RE: https://mastodon.world/@signalapp/116478659183004819
This is a good thread. I like how carefully they take responsibility for where they could have done better, and at the same time very clearly state what isn't a problem with Signal.
Timeline
Post
Remote status
Context
12Like, it's both very true that a phishing attack against Signal users isn't a vulnerability with Signal, and that given the high value of Signal accounts, they can and should do more to proactively resist phishing attacks. They don't let either one of those truths overshadow the other, and good on 'em.
@xgranade
it kinda is an issue with #signal tho.
they've been training users to fall for re-register #scams by constantly prompting users to re-enter your #PIN (and the PIN is only necessary because phone numbers are used for sign-up).
#signal are good at #victimblaming whenever there's a security incident.
they've been training users to fall for re-register #scams by constantly prompting users to re-enter your #PIN (and the PIN is only necessary because phone numbers are used for sign-up).
No, the PIN is required to reacquire the account if you lose all connected devices. If they used any other unique identifier as the account handle, the PINs would still be required.
@david_chisnall @xgranade
yes, exactly: #PIN is needed to reaqcuire your account — using your #phonenumber! — because without PIN, #signal account data would be vulnerable to #SIMswapattack, right?
@david_chisnall @xgranade
whatever #signal's reasons are for badgering users for a #PIN, it's clearly a design choice they made, because other secure messengers don't do this.
and clearly this design choice has some harmful consequences, which i don't think it's fair of them to just #victimblame away.
whatever #signal's reasons are for badgering users for a #PIN, it's clearly a design choice they made, because other secure messengers don't do this.
The choice is either:
- Periodically ask people to enter their PIN, or
- Deal with people complaining that they forgot their PIN and are locked out (or, ideally not possible):
- Provide an insecure way of recovering an account after you are locked out.
The PIN entry UI looks nothing like an incoming message.
@david_chisnall @xgranade
#signal has now decided to use official release notifications that look almost indistiguishable from a regular chat, just to train users even harder to fall for phishing attacks. 😑
@pelle smh just use Delta Chat and these problems go away
@feld does it have forward secrecy yet?
Also note that Delta chat is not suitable if you need anonymity.
@xconde
> forward secrecy
Autocrypt v2 later this year includes it (and PQC fwiw) with a time-based ratcheting system but also:
Jesus christ this is such a meme. PFS is useless unless you ALWAYS USE DISAPPEARING MESSAGES otherwise there's a plaintext copy still sitting around for an attacker to read when they get control of your devices.
e.g., Signal's PFS was completely broken on iOS for years because the message contents leaked into the Notifications database and were able to be extracted from there. Right now it's broken on MacOS and possibly all desktops because they don't flush the SQLite WAL logs frequently enough so copies of your messages can be extracted from there.
But yes it will get PFS though it's practically useless in the real world because nobody's recording all network traffic and trying to decrypt it later after they recover a key. If they can recover a key, they got control of a device from one of the parties in the conversation. If they have the device, they have your entire chat history. Game Over.
> Also note that Delta chat is not suitable if you need anonymity.
Why? What metadata are you referring to?
> forward secrecy
Autocrypt v2 later this year includes it (and PQC fwiw) with a time-based ratcheting system but also:
Jesus christ this is such a meme. PFS is useless unless you ALWAYS USE DISAPPEARING MESSAGES otherwise there's a plaintext copy still sitting around for an attacker to read when they get control of your devices.
e.g., Signal's PFS was completely broken on iOS for years because the message contents leaked into the Notifications database and were able to be extracted from there. Right now it's broken on MacOS and possibly all desktops because they don't flush the SQLite WAL logs frequently enough so copies of your messages can be extracted from there.
But yes it will get PFS though it's practically useless in the real world because nobody's recording all network traffic and trying to decrypt it later after they recover a key. If they can recover a key, they got control of a device from one of the parties in the conversation. If they have the device, they have your entire chat history. Game Over.
> Also note that Delta chat is not suitable if you need anonymity.
Why? What metadata are you referring to?
@feld thanks for the info. It’ll take me a moment to digest it.
Regarding anonymity/metadata, I’m referring to the inherent connection patterns that can be observed with centralised vs decentralised systems.
Replies
1
@xconde it all depends on various factors.
If I'm in the USA and my relay is in the USA, the gov can seize the server / monitor it pretty easily. If they gain root access to the server than can see the client IP addresses associated with an email address.
If I choose a relay server outside the USA, the gov can't see as much other than my IP address connecting to the server.
If I have multiple relays on my profile, I can just flip between them at will
I can choose to delete/create new addresses on relays as often as I want. (I'm hoping this will be automated soon)
If myself and my peer are sharing the same relay server, whoever compromises that server can see the client IPs of both parties.
This is why it's important if you are sercurity conscious to make sure that
1) you use relays outside your legal jurisdiction
2) you regularly change your relay addresses
3) you and the party you communicate with intentionally choose different relays so a compromise of one relay doesn't expose client IPs of both parties
but that's not really a high bar for someone who is especially security conscious. It's pretty easy to do.
If I'm in the USA and my relay is in the USA, the gov can seize the server / monitor it pretty easily. If they gain root access to the server than can see the client IP addresses associated with an email address.
If I choose a relay server outside the USA, the gov can't see as much other than my IP address connecting to the server.
If I have multiple relays on my profile, I can just flip between them at will
I can choose to delete/create new addresses on relays as often as I want. (I'm hoping this will be automated soon)
If myself and my peer are sharing the same relay server, whoever compromises that server can see the client IPs of both parties.
This is why it's important if you are sercurity conscious to make sure that
1) you use relays outside your legal jurisdiction
2) you regularly change your relay addresses
3) you and the party you communicate with intentionally choose different relays so a compromise of one relay doesn't expose client IPs of both parties
but that's not really a high bar for someone who is especially security conscious. It's pretty easy to do.