Comment by moxie | Hacker News Reader

Comment by moxie | Hacker News Reader

This OTRv3 document has been available since at least 2012(?), so I'm not sure why there's a sudden interest in discussing it, but here was our analysis of OTRv3 at Open Whisper Systems:

1) The introduction of SIGMA in the switch from OTRv1 to OTRv2 significantly reduced the "deniability" properties of OTR. The protocol does some explicit things to provide "full" deniability, but in OTRv3 only people who've actually had a conversation with Alice can produce a complete forged transcript with Alice. More details: https://whispersystems.org/blog/simplifying-otr-deniability

2) OTRv3 doesn't work in asynchronous environments. It depends on a reliable and synchronous transport that delivers messages in-order. The messaging landscape is increasingly asynchronous, so OTRv3 is a difficult fit for modern messaging protocols. More details: https://whispersystems.org/blog/asynchronous-security

3) The OTRv3 "ratcheting" protocol is slow. It uses what we refer to as a "three step ratchet," which provides less-than-ideal forward secrecy and "future secrecy" semantics. More details: https://whispersystems.org/blog/advanced-ratcheting

We sought to improve on OTRv3 by addressing these issues in the TextSecure V2 protocol, which we believe builds on the work of OTR to provide enhanced and simplified deniability, an asynchronous-friendly environment, and optimal forward and future secrecy semantics: https://github.com/WhisperSystems/TextSecure/wiki/ProtocolV2

It also now supports group messaging and multi-device messaging, but we'll cover those in a future blog post.

That is cool and all, but let me explain why I still prefer OTR.

OTR is a library that works with many different clients (pidgin, miranda, irssi etc.). While as far as I know your stuff is pretty much baked in your products. Correct me if i'm wrong please.

And I think that is exactly the problem. I've heard of TextSecure and looked at it, but I never bothered to try it. Because it only seems to work with SMS and MMS (at least that's what it advertizes). Now in Switzerland we have the situation that a single SMS costs still about 10 cents (in USD and CHF). But since I've got a traffic flat obviously I'd prefer to send messages over the internet. I've used WhatsApp in the past, and it really was a great replacement for SMS. But I've uninstalled it over privacy concerns.

I realize I'm kinda going off-topic, but I will take this chance to tell the people who could fix this mess where my problems are.

- TextSecure is still bound by phone number. So you can't use TOR to hide your identity. Since it's using SMS you can't deny you ever talked to someone. Your ISP can disprove that.

- Again - there is no library to just leverage your protocol, even if it's better than OTR.

Why can't we just have federated XMPP servers that use whispersystems crypto protocol and maybe some XMPP extensions or a custom protocol to push from the XMPP server to cellphones without battery drain.

If I could, I would fix this. But I don't trust my crypto skills. I could never design a secure protocol from scratch. So PLEASE create libraries regular devs can use to make the world a better place. (OTR does this! At least I would think I do have enough knowledge to use libotr correctly.)

Edit: Looking at the TextSecure code there is Push Notification stuff. So does this use SMS or a messaging server on the interwebs? I'm actually confused now.

I think the next version of TextSecure will work over the internet.

http://www.cyanogenmod.org/blog/whisperpush-secure-messaging...

It's going to allow secured messaging over the air regardless of medium. Transparently. :)

You should take a look at Threema. That does exactly what you describe afaikt - except XMPP, its a walled garden - using NaCl.

Edit: I should probably elaborate:

- It uses the internet connection to transfer messages

- You can choose not to publicize your phone number and solely exchange keys via QR-codes.

- It uses NaCl which utilizes a permanent Diffie-Hellman key exchange to derive a symmetric key for authenticated encryption. If you can decrypt your messages, then you can forge them.

- There is no desktop client yet, but it is on the far agenda.

- It is not an open protocol.

Personally I don't think XMPP is a good basis for an asynchronous, encrypted network protocol. It is extremely verbose and the extension that would make it tolerable to use with unstable internet connection and multiple clients are not supported by enough clients and servers. Also it misses an encryption standard for asynchronous communication. And again I think OTR is not a good basis for that. For example afaik there are no mechanisms for recipient key selection in a non-interactive way.

PS: I would greatly appreciate some markdown dialect for the Hacker News posts, if only to typeset lists.

Moxie is only one person, and the TextSecure/OpenWhisperSystems team beyond him is pretty small, and they're focusing on a lot of things now. iOS is probably (and rightly so) at the top of their lists.

TextSecure is open-source; you could split out the code you need into a library. You should NOT recommend it as a stable, mature crypto library until several people more intelligent than either of us have vetted it, but you could do a lot of useful work on it.

You'll even get paid for it by the OWS bitcoin-bot, so what are you waiting for?

Oh, shiny! It's been a while since I looked at ts (a previous early version had some issues on my previous phone). If you're doing some work on the protocol level, especially if it's essentially transport-transparent like otr that's fabolous! Would it be useful for email as well?

Reply on news.ycombinator.com