Subrosa – An encrypted communication platform

by carlozt03 • 12 years ago

40 49 12 years ago

Scaevolus2• 12 years ago

Matasano's "Javascript Cryptography Considered Harmful" is yet again applicable. http://matasano.com/articles/javascript-cryptography/

These statements are mutually exclusive:

End to end encrypted: Nobody, not even us, can read or listen into your conversations.

Works everywhere: Visit subrosa.io from any computer. No download or install needed.

hluska2• 12 years ago

That is such a good article and I cannot believe that I am just reading it for the first time now. Thank you so much for posting the article and your explanation of the two mutually exclusive statements. Crypto is just about the coolest thing I have ever heard of and I love learning about different types of attacks!

explorigin• 12 years ago

This is not a "good" article. It's very hand wavey with lots of fud.

For example, he talks about the chicken and egg problem of delivering javascript over an insecure connection and then solves it later with SSL/TLS (but he doesn't acknowledge that this is a valid solution). Furthermore, we're all harping on javascript when you can't download PuTTY over an SSL connection.

He talks about browser cache but says that javascript can't control it. That doesn't mean it can't be controlled (see MANIFEST file).

I could go on, but the point is made, there are answers to the problems raised in the article. They may not be _easy_ (as the article complains some things are complex), but it's security on wildly complex systems...of course it's hard.

api2• 12 years ago

Everything this article says is true. That being said, it also applies to any regular application that can be upgraded automatically or that's upgraded at all by a third party. Anything you get off an app store can have its code switched out from under it with minimal and routine or in some cases even no user interaction. All someone has to do is compromise the signing key, which is probably not that hard in many cases.

Scaevolus2• 12 years ago

Scarily true. The amount of damage malicious actors with keys can do is greatly magnified by the auto-update mechanisms that developers love.

jtheory2• 12 years ago

Sure; but there's a world of difference between communicating with a webapp that claims to protect your privacy even from the NSA (but actually cannot) vs. "any regular application", which makes no such security claims, and from whom savvy users won't expect that kind of protection.

People with important information to communicate that they must protect from the powers that be (quite possibly to protect their own lives) will seek out secure methods; at the same time, the powers they're avoiding will be targeting secure communication methods.

phibit5• 12 years ago

Can you explain how these two statements are mutually exclusive?

These statements are mutually exclusive: End to end encrypted: Nobody, not even us, can read or listen into your conversations. Works everywhere: Visit subrosa.io from any computer. No download or install needed.

CJefferson• 12 years ago

subrosa can choose at any time to send you javascript which will send your password back to them. You have no way of checking for this (well, except reading all the javascript, every time you log in)

vsakos3• 12 years ago

First impression:

- There is no demo, i can only guess that this is a "browser-based skype". I hate when i can't try it but it's free.

- Open-source, but no git repo?

Btw I had the same idea before (I posted it to an Idea Sunday thread) but I dropped the idea because i realized that no one needs this level of security, NSA is not interested in your chat with family and friends...

phibit5• 12 years ago

"There is no demo" -- just make an account quickly and try it out. I did this and it was easy.

"Open-source, but no git repo" -- Open-source does not always entail git or Github.

"I dropped the idea because i realized that no one needs this level of security, NSA is not interested in your chat with family and friends..." -- I'm glad you dropped the idea because someone who doesn't understand why privacy is important shouldn't be making privacy applications. The NSA doesn't care about your chat with family and friends, until suddenly they DO start caring and everything you've said can be manipulated and transformed against you, whether your conversations were innocent or not.

vsakos3• 12 years ago

I know it can be open source without git, but GitHub gives a lot of benefits.

Also as I understood, you don't have Facebook, Twitter, Skype, Googe, Outlook, YouTube, and even HN account because NSA could one day transform everything against you?!

joepie91_• 12 years ago

Some sort of reproducible version control chain is essential for any kind of privacy- or security-related application. It makes auditing about a hundred times easier.

acveilleux4• 12 years ago

The published source code is only the client-side. So not quite open-source, at least in my book if a client is open-source the protocol it implements ought to be documented somewhere or the implementation provided.

rubbingalcohol• 12 years ago

Unless they're using a browser extension, there's no way a user can trust this application. It's a web app. At any moment the developer or a malicious third party with unauthorized server access can remotely modify the JavaScript files to dump all data in plaintext to the NSA.

swordswinger12• 12 years ago

In the description of the key exchange mechanism (section 'Conversation Keys' under 'Security') it sounds like they're using one symmetric key for both directions of a two-way channel. If true, this is a pretty serious security flaw. Anyone from Subrosa care to comment?

orthecreedence3• 12 years ago

Not really, from what I understand. Seems they are exchanging a symmetric key via RSA to facilitate two-way encrypted communication. This is pretty standard, browsers do this via TLS.

ctz2• 12 years ago

TLS does not use a single symmetric key for bidirectional comms. It establishes keys per direction.

acveilleux4• 12 years ago

More importantly, one of the party is trusted to come up with the key alone. The other party just has to accept that it's a good key with no other proof then that it was encrypted with their public key. The description is really weak on details.

They keep repeating they've been audited but not naming the auditors.

ctz2• 12 years ago

"Nobody, not even us, can read or listen into your conversations."

This cannot possibly be true, given they are the root of trust for establishing the recipient's authentic public key.

Also, minified javascript really does not count as a source code release.

jtheory2• 12 years ago

Quite right. If they were compelled -- e.g., "insert this backdoor or we'll imprison you" -- they might trivially serve up a tweaked version of their JavaScript to the one user the NSA was interested in.

And it wouldn't take a complicated tweak at all to sneak the real password (or some sufficient version of it) back to the server, after which point certainly "even us" can read & listen in to all of that user's conversations.

danielweber2• 12 years ago

(Comment moved to today's topic.)

carlozt03• 12 years ago

I ran this through the SSLlabs SSL Test and it came back with an F. Perhaps an oversight on their end?

ceejayoz• 12 years ago

Looks like it's because it's vulnerable to the OpenSSL CCS exploit. http://ccsinjection.lepidum.co.jp/

A system bragging about security leaving a known, patched hole like this open isn't a great sign.

Canada• 12 years ago

A quick check with wireshark reveals the use of a VBR codec for audio, so there's another probable side channel besides the Javascript related issues already discussed.

I don't know much about WebRTC, but I think it's something you can set and Subrosa should be doing so in app-webrtc.js.

acveilleux4• 12 years ago

The login protocol require sending a hash of the key used to decrypt the rsa key bundle stored server-side. I hope they implemented a constant time compare for that hash so that verification can't be used to work out key...

danielweber2• 12 years ago

Why have both "username" and "display name"?

At first I thought it was an extra layer of security , like most online games have, to discourage username/password bruteforcing. (It's an obscurity layer, but obscurity layers are not by definition bad.) But you need to tell others your username to communicate with them.

Subrosa – An encrypted communication platform

Related Stories