News for hackers. Stuff that matters.

A comment on Serious vulnerabilities in Matrix’s end-to-end encryption are being patched. Parent comment

Re:Serious vulnerabilities in Matrix’s end-to-end encryption... by pvg on Thursday September 29, 2022 @09:01PM (#33029514)
The typical standard for a system that purports to offer cryptographically secure communication to end-users is that it does it by default rather than 'only does it if the user does these specific things otherwise it doesn't'. This isn't some controversial thing or topic of particularly serious debate.
[ Parent | on HN ]
Re:Serious vulnerabilities in Matrix’s end-to-end encryption... by throwawayKiwi9 on Friday September 30, 2022 @02:12AM (#33031554)
I agree wholeheartedly and this is why I use Matrix. The fact that a vulnerabilitiy of this magnitude can largely be defeated with precautions, albeit non ideal, are a real testament to the power of e2e. Hopefully we will see the fixes these non-default settings recommendations very soon.
[ Parent | on HN ]
Re:Serious vulnerabilities in Matrix’s end-to-end encryption... by tptacek on Friday September 30, 2022 @09:40AM (#33034709)
You keep saying that this vulnerability can be defeated by carefully examining warnings. That's simply not true. The vulnerability is that the server, which you're not supposed to trust, can allow unauthorized people to decrypt your messages. The fact that you get a warning when unauthorized people are decrypting your messages is not a "defeat" of the vulnerability!

The bug is that you're owned, not that you didn't get an alert saying that you're owned.

[ Parent | on HN ]
Re:Serious vulnerabilities in Matrix’s end-to-end encryption... by throwawayKiwi9 on Friday September 30, 2022 @02:03PM (#33038363)
Did you skim over the part where there's a toggle to strictly prevent sending messages to unauthorized devices?
[ Parent | on HN ]
Re:Serious vulnerabilities in Matrix’s end-to-end encryption... by tptacek on Friday September 30, 2022 @02:31PM (#33038738)
No, I did not. There are like 7 different horrible vulnerabilities in this paper, and you're talking about a different one (the one where the server can add new devices to people's accounts!) than I am (the one where the server can add random people to your channel, whether they're verified or not).
[ Parent | on HN ]