I like everything Matthew Garrett writes but I can't resist being annoying about this:
Signal has had forward secrecy forever, right? The modern practice of secure messaging was established by OTR (Borisov and Goldberg), which practically introduced the notions of "perfect forward secrecy" and repudiability (as opposed to non-repudiability) in the messaging security model. Signal was an evolution both of those ideas and of the engineering realization of those ideas (better cryptography, better code, better packaging).
What's so galling about this state of affairs is that people are launching new messaging systems that take us backwards, not just to "pre-Signal" levels, but to pre-modern levels; like, to 2001.
1. Core Secrets said the FBI "compelled" companies to secretly backdoor their products. Another leak mentioned fines by FISA court that would kill a company. I dont know if you can be charged or not.
2. They paid the big companies tens of millions to $100+ million to backdoor their stuff. Historically, we know they can also pressure them about government contracts or export licenses. Between 1 and 2, it looks like a Pablo Escobar-like policy of "silver or lead."
3. In the Lavabit trial, the defendant said giving them the keys would destroy the business since the market would know all their conversations were in FBI's hands. The FBI said they could hide it, basically lying given Lavabit's advertising, which would prevent damage to the business. IIRC, the judge went for that argument. That implies the FBI and some courts tell crypto-using companies to give them access but lie to their users.
Just these three facts make me wonder how often crypto in big platforms is intentionally weak by governemnt demand or sloppy because they dont care. So, I consider all crypto use in a police state subverted at least for Five Eyes use. I'll change my mind once the Patriot Act, FISC, secret interpretations of law, etc are all revoked and violators get prosecuted.
There is no such thing as "fines by FISA court". FISA doesn't hear adversarial cases and doesn't have statutory authority or even subject matter jurisdiction to enforce compliance on private actors. FISA is an authorizer for other government bodies, who then use ordinary Article III courts to enforce compliance. Other than the fact that they're staffed by Article III judges and not directly overseen by Article III courts, the FISA court functions like a magistrate court, not a normal court. So: I immediately distrust the source.
People are going to come back and say "well yeah that's just what they tell you about FISA court, but I bet FISA courts fine people all the time", but no, it's deeper than that: private actors aren't parties to FISA cases. It's best to think of them as exclusively resolving conflicts between government bodies.
> In some circumstances, nongovernmental parties may litigate the lawfulness of FISA orders or directives to provide information or assistance to the government. For example:
> A private company or individual that has been served with a directive to assist in acquiring information under Section 702 may petition the FISC to modify or set aside the directive. Conversely, the government may petition the FISC to compel the recipient to comply with the directive.
> In responding to the government’s petition, the private party has the opportunity to show cause for the noncompliance or argue that the order should not be enforced as issued.
> In 2007, Yahoo! Inc. refused to comply with directives issued by the government under provisions of FISA that have been replaced by Section 702. The government filed a motion with the FISC to compel compliance.
The warrants the court issues do apply to private parties. Failure to comply with a warrant is contempt of court and the court can compel compliance by fines and other sanctions. You can read what that looks like in this FISA court ruling against Yahoo.
It was a big company that said they'd be fined per day for non-compliance with mass surveillance. Core Secrets etc says that was done by FBI for FISA warrants. So, whoever enforces that.
I dont know the mechanics of it, like jurisdiction. It might be as you say. I just know they and their targets were both clear at different times they could force a company to do it.
Why? Do you think many people would want to develop from their phones instead of PCs if that was an option? I've certainly never wanted to.
You can actually run a desktop VM on a phone pretty easily (I even run a Windows one, for games) so I wouldn't say I feel a restriction in my software freedom.
Bitcoin is great for prospecting, laundering money across borders, and scamming gullible people. It's also easier to hide a stash of stolen bitcoins from the authorities for after you get released from jail than it is to hide a stash of actual money. Bitcoin is certainly no alternative to actual money but it's not entirely useless.
I think these Twitter DMs only does the scamming the gullible part, as you need to pay to use the feature and this is scamming people into thinking they're paying for secure messaging.
Key derivation from a PIN? Although that's an implementation detail of the key backup rather than anything inherent in the actual messaging so who knows.
