Security quotes of the week [LWN.net]

It is notable that the attacker only makes a few guesses at usernames, and successfully authenticates once the correct username has been found. While we don't have any specific evidence for this, a possible explanation is that the user database of master.php.net has been leaked, although it is unclear why the attacker would need to guess usernames in that case.
The master.php.net system, which is used for authentication and various management tasks, was running very old code on a very old operating system / PHP version, so some kind of vulnerability would not be terribly surprising.

— Nikita Popov reports on what caused the PHP Git repository compromise (Thanks to Paul Wise.)

I think this is an incredibly bad idea. It’s not just the bloating of what was a clean secure communications app. It’s not just that blockchain is just plain stupid. It’s not even that Signal is choosing to tie itself to a specific blockchain currency. It’s that adding a cryptocurrency to an end-to-end encrypted app muddies the morality of the product, and invites all sorts of government investigative and regulatory meddling: by the IRS, the SEC, FinCEN, and probably the FBI.
And I see no good reason to do this. Secure communications and secure transactions can be separate apps, even separate apps from the same organization. End-to-end encryption is already at risk. Signal is the best app we have out there. Combining it with a cryptocurrency means that the whole system dies if any part dies.

— Bruce Schneier reacts to the Wired report that the Signal app is adding support for a cryptocurrency

Security quotes of the week

Posted Apr 8, 2021 16:46 UTC (Thu) by smurf (subscriber, #17840) [Link]

Do I understand this correctly. The PHP people themselves did not update one of their own critical systems for years??

No wonder PHP-the-language does not, and never did, take security seriously …

Security quotes of the week

Posted Apr 8, 2021 23:31 UTC (Thu) by flussence (guest, #85566) [Link] (5 responses)

> Signal is the best app we have out there.

Good god no, Signal wasn't even passably mediocre. It's a cult of personality wrapped up in a glitzy phone app that offers a silver bullet for a vacuous threat model: you're paranoid your carrier/government will read the content of your messages and do “something” based on the info, but you're fine with letting them know all the metadata associated with a normal SMS conversation and that you have something to hide from them specifically? Sure.

All for the low, low price of giving Signal access to your social graph and other personal information, which they pinky-swear they won't do anything evil with. Instead they're going to sate the rabid hunger of the venture capitalists that pumped tens of millions of dollars into this thing with fairy dust and sparkles, just like every other MLM scheme out of silicon valley.

How many times has this frog been boiled now? It's practically glue at this point. I'd trust Tox more, and that's not a recommendation for Tox.

Security quotes of the week

Posted Apr 9, 2021 9:14 UTC (Fri) by james (guest, #1325) [Link] (4 responses)

It's a cult of personality wrapped up in a glitzy phone app that offers a silver bullet for a vacuous threat model

For one thing, your threat model needs to include that any government with reach over suppliers or distributors will attempt to subvert the update process:

...the EncroChat servers were in France and the French Gendarmerie had discovered a way to send an implant to all EncroChat devices in the world under cover of an apparent update. That implant caused the device to transmit to the French police all the data held on it.

-- The Lord Chief Justice of England and Wales in a Court of Appeal judgment, finding that this material could be used in English and Welsh courts in criminal proceedings.

Not to mention Sky ECC, where allegedly Belgian police managed to crack the encryption.

Security quotes of the week

Posted Apr 9, 2021 9:21 UTC (Fri) by mjg59 (subscriber, #23239) [Link] (3 responses)

> For one thing, your threat model needs to include that any government with reach over suppliers or distributors will attempt to subvert the update process:

Android will not install an updated version of an app unless it's signed with the same key as the installed version. Signal is signed with a key that's held by Signal, not by Google. To subvert that model you'd need to push a malicious OS update to the user's phone first, which is going to involve getting your phone vendor's keys. This is clearly not impossible, but at the point where you can't trust the OS underneath you then the only answer is "Don't use the internet to communicate with people".

Security quotes of the week

Posted Apr 9, 2021 9:28 UTC (Fri) by james (guest, #1325) [Link] (2 responses)

Android will not install an updated version of an app unless it's signed with the same key as the installed version.

Which may very well be available to police with a court order and the threat of imprisonment if staff do not comply. You'll want multiple people to have access to the key, after all, and some way of backing it up remotely.

The EncroChat and Sky ECC cases make it clear that this is a plausible scenario.

Security quotes of the week

Posted Apr 9, 2021 9:48 UTC (Fri) by mjg59 (subscriber, #23239) [Link] (1 responses)

I'd hope that the key is sharded, with no individual having access to it. While it's not impossible for a foreign government to compromise enough people to make that happen, it's not super realistic. Given that Signal is based in the US then yes, I'd agree you probably shouldn't depend on it if keeping your messages out of the US government's hands is vital. But I don't think that's what most of its users are trying to protect against.

Security quotes of the week

Posted Apr 9, 2021 22:52 UTC (Fri) by rodgerd (guest, #58896) [Link]

Pretty much my use case for Signal is cross-platform iMessage, and it does a perfectly sound job of being that, for now. I’d trust it more than, say, Telegram or a network of self-hosted allegedly-secure messaging tools or PGP.

If I was trying to evade Putin or the CCP I’d have bigger problems.