About backdoors in crypto messengers

Re:About backdoors in crypto messengers by binaryapparatus on Thursday January 19, 2017 @06:28AM (#13434932)

It seems that if you really want proper secure channel you need to write one yourself. Anything out there is subject to being compromised.

Is there open source alternative for Signal?

[ Parent | on HN ]

Re:About backdoors in crypto messengers by vurpo on Thursday January 19, 2017 @09:02AM (#13435785)

Matrix is decentralized, proper open source, modern, has audited end-to-end encryption and all that. Be aware that if you install the Riot app from the Play Store, it uses GCM (which means that client is technically vulnerable to the same attack as described in the article), but if you install it from F-Droid it does not.

One strength of Matrix over Signal is indeed that you are free to choose or develop your own client to use with it. You can also host your own server for the decentralized Matrix network, but that point is kind of orthogonal and not related to this specific issue.

[ Parent | on HN ]

Re:About backdoors in crypto messengers by _0ffh on Thursday January 19, 2017 @06:47AM (#13435027)

You don't have to look far. The actual Signal client source is licensed under GPLv3.

Edit: And server code under AGPLv3.

[ Parent | on HN ]

Re:About backdoors in crypto messengers by em3rgent0rdr on Thursday January 19, 2017 @08:01AM (#13435397)

well LibreSignal was shut down because Moxie didn't like them using WhisperSystem's servers. I guess the libre community could figure out how to setup and fund an alternative server, but since Signal's server code isn't federated, then I don't believe there would be a straightforward way to send messages between the two systems.

https://github.com/LibreSignal/LibreSignal/issues/37#issueco...

[ Parent | on HN ]

Re:About backdoors in crypto messengers by temprature on Thursday January 19, 2017 @09:33AM (#13436032)

> but since Signal's server code isn't federated

The Signal server code has supported federation since the first commit in the git history. Whisper Systems' instance of the server doesn't federate with any other server anymore but there is nothing stopping the LibreSignal crowd from standing up their own network of federation-enabled servers.

[ Parent | on HN ]

Re:About backdoors in crypto messengers by vurpo on Thursday January 19, 2017 @09:04AM (#13435797)

Moxie and Whisper Systems is clearly against decentralization and federation, based on that blog post they wrote. This means it's unlikely that Signal is ever going to have any support for federation.

[ Parent | on HN ]

Re:About backdoors in crypto messengers by temprature on Thursday January 19, 2017 @09:42AM (#13436114)

> This means it's unlikely that Signal is ever going to have any support for federation.

Signal had support for federation. Their server was federated with Cyanogen's for a while[0]. That being the disaster it was is why that blog post happened and no one seems to be forthcoming with solutions to the problems they had.

[0] https://whispersystems.org/blog/cyanogen-integration/

[ Parent | on HN ]

Re:About backdoors in crypto messengers by angry_octet on Thursday January 19, 2017 @08:23AM (#13435545)

Obviously they can run an alternative server, and if their version is sufficiently more attractive people will switch their client.

They could 'solve' all these usability problems, fix the use of google interfaces the tin foil hat brigade detest, and deploy it on a non-existent non-proprietary secure phone platform. Oh and make it federated but keep it immune from spam. Yeah, seems like that is a bit hard.

[ Parent | on HN ]

Re:About backdoors in crypto messengers by em3rgent0rdr on Thursday January 19, 2017 @06:50AM (#13435046)

also on F-Droid you can find "Silence" which is a fork of "Signal" but only for SMS texts.

[ Parent | on HN ]

Re:About backdoors in crypto messengers by jacobush on Thursday January 19, 2017 @07:16AM (#13435162)

True, but you still need to be aware of who your potential adversary is. If it is someone with access to SMS network texts logs, these encrypted texts will light up like a Christmas tree for someone looking for something unusual.

[ Parent | on HN ]

Re:About backdoors in crypto messengers by em3rgent0rdr on Thursday January 19, 2017 @07:56AM (#13435355)

The threat model is that google and cell phone networks are untrusted adversaries. So your same concern can be said about Signal messages going through Google servers under the surveillance of the NSA. Either way the adversary sees a bunch of suspicious encrypted messages, but can't read them. But if the user has proprietary google code installed on their phone (i.e. Google Play Services), then the backdoor which this blog is warning about is the fact that now your phone software is/could be potentially compromised.

[ Parent | on HN ]

Re:About backdoors in crypto messengers by jacobush on Thursday January 19, 2017 @08:15AM (#13435485)

It depends on who you are hiding from. In some freer countries, encrypted texts at most get you flagged on some kind of list. In others you may get enhanced interrogation.

[ Parent | on HN ]

Re:About backdoors in crypto messengers by holri on Thursday January 19, 2017 @06:43AM (#13435003)

from the article: XMPP

[ Parent | on HN ]

Re:About backdoors in crypto messengers by Angostura on Thursday January 19, 2017 @07:39AM (#13435263)

Or use Signal on iOS? (This is a genuine question)

[ Parent | on HN ]

Re:About backdoors in crypto messengers by angry_octet on Thursday January 19, 2017 @08:26AM (#13435563)

This would arguably be more secure. Depends who you trust least I guess, Apple or Google + OEMs. I think Apple has a lot to lose if they were to produce a backdoored firmware. Some android handset contract manufacturer or OEM? Not so much.

[ Parent | on HN ]