I like everything Matthew Garrett writes but I can't resist being annoying about this:
Signal has had forward secrecy forever, right? The modern practice of secure messaging was established by OTR (Borisov and Goldberg), which practically introduced the notions of "perfect forward secrecy" and repudiability (as opposed to non-repudiability) in the messaging security model. Signal was an evolution both of those ideas and of the engineering realization of those ideas (better cryptography, better code, better packaging).
What's so galling about this state of affairs is that people are launching new messaging systems that take us backwards, not just to "pre-Signal" levels, but to pre-modern levels; like, to 2001.
1. Core Secrets said the FBI "compelled" companies to secretly backdoor their products. Another leak mentioned fines by FISA court that would kill a company. I dont know if you can be charged or not.
2. They paid the big companies tens of millions to $100+ million to backdoor their stuff. Historically, we know they can also pressure them about government contracts or export licenses. Between 1 and 2, it looks like a Pablo Escobar-like policy of "silver or lead."
3. In the Lavabit trial, the defendant said giving them the keys would destroy the business since the market would know all their conversations were in FBI's hands. The FBI said they could hide it, basically lying given Lavabit's advertising, which would prevent damage to the business. IIRC, the judge went for that argument. That implies the FBI and some courts tell crypto-using companies to give them access but lie to their users.
Just these three facts make me wonder how often crypto in big platforms is intentionally weak by governemnt demand or sloppy because they dont care. So, I consider all crypto use in a police state subverted at least for Five Eyes use. I'll change my mind once the Patriot Act, FISC, secret interpretations of law, etc are all revoked and violators get prosecuted.
There is no such thing as "fines by FISA court". FISA doesn't hear adversarial cases and doesn't have statutory authority or even subject matter jurisdiction to enforce compliance on private actors. FISA is an authorizer for other government bodies, who then use ordinary Article III courts to enforce compliance. Other than the fact that they're staffed by Article III judges and not directly overseen by Article III courts, the FISA court functions like a magistrate court, not a normal court. So: I immediately distrust the source.
People are going to come back and say "well yeah that's just what they tell you about FISA court, but I bet FISA courts fine people all the time", but no, it's deeper than that: private actors aren't parties to FISA cases. It's best to think of them as exclusively resolving conflicts between government bodies.
Bitcoin is great for prospecting, laundering money across borders, and scamming gullible people. It's also easier to hide a stash of stolen bitcoins from the authorities for after you get released from jail than it is to hide a stash of actual money. Bitcoin is certainly no alternative to actual money but it's not entirely useless.
I think these Twitter DMs only does the scamming the gullible part, as you need to pay to use the feature and this is scamming people into thinking they're paying for secure messaging.
Key derivation from a PIN? Although that's an implementation detail of the key backup rather than anything inherent in the actual messaging so who knows.
He didn't say it was Bitcoin style, just that it used "(Bitcoin style) encryption".
I was going to point out that Bitcoin does not use encryption; but technically I think it's signature algorithm (ecdsa) can be thought of as a hashing step, followed by a public-key based encryption step.
So, in the most charitable reading, it using ecliptic curve asymmetric encryption. Presumably for the purpose of exchanging a symmetric key, as asymmetric encryption is very slow. In other words, what basically everything written this decade does. Older stuff would use non EC algorithms, that are still totally fine, but need larger keys and would be vulnerable to quantum computers is those ever become big enough.
> but technically I think it's signature algorithm (ecdsa) can be thought of as a hashing step, followed by a public-key based encryption step.
It really can't. If you're extremely drunk you can think of it as similar to hashing followed by a public-key based decryption step (signing uses the private key, as does decryption) but that's about as good an analogy as calling a tractor-trailer a container ship because both haul cargo. The actual elliptic-curve part of the operation isn't encryption or decryption, and thinking of it as such will lead to error.
RSA does have a simpler correspondence in that the fundamental modular multiplication operation is shared between decryption and signing (or between encryption and verification). But modular multiplication alone isn't secure, it's the "padding" that turns modular multiplication with a particularly-chosen modulus from some basic math into a secure encryption/signature system. And the padding differs, and the correspondence doesn't hold in real systems. RSA without padding is just sparkling multiplication.
Thanks. The top comment there gets pretty technical and ends with:
> ... As noted in the help doc, this isn't forward secure, so the moment they have the key they can decrypt everything. This is so far from being a meaningful e2ee platform it's ridiculous.
ALL roaming SIMs aren't restricted unless the home telecom company cooperates. The roaming traffic passes over a global MPLS network to the home mobile network, so it's not restricted by the national firewalls.
It doesn't mean anything, just sounds cool to people who don't know the tech well enough. Same reason why your HDMI cable is "gold plated for 10x speed!"
Gold plating electrical contacts does at least do something useful though, it helps to prevent oxidization/corrosion. A better analogy would be gold plated TOSLINK cables, which unfortunately do exist.
I can tell you're no connoisseur. Gold-plating a digital connector like HDMI makes sure the zeros are really round and the ones are really pointy. If you have the right setup you can definitely tell the difference.
e2e encryption is easy if everyone knows public keys for everyone else. This is how GPG works for example.