He didn't say it was Bitcoin style, just that it used "(Bitcoin style) encryption".
I was going to point out that Bitcoin does not use encryption; but technically I think it's signature algorithm (ecdsa) can be thought of as a hashing step, followed by a public-key based encryption step.
So, in the most charitable reading, it using ecliptic curve asymmetric encryption. Presumably for the purpose of exchanging a symmetric key, as asymmetric encryption is very slow. In other words, what basically everything written this decade does. Older stuff would use non EC algorithms, that are still totally fine, but need larger keys and would be vulnerable to quantum computers is those ever become big enough.
> but technically I think it's signature algorithm (ecdsa) can be thought of as a hashing step, followed by a public-key based encryption step.
It really can't. If you're extremely drunk you can think of it as similar to hashing followed by a public-key based decryption step (signing uses the private key, as does decryption) but that's about as good an analogy as calling a tractor-trailer a container ship because both haul cargo. The actual elliptic-curve part of the operation isn't encryption or decryption, and thinking of it as such will lead to error.
RSA does have a simpler correspondence in that the fundamental modular multiplication operation is shared between decryption and signing (or between encryption and verification). But modular multiplication alone isn't secure, it's the "padding" that turns modular multiplication with a particularly-chosen modulus from some basic math into a secure encryption/signature system. And the padding differs, and the correspondence doesn't hold in real systems. RSA without padding is just sparkling multiplication.
Thanks. The top comment there gets pretty technical and ends with:
> ... As noted in the help doc, this isn't forward secure, so the moment they have the key they can decrypt everything. This is so far from being a meaningful e2ee platform it's ridiculous.
ALL roaming SIMs aren't restricted unless the home telecom company cooperates. The roaming traffic passes over a global MPLS network to the home mobile network, so it's not restricted by the national firewalls.
It doesn't mean anything, just sounds cool to people who don't know the tech well enough. Same reason why your HDMI cable is "gold plated for 10x speed!"
Gold plating electrical contacts does at least do something useful though, it helps to prevent oxidization/corrosion. A better analogy would be gold plated TOSLINK cables, which unfortunately do exist.
A lot of quack tech is technically somewhat useful. Oxygen-free copper, occasionally used in "audiophile" cables - technically is a better electrical conductor (compared to regular copper), by a whooping low single-digit %.
Exact same effect could be achieved by making conductor that very same single-digit % thicker. Which is an order of magnitude cheaper. And ohmic resistance is not that important for audio-cables anyway.
Sure, but we were talking about high-speed digital cables, not audio cables. When you're pushing 48gbps over copper (as in HDMI 2.1) the cable construction and connection integrity absolutely does matter, older HDMI cables don't work reliably at those speeds (if at all) despite having exactly the same pinout as the newer ones.
Gold-plating of contact surface of electric connectors is indeed genuinely useful, on account of preventing contact oxidation.
Assuming good contact in connector(s) is achieved, gold-plating does not further help with high-speed signals. What matters here - is wire/cable itself, specifically, tight control over where conductors are relative to each other and insulation, so that impedance is well matched throughout, cross-talk is minimized, etc, etc...
I can tell you're no connoisseur. Gold-plating a digital connector like HDMI makes sure the zeros are really round and the ones are really pointy. If you have the right setup you can definitely tell the difference.
e2e encryption is easy if everyone knows public keys for everyone else. This is how GPG works for example.
However, the challenge is distributing those keys in a trustworthy way - because if someone can tamper with the keys during distribution, they can MITM any connection.
I assume this "bitcoin style" encryption is a blockchain or blocktree of every users public key now and throughout history. Ship the tree root hash inside the client app, and then every user can verify that their own entry in the tree is correct, and any user can use the same verified tree to fetch a private key for any other user.
The idea is to only distribute the root of the tree to a client, query the server for the username you want to look up, which then returns the key and a short proof that this username maps to that key within the hash tree identified by the known root.
If the service provider (ie. the X.com servers) are evil, then the API can return false data and the client has no way to know.
However, with a merkle tree, the root hash is embedded into the app, and the servers return the data together with info chaining to the merkle root (typically a few kilobytes, even if the whole tree is hundreds of gigabytes).
With that info, the app can verify the chain to the root and be sure that the servers aren't returning false data.
