMessage is more secure or is that statement also baseless?

[0]: https://www.whatsapp.com/security/WhatsApp-Security-Whitepap...

A white paper is not an implementation. Whatsapp is owned by Facebook and required to increase their bottom line. They are not a charity.

Assuming Facebook is lying isn't a very good technical argument. There are other ways for them to make profit than doing the shady things you are implicitly accusing them of doing without any base.

They spent billions on WhatsApp. I'm open to suggestions - how would they profit on it if all the data that passed through it was opaque to them? Perhaps they are just catering to a recent strong interest by the public in encryption.

The white paper doesn't say anything about additional public keys messages are encrypted for.

It states that:

- The private keys remain on the devices (which is good, but they don't need them to read your messages)

- The messages can't be read by WhatsApp (they don't say anything about their parent company Facebook or governments though).

If you read all the whitepapers and alert messages, you can totally read them in a way that allows Facebook to see, store and analyze the clear-text of every message you're sending, without anybody lying anywhere.

That's actually a good explanation of your point. Thanks.

> From that perspective, I'm still inclined to trust apple's iMessage a bit more especially after recent events.

// edit: got my answer here: https://news.ycombinator.com/item?id=11432629

I'm curious, is that because of what they did in the FBI case, or for technical reasons? IIRC iMessage would allow Apple to add public keys which they (or the FBI/$ADVERSARY) control as a sort-of backdoor as well. I can't say that I've been keeping track of Facebook's position or history on this topic, so it might or might not be fair to say that Apple deserves more trust here, but on a technical level there's not much of a difference.

The unfortunate reality too is that average users will never go to the extra trouble of authenticating keys themselves. I'm also more likely to trust a company like Apple or Google with key management than a "trusted third party" (simply because they're bigger companies, with more valuable brands to protect, and resources to throw at the problem).

So, it feels like for the average consumer, a product like iMessage ticks all the necessary boxes. While WhatsApp adding features like the ability to compare your keys via a QR code looks cool, I have to wonder how many users will actually take advantage (and how would they even know if that number or QR code really represents what they think it does?)

Manual authentication via QR (or comparing the digits) works on top of the server-side authentication. It does what iMessage does, but you also have the option to actually compare the fingerprints if you are so inclined.

The good thing about verification is that if only a few people do it, it already profieds a benefit.

> From that perspective, I'm still inclined to trust apple's iMessage a bit more especially after recent events.

I'm surprised by this statement. After recent events I'd say the imessage protocoll is a weird ad-hoc construction that failed to follow basic modern crypto constructions like authenticated encryption and forward secrecy. I don't expect anything alike from the signal protocol.

The one thing iMessage and WhatsApp have in common is that they both end-to-end encrypt without giving the user control over the keys being used.

So ignoring actual protocol and implementation flaws (I agree with you that WhisperSystems will probably be ahead of Apple there), both rely on the key management being done in a thrustworthy manner.

And this is where I trust Apple more than Facebook, especially in light of the recent FBI events. If Apple says they are not maliciously injecting fake public keys for the purpose of surveillance and marketing, I tend to believe Apple.

If Facebook is silent about this, I assume they are doing it.

WhatsApp allows you to verify keys. Apple doesn't. This makes a pretty big difference.

Also, iMessage's crypto protocol is cryptographically broken. It's been patched together in ways that prevent the obvious attack, but don't actually fix the underlying issue. Doing so involves replacing the protocol. In the mean time, those patches are not fool proof and someone may get around them.

> Whats App allows you to verify keys. Apple doesn't. This makes a pretty big difference.

Does it? It allows me to verify a key. It doesn't give me any ability to control what other keys it's working with.

This only helps me to make sure that the message I just got, I actually got from the person it's claiming to be. It doesn't give me any other protection though.

I agree about the broken iMessage crypto and I hope to see Apple upgrade the protocol in a future OS release. With their quick uptake of new OSes, a fix could propagate relatively quickly.

Reply on news.ycombinator.com