However, the challenge is distributing those keys in a trustworthy way - because if someone can tamper with the keys during distribution, they can MITM any connection.
I assume this "bitcoin style" encryption is a blockchain or blocktree of every users public key now and throughout history. Ship the tree root hash inside the client app, and then every user can verify that their own entry in the tree is correct, and any user can use the same verified tree to fetch a private key for any other user.
We pretty much know this can't be practically done in a distributed way. Even the public federated stores for gpg keys have been flooded so much they stopped being usable.
Maybe? XChat would have to show an established market in commerce in each market that x is infringing that they have an established commercial precense in. Also it's harder if xchat doesn't have a trademark in each of those regions.
Readit News
Signal has had forward secrecy forever, right? The modern practice of secure messaging was established by OTR (Borisov and Goldberg), which practically introduced the notions of "perfect forward secrecy" and repudiability (as opposed to non-repudiability) in the messaging security model. Signal was an evolution both of those ideas and of the engineering realization of those ideas (better cryptography, better code, better packaging).
What's so galling about this state of affairs is that people are launching new messaging systems that take us backwards, not just to "pre-Signal" levels, but to pre-modern levels; like, to 2001.
1. Core Secrets said the FBI "compelled" companies to secretly backdoor their products. Another leak mentioned fines by FISA court that would kill a company. I dont know if you can be charged or not.
2. They paid the big companies tens of millions to $100+ million to backdoor their stuff. Historically, we know they can also pressure them about government contracts or export licenses. Between 1 and 2, it looks like a Pablo Escobar-like policy of "silver or lead."
3. In the Lavabit trial, the defendant said giving them the keys would destroy the business since the market would know all their conversations were in FBI's hands. The FBI said they could hide it, basically lying given Lavabit's advertising, which would prevent damage to the business. IIRC, the judge went for that argument. That implies the FBI and some courts tell crypto-using companies to give them access but lie to their users.
Just these three facts make me wonder how often crypto in big platforms is intentionally weak by governemnt demand or sloppy because they dont care. So, I consider all crypto use in a police state subverted at least for Five Eyes use. I'll change my mind once the Patriot Act, FISC, secret interpretations of law, etc are all revoked and violators get prosecuted.
People are going to come back and say "well yeah that's just what they tell you about FISA court, but I bet FISA courts fine people all the time", but no, it's deeper than that: private actors aren't parties to FISA cases. It's best to think of them as exclusively resolving conflicts between government bodies.
https://inteltoday.org/2020/02/15/crypto-ag-was-boris-hageli...
We've always done this.
I think these Twitter DMs only does the scamming the gullible part, as you need to pay to use the feature and this is scamming people into thinking they're paying for secure messaging.
I was going to point out that Bitcoin does not use encryption; but technically I think it's signature algorithm (ecdsa) can be thought of as a hashing step, followed by a public-key based encryption step.
So, in the most charitable reading, it using ecliptic curve asymmetric encryption. Presumably for the purpose of exchanging a symmetric key, as asymmetric encryption is very slow. In other words, what basically everything written this decade does. Older stuff would use non EC algorithms, that are still totally fine, but need larger keys and would be vulnerable to quantum computers is those ever become big enough.
It really can't. If you're extremely drunk you can think of it as similar to hashing followed by a public-key based decryption step (signing uses the private key, as does decryption) but that's about as good an analogy as calling a tractor-trailer a container ship because both haul cargo. The actual elliptic-curve part of the operation isn't encryption or decryption, and thinking of it as such will lead to error.
RSA does have a simpler correspondence in that the fundamental modular multiplication operation is shared between decryption and signing (or between encryption and verification). But modular multiplication alone isn't secure, it's the "padding" that turns modular multiplication with a particularly-chosen modulus from some basic math into a secure encryption/signature system. And the padding differs, and the correspondence doesn't hold in real systems. RSA without padding is just sparkling multiplication.
Yeah Musk as not very technical person would hardly know the difference.
X's new "encrypted" XChat feature doesn't seem to be any more secure
https://news.ycombinator.com/item?id=44178008
> ... As noted in the help doc, this isn't forward secure, so the moment they have the key they can decrypt everything. This is so far from being a meaningful e2ee platform it's ridiculous.
https://news.ycombinator.com/item?id=44178544
Deleted Comment
Dead Comment
Deleted Comment
What does "Bitcoin style encryption" mean? Isn't Bitcoin mostly relying on cryptographic signatures rather than "encryption" as we commonly know it?
However, the challenge is distributing those keys in a trustworthy way - because if someone can tamper with the keys during distribution, they can MITM any connection.
I assume this "bitcoin style" encryption is a blockchain or blocktree of every users public key now and throughout history. Ship the tree root hash inside the client app, and then every user can verify that their own entry in the tree is correct, and any user can use the same verified tree to fetch a private key for any other user.
Deleted Comment
http://xchat.org/
[0]: https://hexchat.github.io/news/2.16.2.html
Deleted Comment
Deleted Comment