Hacker News Reader

Comment by brian-armstrong | Hacker News Reader

When the party storing the DM controls key storage/exchange, does this matter? If you can't verify the other party's keys are in use, and ensure no other keys are being silently added, this type of encryption is just checking a box.

View on HN

Almost every encrypted app allows users to check their keys via QR code scanning or string comparison. If twitter adopts encryption, I hope they will let users do that.

At this point the same entity controls both key distribution and the messaging channel, so information-theoretically it may seem that encryption becomes pointless because it’s very easy to perform a mitm attack. However, since any user can check their keys (at least in theory), the service cannot mitm _every_ conversation. This prohibits mass surveillance which is good enough.

Aren't you also trusting that their client actually renders all the keys in use though?

I would imagine that for people that actually care (whose threat model involves governments targeting them specifically), then they're aware of all the tradeoffs involved and can make informed decisions (and know how to use more secure, harder to use platforms). For everyone else, I think "e2e encrypted by maybe twitter is lying to you" is no worse than the current state of play.

We do, but that would require the company to lie about what they are doing with the app. At Twitter's scale it's very possible that someone would notice and leak that.

The goal as I imagine it is to go from "Hundreds of Twitter employees can definitely access my messages today and anything I've sent and received up until now" to "Twitter will likely need to perform a MITM attack to read my messages starting from the moment when the attack was performed. Maybe they have a secret backdoor, but it's probably too valuable to use on my cat photos".

You mean like leaking the collusion between certain parties to down-rate certain other parties using a secret algorithm?

It would only take a couple of people I'm key positions to accomplish it.

If it's just about internal access, how is it any different from implementing access controls? Put another way, at Twitter's scale, any employee access to production data is intentional.

Correct, but with everything in plaintext one just needs to read a file stored somewhere in a database. With encryption, one needs to perform an active attack.

Nobody wants to MITM every conversation, they want to MITM the conversations of valuable targets. This can be done at scale without breaking any cryptosystem, and with low probability of detection, by a well-resourced actor in possession of private keys that are ostensibly controlled by Apple and/or Google.

No prizes for guessing entities that fit this description.

There's implementations where it would work, be effective, or be both.

It all depends on what the key material is protected with at that point. If it's something provided client side and is transmitted securely, and used blindly, then it would work. Anything short of that would probably trigger my curiosity.

Edit: This kind of statement also needs to b prepended with who you're trying to protect yourself from, because that entirely changes the game.

Edit: There's also key exchange (and derivation) that could happen and impact the effectiveness of this process.

If the client is entirely in the browser, it doesn't particularly matter if they give you some keys to scan. You don't know what it's actually doing, or how the keys are generated.

It would need to encrypt the messages in the browser before they are sent, for a start.

Reply on news.ycombinator.com