It can be done with Merkel trees. You just ship the root hash.
Merkel trees are snapshot/read only though - so you then use a bitcoin style Blockchain to ship refreshed versions of the root tree hash (you can even ship it in the actual bitcoin Blockchain if you like, piggybacking on its proof of work to ensure different people don't see different root hashes)
Parent comment writes: "ship[ing] the tree root hash", for a merkle tree ("bitcoin style") this would just be a single (small) hash no matter the tree size, i.e. 32 bytes is enough.
We pretty much know this can't be practically done in a distributed way. Even the public federated stores for gpg keys have been flooded so much they stopped being usable.
Maybe? XChat would have to show an established market in commerce in each market that x is infringing that they have an established commercial precense in. Also it's harder if xchat doesn't have a trademark in each of those regions.
I do find it funny that the library Twitter is using (according to TFA anyway) self-describes itself as:
> Caution
> Experimental library!
and
> While this library is just a wrapper around the well known Libsodium library it still comes with high potential of introducing new attack surfaces, bugs and other issues and you shouldn't use it in production until it has been reviewed by community.
Given that Signal is pushing new code updates all the time, isn't it trivial for them to push new binaries that harvest messages/keys/whatever-they-want?
Their client is open source and is routinely audited. Their Android builds are fully reproducible. You can also build and run the app yourself if you want instead of downloading it from the app stores. It is virtually impossible for them to ship a backdoor, at least on Android, without the security community noticing.
What exactly prevents them from doing a Windows build with an non-published change, signing it with the keys they control, and pushing it to an individual client through the upgrade servers which they control?
There is a window of vulnerability between a theoretically malicious update being pushed and the security community noticing that it doesn't correspond to a build of the published source. That might only be a few hours, or even minutes - but milliseconds would be enough to do most of its work.
Correct me if I'm wrong here -- let's say the Signal folks are breached or have been secretly waiting for just the right moment to push out some malicious code. How would they coordinate rolling it out to client devices to take advantage of that gap? I mean, depending on what the exploit was, they might be able to whack some percentage of users -- but it would be caught fairly quickly. I'm curious what sort of attack you're theorizing that would be worthwhile here.
Noticing something and reacting to it are very different things. Signal could fairly trivially grab all historical data for all online users within a fairly limited window. However it would be a one off event so the value proposition of such an act is dubious.
What's especially frustrating about all of these "Signal could flip a switch and steal everybody texts!" histrionics is that if they were interested in doing that they... wouldn't work at Signal. They'd go join/start the hundreds of other companies we've heard of in the past few years that have stored/leaked incredibly sensitive data with an insignificant fraction of the effort Signal have put in to establishing their credibility (the TeleMessage scandal being just the latest). People should hold Signal accountable, constantly, forever. But the baseless FUD is frankly hysterical from a forum of ostensible technologists.
This comment does not follow the context of the discussion.
Circling back up. Article author: Twitter might be untrustworthy and could bruteforce your keys. Use Signal.
Me: That's unreasonable. You also have to trust Signal.
Your answer just now: Why are people picking on Signal?!?
In fact, what the world really needs, rather than 3rd-party controlled encrypted messaging solutions like Twitter and Signal, is public apis for public key cryptography on non-trusted infrastructure, not tied to single groups. Everybody knows this. The reason that we instead have bodies like Signal -- a company that just so happens to tie every encrypted message to a real phone number and real human identity for no easily explained reason -- and the reason we have people who surely know better defending bodies like Signal in public, is an exercise left for the reader.
They control the update servers. So it's possible to target a single user with a single build that no one else ever sees. What percentage of users verify every release?
In theory, Binary Transparency (https://binary.transparency.dev/) solves that among other things. To pass verification, an update has to prove that it's included in a public log of releases.
Sure, but only if you are blindly auto installing every update as soon as it is pushed. All you have to do to protect yourself is download the bundle, run a checksum and then install it.
> It is virtually impossible for them to ship a backdoor [..] without the security community noticing.
OpenSSH was trivially backdoor'd [1] and distributed in several major distributions and the security community _did not_ notice until after it was already wild.
