#privatemessaging — Public Fediverse posts
Live and recent posts from across the Fediverse tagged #privatemessaging, aggregated by home.social.
-
EU now one step away from reviving private message scanning rules
https://cyberinsider.com/eu-now-one-step-away-from-reviving-private-message-scanning-rules/
Comments: https://news.ycombinator.com/item?id=48834296
#HackerNews #EUprivacy #PrivateMessaging #Cybersecurity #DigitalRights #Surveillance
-
WhatsApp Clone, but Decentralized with P2P Messaging
"Secure and private" is the general goal.
This is a technical/concept demo of a fairly unique approach using a browser-based, local-first and webrtc.
This is intended to introduce a new paradigm in client-side managed secure cryptography. We can avoid registration of any sort.
Features:
* P2P
* End to end encryption
* Signal protocol
* Post-Quantum cryptography
* File transfer
* Local-first
* No registration
* No installation
* No database
* TURN serverFeel free to reach out for clarity instead of diving into the docs/code.
IMPORTANT: While this is aiming to provide a secure experience, it isnt audited or reviewed. **Shared for testing, feedback and demo purposes only.** Please use responsibly.
#Privacy #OpenSource #P2P #WebRTC #Decentralization #DigitalSovereignty #CyberSecurity #FOSS #SelfHosted #NoCloud #AntiCorp #Encryption #WebDev #TechLiberty #PrivateMessaging #Networking #DataPrivacy #InternetFreedom #LocalFirst #SoftwareEngineering #WebApps #ZeroKnowledge #PrivacyTech #IndieDev #NoSignup #NoInstall #DecentralizedWeb #SecureMessaging #BrowserApp #TechEthics #P2P #WebRTC #PeerJS #ZeroData #EphemeralData #Encryption #E2EE #BrowserToBrowser #NoInstall #Privacy #Security #Decentralized #Messaging #VideoCall #NoTracking #PrivateMessaging #Prototype #Demo #WorkInProgress #CloseSource #OpenSource #WebDev #GitHub #TechDevelopment #WhatsApp #ChatApp #InstantMessaging #PWA
-
This is intended to introduce a unique approach in client-side managed secure cryptography. We can avoid registration of any sort.
Features:
PWA
P2P
End to end encryption
Signal protocol
Post-Quantum cryptography
Multimedia
File transfer
Video calls
Local-first
No registration
No installation
No database
TURN serverhttps://www.reddit.com/r/positive_intentions
#Privacy #OpenSource #P2P #WebRTC #Decentralization #DigitalSovereignty #CyberSecurity #FOSS #SelfHosted #NoCloud #AntiCorp #Encryption #WebDev #TechLiberty #PrivateMessaging #Networking #DataPrivacy #InternetFreedom #LocalFirst #SoftwareEngineering #WebApps #ZeroKnowledge #PrivacyTech #IndieDev #NoSignup #NoInstall #DecentralizedWeb #SecureMessaging #BrowserApp #TechEthics #P2P #WebRTC #PeerJS #ZeroData #EphemeralData #Encryption #E2EE #BrowserToBrowser #NoInstall #Privacy #Security #Decentralized #Messaging #VideoCall #NoTracking #PrivateMessaging #Prototype #Demo #WorkInProgress #CloseSource #OpenSource #WebDev #GitHub #TechDevelopment #WhatsApp #ChatApp #InstantMessaging #PWA
-
Decentralized WhatsApp Clone - No Setup or Signup
https://positive-intentions.com
This is intended to introduce a new paradigm in client-side managed secure cryptography. We can avoid registration of any sort. A fairly unique offering for a messaging app.
No need for things like phone numbers or registering to any app stores. There are no databases to be hacked Allowing users to send E2EE messages; no cloud, no trace.
#Privacy #OpenSource #P2P #WebRTC #Decentralization #DigitalSovereignty #CyberSecurity #FOSS #SelfHosted #NoCloud #AntiCorp #Encryption #WebDev #TechLiberty #PrivateMessaging #Networking #DataPrivacy #InternetFreedom #LocalFirst #SoftwareEngineering #WebApps #ZeroKnowledge #PrivacyTech #IndieDev #NoSignup #NoInstall #DecentralizedWeb #SecureMessaging #BrowserApp #TechEthics
-
PC Mag: Mastodon Plans End-to-End Encryption for Private Messages. “Decentralized social media platform Mastodon plans on adopting its own end-to-end encryption (E2EE) for private messages. Mastodon announced the upcoming feature in a blog post about receiving €614,000 ($724,000) from the Sovereign Tech Fund, an effort backed by the German government to support open-source software.”
https://rbfirehose.com/2026/04/17/pc-mag-mastodon-plans-end-to-end-encryption-for-private-messages/ -
E2EE is coming to Mastodon. And it’s long overdue. Not until next year, but at least it’s on the horizon.
