How Cloudflare verifies the code WhatsApp Web serves to users

https://blog.cloudflare.com/cloudflare-verifies-code-whatsapp-web-serves-users/

by jgrahamc • 4 years ago

18 9 4 years ago

blog.cloudflare.com

dane-pgp3• 4 years ago

This is actually fantastic, and I hope it really puts momentum into closing the remaining security gap between JavaScript crypto and the native app equivalent.

The system described in this post doesn’t scale to arbitrary assets – yet – but we are exploring ways in which we could extend this offering for something more general and usable like Binary Transparency.

It would be great if other makers of E2EE apps (like ProtonMail and Matrix's Element) joined this initiative and made the verifier work for their web apps too. I'm sure Cloudflare would be happy to partner with those organisations.

For context, there have been a few other attempts in the past to verify the contents of web apps, such as Signed Pages[0] and SecureBookmarks[1], but those have had usability drawbacks. One thing I hope Cloudflare end up supporting is returning the version/hash info from a verifiable append-only log. That way, users can choose to run an old version of a web app until the new version has been around for long enough to be independently reviewed.

[0] https://github.com/tasn/webext-signed-pages

[1] https://coins.github.io/secure-bookmark/

Arathorn• 4 years ago

At Element we would love to get involved with this too. We urgently need better ways to demonstrate that Element Web hasn’t been tampered with in transit.

We currently use CF as a CDN for hosting Element however; I may be missing something, but: how do you stop CF conspiring to mess with the JS and publish a different hash?

elithrar2• 4 years ago

(I lead privacy products at CF and co-authored the linked post)

This—improving trust in the system and making it provable—is something we're looking to do. Having the publisher sign the hashes and publish the public key is one approach we've discussed. You'd be able to validate this out-of-band. Most users, however, likely won't go to this extent - a lot of the motivation behind this work was around automating the stuff that folks just don't do (like comparing hashes).

Longer term we'd like to get more of these capabilities into the browser itself - comparing the hash in a separate context, validating signatures, etc - so that this is scalable.

Ultimately these systems are also still built on trust: at some level there are humans in the loop, an assumption that the user's machine itself isn't compromised, and/or that the code itself is actually "correct" (for some definition of correct).

shock• 4 years ago

We urgently need better ways to demonstrate that Element Web hasn’t been tampered with in transit.

Serving the content with HTTPS ought to ensure that. What Cloudflare does with WhatsApp is to prove to facebook the user hasn't modified the code locally. This is dis-empowering the user, not protecting the user.

How Cloudflare verifies the code WhatsApp Web serves to users

Related Stories