Re:Jeff Bezos's phone 'hacked by Saudi crown prince'
by bitL on Wednesday January 22, 2020 @11:26AM
(#22118899)
Signal protocol might be airtight but nobody knows if any part of an app that is built on top of it doesn't leak keys somewhere in the pipeline. All crypto protocols work under certain assumptions and no protocol is 100% secure from all possible misuses when Mallory owns certain portions of infrastructure.
[ Parent
| on HN ]
Re:Jeff Bezos's phone 'hacked by Saudi crown prince'
by UncleMeat on Wednesday January 22, 2020 @12:11PM
(#22119507)
Of course they do. Reading bytecode is not much harder than reading source. Even reading decompiled binaries isn’t so hard.
There is zero compelling reason to believe that signal is uniquely flawed.
Re:Jeff Bezos's phone 'hacked by Saudi crown prince'
by bitL on Wednesday January 22, 2020 @12:25PM
(#22119707)
Outside Signal app, if e.g. I incorporate the protocol to my own app via the provided source code, am I prevented from leaking keys?
Re:Jeff Bezos's phone 'hacked by Saudi crown prince'
by tptacek on Wednesday January 22, 2020 @01:12PM
(#22120236)
Exactly what is your point? Durov is talking about Signal, not some hypothetical application you came up with to leak keys.
Re:Jeff Bezos's phone 'hacked by Saudi crown prince'
by bitL on Wednesday January 22, 2020 @04:16PM
(#22122129)
Wasn't he talking about WhatsApp that integrates Signal protocol? Asking if integrating protocol allows the "host" app to leak keys is completely valid.
Re:Jeff Bezos's phone 'hacked by Saudi crown prince'
by UncleMeat on Thursday January 23, 2020 @10:58AM
(#22128528)
Again, reading bytecode is not hard. Even reading decompiled binaries isn't very hard. If WhatsApp was leaking keys on the side it wouldn't be too difficult to find, especially given how incredibly high profile it is as a target.
Open source vs closed source is not meaningful here.