On one hand, it’s a little scary seeing Mastodon features receiving large sums of money for features and improvements. On the other, it’s meaningful to see Mastodon maturing.
#Privacy #Mastodon #InfoSec #E2EE #Encryption #PrivateMessaging #DM
-
Is this a #secure #MessagingApp? Maybe not yet, but it’s time to think about #DigitalPrivacy.
Imagine a #Messaging platform that’s as #secure as #Signal but requires #NoRegistration and #NoInstallation. By leveraging #WebRTC for direct #BrowserToBrowser communication, this #OpenSource project eliminates the #Middleman entirely. Simply share a unique #URL to establish an #Encrypted #PrivateChannel. It is a #Lightweight, #Disposable method to bypass #DataHarvesting and reclaim #DigitalSovereignty.
This project introduces a new #Paradigm in #ClientSide managed #Encryption. Send #Secure messages with #NoSetup, #NoCloud, and #NoTrace.
Experience the #Features:
* #PWA (#ProgressiveWebApp) for instant access
* #P2P (#PeerToPeer) connectivity
* #EndToEndEncryption (#E2EE)
* #SignalProtocol & #PostQuantum #Cryptography
* #Multimedia, #FileTransfer, & #VideoCalls
* #NoDatabase & #Stateless architecture
* #TURN server support for reliable connectionsWhile not yet a direct replacement for #Simplex or #WhatsApp, this introduces a unique approach to #SecureCommunication.
Try the #LiveDemo now:
https://p2p.positive-intentions.com/iframe.html?globals=&id=demo-p2p-messaging--p-2-p-messaging&viewMode=storyExplore the #Technical roadmap:
https://positive-intentions.com/docs/technical/p2p-messaging-technical-breakdownRead the full #Documentation:
https://positive-intentions.com/docs/technical#PrivacyTech #Privacy #CyberSecurity #Infosec #WebDev #JavaScript #Decentralized #EncryptionProtocol #QuantumResistant #Tech #FOSS #SoftwareEngineering #DataPrivacy #SecureChat #NoLog #P2PChat #WebRTCProtocol #Coding #DevCommunity #DigitalPrivacy #InternetFreedom #SecureMessaging #WebTech #AppDevelopment #CryptographyResearch #PrivateMessaging #WebPlatform #ZeroTrust #Innovation
-
WhatsApp Clone... But Decentralized and P2P Encrypted Without Install or Signup.
Features include:
* P2P
* End to end encryption
* forward secrecy
* Multimedia
* Open source
* No registration
* No installation
* Encrypted storage
* TURN serverThe project is far from finished and presented for testing, feedback and demo purposes (USE RESPONSIBLY!).
https://positive-intentions.com
#Privacy #OpenSource #P2P #WebRTC #Decentralization #DigitalSovereignty #CyberSecurity #FOSS #SelfHosted #NoCloud #AntiCorp #Encryption #WebDev #TechLiberty #PrivateMessaging #Networking #DataPrivacy #InternetFreedom #LocalFirst #SoftwareEngineering #WebApps #ZeroKnowledge #PrivacyTech #IndieDev #NoSignup #NoInstall #DecentralizedWeb #SecureMessaging #BrowserApp #TechEthics
-
Keet, the ultimate private messenger, connects devices directly, eliminating the need for servers and storing user messages. End-to-end encryption ensures only you and the recipient can read messages. Keet prioritizes privacy by design, eliminating middlemen, data collection, and compliance requirements. Download it for free at https://keet.io.
#Keet #P2P #Privacy #EndToEndEncryption #NoServers #PrivateMessaging #Decentralized #DigitalFreedom #SecureChat
-
WhatsApp Clone... But Decentralized and P2P Encrypted Without Install or Signup.
By leveraging WebRTC for direct browser-to-browser communication, it eliminates the middleman entirely. Users simply share a unique URL to establish an encrypted, private channel. This approach effectively bypasses corporate data harvesting and provides a lightweight, disposable communication method for those prioritizing digital sovereignty.
Features include:
* P2P
* End to end encryption
* forward secrecy
* Multimedia
* Open source
* No registration
* No installation
* Encrypted storage
* TURN serverThe project is far from finished and presented for testing, feedback and demo purposes (USE RESPONSIBLY!).
