Re:Twilio incident: What Signal users need to know
by daneel_w on Monday August 15, 2022 @03:03PM
(#32473824)
I guess I have to rephrase myself: the API calls are authenticated, because the API endpoints will not consume anonymous requests. I'd be glad if you could point me to documentation proving that the messaging API uses completely different credentials than those for user login, and that the two are also disassociated.
[ Parent
| on HN ]
Re:Twilio incident: What Signal users need to know
by niel on Monday August 15, 2022 @04:12PM
(#32474765)
This doesn't prove anything, but:
> Without authenticating, hand the encrypted envelope to the service along with the recipient’s delivery token.
Source: https://signal.org/blog/sealed-sender/#:~:text=Without%20aut...
The sender's client sends a certificate derived from the recipient's profile key.
This certificate is sent to the server as the header "Unidentified-Access-Key" - you can see how this header is derived from the Signal clients' source.
So yes, these API calls are authenticated, but not using the sender's credentials in any way.
Re:Twilio incident: What Signal users need to know
by melgafin on Monday August 15, 2022 @03:25PM
(#32474111)
Good luck finding documentation about the protocols and APIs used by signal. While every random cryptocurrency has a cryptography whitepaper, it seems that Signal does not.
Re:Twilio incident: What Signal users need to know
by niel on Monday August 15, 2022 @05:08PM
(#32475400)
Signal published detailed specifications of the protocol with reference implementations since at least Feb 2017 (group messaging protocol was added later on): https://signal.org/docs/
The server and clients are open source: https://github.com/signalapp