[personal profile] mjg59
Moxie, the lead developer of the Signal secure communication application, recently blogged on the tradeoffs between providing a supportable federated service and providing a compelling application that gains significant adoption. There's a set of perfectly reasonable arguments around that that I don't want to rehash - regardless of feelings on the benefits of federation in general, there's certainly an increase in engineering cost in providing a stable intra-server protocol that still allows for addition of new features, and the person leading a project gets to make the decision about whether that's a valid tradeoff.

One voiced complaint about Signal on Android is the fact that it depends on the Google Play Services. These are a collection of proprietary functions for integrating with Google-provided services, and Signal depends on them to provide a good out of band notification protocol to allow Signal to be notified when new messages arrive, even if the phone is otherwise in a power saving state. At the time this decision was made, there were no terribly good alternatives for Android. Even now, nobody's really demonstrated a free implementation that supports several million clients and has no negative impact on battery life, so if your aim is to write a secure messaging client that will be adopted by as many people is possible, keeping this dependency is entirely rational.

On the other hand, there are users for whom the decision not to install a Google root of trust on their phone is also entirely rational. I have no especially good reason to believe that Google will ever want to do something inappropriate with my phone or data, but it's certainly possible that they'll be compelled to do so against their will. The set of people who will ever actually face this problem is probably small, but it's probably also the set of people who benefit most from Signal in the first place.

(Even ignoring the dependency on Play Services, people may not find the official client sufficient - it's very difficult to write a single piece of software that satisfies all users, whether that be down to accessibility requirements, OS support or whatever. Slack may be great, but there's still people who choose to use Hipchat)

This shouldn't be a problem. Signal is free software and anybody is free to modify it in any way they want to fit their needs, and as long as they don't break the protocol code in the process it'll carry on working with the existing Signal servers and allow communication with people who run the official client. Unfortunately, Moxie has indicated that he is not happy with forked versions of Signal using the official servers. Since Signal doesn't support federation, that means that users of forked versions will be unable to communicate with users of the official client.

This is awkward. Signal is deservedly popular. It provides strong security without being significantly more complicated than a traditional SMS client. In my social circle there's massively more users of Signal than any other security app. If I transition to a fork of Signal, I'm no longer able to securely communicate with them unless they also install the fork. If the aim is to make secure communication ubiquitous, that's kind of a problem.

Right now the choices I have for communicating with people I know are either convenient and secure but require non-free code (Signal), convenient and free but insecure (SMS) or secure and free but horribly inconvenient (gpg). Is there really no way for us to work as a community to develop something that's all three?
From: [personal profile] mjh75
I just looked at my IRC logs and it would seem that you're in #coreos on freenode, which is a channel which is exposed into Matrix as #freenode_#coreos:matrix.org (thanks to folks like M-hash accessing the channel over Matrix). Whilst you may not have directly communicated with M-hash there, it does mean that you are (very) indirectly utilising Matrix already to communicate with folks.

However, both Hangouts and IRC are obviously not end-to-end encrypted (unless you layer it on top). So if you want the convenience of communicating to bridged users, you necessarily end up exposing plaintext and metadata at the gateway. So I guess this is a scenario where the tryptic of convenience/security/freedom breaks down at the expense of security. I'd still argue that one can still achieve security in a Matrix world without significantly compromising convenience by saying "hey, M-hash, any chance you can use an E2E capable client (e.g. a native matrix client like Vector or WeeChat, or a (currently) hypothetical axolotl-compatible 3rd party client like Signal, WhatsApp, Wire etc should they ever be bridged into Matrix.). You'd then continue the conversation in an encrypted room, and achieve the trifecta :)

In terms of Hangouts: nobody's written a hangouts bridge for Matrix yet; i'm not sure why as it'd be trivial to take one of the 3rd party libraries and hook it up. We're still quite early on in the process of building out bridges ourselves, but contribs from anyone reading this would be enormously welcome!
From: (Anonymous)
Except it'd be trivial to downgrade to plaintext by a state or corporate level adversary; simply intercept the connection and say "no, my client does not have these capabilities".
From: [personal profile] mjh75
E2E admittedly isn't deployed yet on Matrix (https://matrix.org/jira/browse/SPEC-162 has the gory details; we've written the ratchet but not finished the key management & UX stuff yet), so my answer here is somewhat speculative. However, the current design is that Matrix-connected rooms have immutable E2E configuration. It is *not* performed as a capability mechanism p2p between clients.

So, if I want to reliably converse with you with E2E encryption, I'd create a room whose initial event bakes in the requirement to use a given ratchet (Olm), with whatever PFS semantics are desired (e.g. advance the ratchet for every message and discard ephemeral keys => PFS, or perhaps only advance the ratchet on demand, to deliberately allow 'epochs' of history to be replayed on new devices or to new members of the room). If a room has E2E enabled, any plaintext content is ignored by well-behaving clients. The reason for making encryption state of a room immutable is largely to simplify the design.

Therefore an adversary cannot downgrade to plaintext within an existing room, or masquerade a plaintext room as an encrypted one. The most likely attacks are:

a) if a malicious client or bridge is invited to an encrypted room, which then participates in the E2E ratchet but then leaks the data elsewhere (e.g. by bridging to plaintext endpoints or publishing client logs to the web),
b) if a remote client is MITM'd and fingerprint confirmation checks fail. We've not decided yet how to do fingerprint confirmation for the public identity keys, but obviously some kind of OOB check is needed to confirm the identity of who you're talking to.


Matthew Garrett

About Matthew

Power management, mobile and firmware developer on Linux. Security developer at Google. Ex-biologist. @mjg59 on Twitter. Content here should not be interpreted as the opinion of my employer.

Expand Cut Tags

No cut tags