1) That was not "trivial", by any stretch of the definition. It was a 3-year long campaign by a (suspected to be) nation-state (or similarly resourced) actor! I don't think you can get any farther away from "trivial" if you tried.
2) From your link, it says: "Ubuntu 24.04LTS was a month away from being shipped with this backdoor, with other distros being on the same boat. Maybe the best way to describe it is this: had it gone undetected, Linux servers would have been running with a bomb waiting to be activated remotely." and "Luckily this backdoor was discovered in an early stage, and most of the Linux user community stays safe"
That was an attack targeting an optional dependency that receives significantly less scrutiny than OpenSSH proper. Which to be fair, is probably also the most plausible path if you wanted to attack Signal.
If your HW/OS doesn't allow verification of binaries, but your threat model requires doing that, then you need to use proper HW/OS that allows the verification. Also, iOS is proprietary so who knows what the OS is doing anyway. Also, this https://thehackernews.com/2014/01/DROPOUTJEEP-NSA-Apple-iPho...
If you are in the EU you can build the app from source and sideload it on your phone. Everyone else is out of luck. So yeah, either Signal or Apple can insert a backdoor into the app.
>...you're still relying on the Twitter server to give you the public key of the other party and there's no out of band mechanism to do that or verify the authenticity of that public key at present.
...
>Signal doesn't have these shortcomings. Use Signal.
Dunno that Signal is a really good counterexample for this particular aspect of E2EE messaging. The option exists to compare a 60 digit decimal number but the usability of this feature is such that most users don't even know that this is something they have to do. Just having a feature is not valuable if no one knows that feature exists and have no idea what any of it means.
I like the approach used by Briar Messenger. They just have the user use the number that represents identity in the system. There is no misleading feature that maps a phone number to the actual cryptographic identity. This makes it much harder for the user to unknowingly use the system in an unsafe way. A Briar identity looks like this:
"X" is a _terrible_ name; in a headline it looks like someone forgot to fill out a template.
Twitter wouldn't be the first rebrand where people just decide they're not going to bother with this. Notably, there the odd year or so where the Royal Mail attempted to rebrand to 'Consignia' (in the alternate universe where the Iraq War didn't happen, this would be what everyone remembered about the Blair era), and Netflix's attempt, some years before scrapping it entirely, to rename its DVD delivery business to 'Quikster'.
Interestingly, Apple (then Apple Computer) themselves fell afoul of this; they were repeatedly sued by Apple Corps (The Beatles' record label) over their name.
I keep calling it Twitter, and urge everyone else to do so, because "twitter" is a better search term than "x", especially if you are using a search that doesn't let you specify word match.
Sorry, but I use a search engine where I can specify "site:x.com" for example, or better yet, "site:m.xkcd.com", and it shows me exclusively results on that site’s domain, rather than clumsily trying to pretend with a content keyword.
X.com is distinctive and unambiguous. Wikipedia has entertained at least 12 proposals to change the article name; 100% of them have failed, and they are issuing 3-month moratoriums on discussion now.
Honestly the new name is a bit of a prank on porn addicts. If someone is watching over your shoulder while you try to type "x.com" into the URL bar, autocomplete may reveal how many other sites begin with "x" that you’ve visited lately.
That's fine when you are searching for things on x.com.
But what about when you are searching a comment thread on another site to try to find a comment you remember where x.com was mentioned? The comment is probably not going to say "x.com".
That is an interesting concept as it seems that Elon Musk's main battle is against people's right to not be called by an old name. Xitter transition have not been very successful.
It's still running fine for me with actual interesting content. I don't get this take, feels like only people who don't use it at all (anymore) say it's been a bad transition or "X sucks now" but they're not using it.
It's still just Twitter, but you're not being banned anymore. So ACTUAL discussions can take place without having the thought police running around with a banhammer.
> I'm not going to return to a website that doesn't ban people unable to have a civilized conversation
That's your choice! Perfectly fine. For me, I don't want to close my eyes for what the world is actually thinking, even when they're in rage-mode. I think that makes your own thinking very narrow.
Also, it's a conscious choice they made - they're the only platform I know of that allows you saying anything with no penalty except for maybe a algorithmic one. That doesn't mean it sucks, or is a bad platform, or the transition failed.