Technical breakdown: https://www.reddit.com/r/CorpFree/comments/1qnouh8/whatsapp_clone_but_peertopeer_no_install_or_signup
#Privacy #OpenSource #P2P #WebRTC #Decentralization #DigitalSovereignty #CyberSecurity #FOSS #SelfHosted #NoCloud #AntiCorp #Encryption #WebDev #TechLiberty #PrivateMessaging #Networking #DataPrivacy #InternetFreedom #LocalFirst #SoftwareEngineering #WebApps #ZeroKnowledge #PrivacyTech #IndieDev #NoSignup #NoInstall #DecentralizedWeb #SecureMessaging #BrowserApp #TechEthics
-
WhatsApp Clone... But Decentralized and P2P Encrypted (No Install or Signup)
The following is a technical breakdown of progress and how it works.
https://programming.dev/c/SecureComs@lemmy.ml
#P2P #WebRTC #PeerJS #ZeroData #EphemeralData #Encryption #E2EE #BrowserToBrowser #NoInstall #Privacy #Security #Decentralized #Messaging #VideoCall #NoTracking #PrivateMessaging #Prototype #Demo #WorkInProgress #CloseSource #OpenSource #WebDev #GitHub #TechDevelopment #WhatsApp #ChatApp #InstantMessaging
-
https://glitr.positive-intentions.com
Secure decentralized P2P messaging PWA
Progress update:
- UI improvements throughout
- Passkey-based encrypted data at rest.
- Introducing giphy integration
- Bug fixes throughoutNOTE: This is still a work-in-progress and a close-source project. Its far from finished and doesnt have the user-experience needed to promote the project to a wider audience. The implementation is based on the open source MVP seen here: https://github.com/positive-intentions/chat. It has NOT been audited or reviewed. For testing purposes only, not a replacement for your current messaging app.
* Docs: https://positive-intentions.com/docs/category/sparcle
* Reddit: https://www.reddit.com/r/positive/_intentions
* More: https://positive-intentions.com#P2P #WebRTC #PeerJS #ZeroData #EphemeralData #Encryption #E2EE #BrowserToBrowser #NoInstall #Privacy #Security #Decentralized #Messaging #VideoCall #NoTracking #PrivateMessaging #Prototype #Demo #WorkInProgress #CloseSource #OpenSource #WebDev #GitHub #TechDevelopment #WhatsApp #ChatApp #InstantMessaging #PWA
-
Want E2E encrypted messages and video calls with no downloads, no sign-ups and no tracking?
This prototype uses webRTC to establish a secure browser-to-browser connection. Everything is ephemeral and cleared when you refresh the page—true zerodata privacy!
Check out the pre-release demo here: https://p2p.positive-intentions.com/iframe.html?globals=&id=demo-p2p-messaging--p-2-p-messaging&viewMode=story
(For those who have seen it before, i've added fixes and improvements throughout, so it might still be worth checking out)
NOTE: This is still a work-in-progress and a close-source project. Its far from finished and doesnt have the user-experience needed to promote the project to a wider audience. The implementation is based on the open source MVP seen [here](https://github.com/positive-intentions/chat). It has NOT been audited or reviewed. For testing purposes only, not a replacement for your current messaging app.
* Docs: https://positive-intentions.com/docs/category/sparcle
* Reddit: https://www.reddit.com/r/positive/_intentions
* More: https://positive-intentions.com#P2P #WebRTC #PeerJS #ZeroData #EphemeralData #Encryption #E2EE #BrowserToBrowser #NoInstall #Privacy #Security #Decentralized #Messaging #VideoCall #NoTracking #PrivateMessaging #Prototype #Demo #WorkInProgress #CloseSource #OpenSource #WebDev #GitHub #TechDevelopment #WhatsApp #ChatApp #InstantMessaging
-
A really great list & explanation of several secure & private tools.
▶️ Use These Before They're Banned: 7 Encrypted Services - TechLore
https://youtube.com/watch?v=USNy6fwJyME&si=Msz4cuJ-QYNF88Z1
#VPN #securemail #privatemessaging -
Engadget: X is finally rolling out Chat, its DM replacement with encryption and video calling . “X has finally revealed its long-promised chat platform, which replaces the service’s basic DM functionality with features more like the messaging capabilities on other mainstream apps. The update adds voice and video calling, file sharing and the ability to edit and delete previously sent messages, […]
-
Want E2E encrypted messages and video calls with no downloads, no sign-ups and no tracking?
This prototype uses webRTC to establish a secure browser-to-browser connection. Everything is ephemeral and cleared when you refresh the page—true zerodata privacy!