There are certainly much better ways to learn what the world is thinking than a website without effective moderation. The problem was never "censorship" or "people are not allowed to say everything". The problem is the quantity of garbage the information supersewer generates and finding what is true and relevant.
Except for criticizing musk in the papers, as he's banned journalists, people "doxing" him by publishing his plane, etc
There's a million things you cant say, its now you are happy that the right wing nutjobs get to have their peace in public - that's the only part of the conversation that's "now allowed"
I won't speak for others, but I refuse to use a service that doesnt work if I'm not signed in. But when it did work, there didn't appear to be overzealous banning, and all the banning conversation appeared to be coming from sources that deserved to be banned, imo.
So when you say "it's still good" while also mentioning thought police, I take what you're saying with a huge grain of salt, as I never noticed thought police to begin with, so less of something unnoticable sounds very close to "complete anarchy, nazis, and that's how we like it". Like 4chan put on a business suit.
If you never noticed the thought police, you were of the kind of people that Twitter wanted there to exclusively be. That's okay, but not a realistic view of the world. However, people with differing ideologies were pushed away. Yes, that includes literal nazis. But that also includes people who don't agree with the status-quo and want to see something different. The old twitter gave the impression of a world where 99% of the people agree with the current state of things, which is just not reality.
X is the only platform where you can see the real state of the world, raw, unedited. That's INCREDIBLY valuable and I'm absolutely baffled by how everyone here seems to celebrate censorship. We fought wars over this.
Yeah the censorship is overbearing now. I've since deleted my account of a decade but just using the word "cis" got a post of mine immediately auto-moderated.
I think people talking about how new-Twitter is somehow a bastion of free speech or whatever are just telling on themselves about what they think speech is.
I recognize the benefits of open communication, while also not wanting to participate in something so gross. I'm absolutely baffled by people claiming censorship free is the only option, and that any moderation at all is bad. A free for all is not what I want, in any platform or space I participate in.
Of course it surges when you re-instate complete free speech. But now you could interact with them, discuss with them, maybe sway them another way. Or you just ignore them and scroll away, or even block them, so the algorithm knows you don't want that content.
They're already being pulled down by the alg. It's just allowed now, and why shouldn't it be? I think it's better for humanity overall if these people are not pushed into a small echo-chamber but instead can speak freely and openly.
We should go back to sticks & stones. Let hate flow off you and instead look for love, which is also still there.
> Of course it surges when you re-instate complete free speech.
what? Elon routinely complies with random countries asking him to ban users, and routinely bans people he personally doesn't like. he even banned someone who was just reposting public flight data!
what on earth does "complete free speech" mean to you??!
And when all the hate speech proponents flood the platform with bots? What happens when pushing down is not enough because there is too much? What happens when there are so many new accounts posting hate speech you can’t block them either. Free speech and word detection algorithms are not good moderation they are lazy moderation that refuses to address the problem most people have with Twitter.
Twitter is not the US and does not guarantee free speech. To insist that it must because it’s a US company is entirely missing the point. Banning people is essentially ignoring people. Which is what the text of “sticks and stones” is instructing.
That seems like a weird take. If 80% of the internet is spam (which it very well could be), is spam the internet?
I guess censorship is a popular thing now on HN. Never thought I would see all you people advocating FOR censorship. I’m happy Elon seems unmoving in his stance on this. We need to progress.
I am by no means a bluesky person. I hate Twitter and all its clone sites, because I think they're tearing apart the social fabric by training people to interact in bite-sized hot takes in a cycle of outrage. I will still call it Twitter until the end of time, because I refuse to respect corporate rebrands. Whether it's Twitter, Facebook, Comcast, or anything else, I'm not going to play along with their silly name games.
Signal has had forward secrecy forever, right? The modern practice of secure messaging was established by OTR (Borisov and Goldberg), which practically introduced the notions of "perfect forward secrecy" and repudiability (as opposed to non-repudiability) in the messaging security model. Signal was an evolution both of those ideas and of the engineering realization of those ideas (better cryptography, better code, better packaging).
What's so galling about this state of affairs is that people are launching new messaging systems that take us backwards, not just to "pre-Signal" levels, but to pre-modern levels; like, to 2001.