Check out the pre-release demo here: https://p2p.positive-intentions.com/iframe.html?globals=&id=demo-p2p-messaging--p-2-p-messaging&viewMode=story
(For those who have seen it before, i've added fixes and improvements throughout, so it might still be worth checking out)
NOTE: This is still a work-in-progress and a close-source project. Its far from finished and doesnt have the user-experience needed to promote the project to a wider audience. The implementation is based on the open source MVP seen [here](https://github.com/positive-intentions/chat). It has NOT been audited or reviewed. For testing purposes only, not a replacement for your current messaging app.
* Docs: https://positive-intentions.com/docs/category/sparcle
* Reddit: https://www.reddit.com/r/positive/_intentions
* More: https://positive-intentions.com#P2P #WebRTC #PeerJS #ZeroData #EphemeralData #Encryption #E2EE #BrowserToBrowser #NoInstall #Privacy #Security #Decentralized #Messaging #VideoCall #NoTracking #PrivateMessaging #Prototype #Demo #WorkInProgress #CloseSource #OpenSource #WebDev #GitHub #TechDevelopment #WhatsApp #ChatApp #InstantMessaging
-
P2P Whatsapp Clone
Check out the pre-release demo: https://p2p.positive-intentions.com/iframe.html?globals=&id=demo-p2p-messaging--p-2-p-messaging&viewMode=story).
Want to send #encrypted #WebRTC #messages and #videoCalls with #noDownloads, #noSignUps and #noTracking?
This prototype uses #PeerJS to establish a #secure #browserToBrowser #connection. Everything is ephemeral and cleared when you refresh the page—true #zerodata #privacy!
NOTE: This is still a work-in-progress and a #closeSource project. To view the #openSource version see [here](https://github.com/positive-intentions/chat). it has NOT been audited or reviewed. For #testing purposes only, not a replacement for your current messaging app.
- Docs: https://positive-intentions.com/docs/category/sparcle
- Reddit: https://www.reddit.com/r/positive_intentions
- GitHub: https://github.com/positive-intentions#P2P #WebRTC #PeerJS #ZeroData #EphemeralData #Encryption #Encrypted #infosec #cryptography #E2EE #BrowserToBrowser #NoInstall #Privacy #Security #Decentralized #Messaging #VideoCall #NoTracking #PrivateMessaging #Prototype #Demo #WorkInProgress #WebDev #TechDevelopment #ChatApp #javascript #InstantMessaging
-
E2EE P2P Messaging App
I recently introduced [metered.ca](http://metered.ca) for the STUN/TURN servers and the stability has hugely improved and so i'd like to ask for your feedback if you'd like to try it out.
Data isnt persisted (yet), so each page refresh will clear all keys.
(IMPORTANT: For testing and demo purposes only. This is a work-in-progress and far from finished. It has not been reviewed or audited. Do not use it for sensitive data.)
#P2P #WebRTC #PeerJS #ZeroData #EphemeralData #Encryption #Encrypted #infosec #cryptography #E2EE #BrowserToBrowser #NoInstall #Privacy #Security #Decentralized #Messaging #VideoCall #NoTracking #PrivateMessaging #Prototype #Demo #WorkInProgress #WebDev #TechDevelopment #ChatApp #javascript #InstantMessaging
-
Want to send messages and video calls with:
* no installs
* no sign-ups
* no tracking
* end-to-end encryptionThis new prototype uses PeerJS to establish a secure browser-to-browser connection. Everything is ephemeral and cleared when you refresh the page—true zerodata privacy!
Check out the [testable demo here](https://p2p.positive-intentions.com/iframe.html?globals=&id=demo-p2p-messaging--p-2-p-messaging&viewMode=story).
I am working towards a look-and-feel to match Whatsapp as seen in this [hardcoded UI demo](http://glitr.positive-intentions.com).
IMPORTANT NOTE: This is still a work-in-progress and a close-source project. It is based on the open source MVP see [here](https://github.com/positive-intentions/chat). It has NOT been audited or reviewed. For testing purposes only, not a replacement for your current messaging app.
* Docs: https://positive-intentions.com/docs/category/sparcle
* Reddit: https://www.reddit.com/r/positive_intentions
* GitHub: https://github.com/positive-intentions#P2P #WebRTC #PeerJS #ZeroData #EphemeralData #Encryption #E2EE #BrowserToBrowser #NoInstall #Privacy #Security #Decentralized #Messaging #VideoCall #NoTracking #PrivateMessaging #Prototype #Demo #WorkInProgress #CloseSource #OpenSource #WebDev #GitHub #TechDevelopment #WhatsApp #ChatApp #InstantMessaging
-
#Instagram reached #3billion monthly active users, according to Meta CEO #MarkZuckerberg. The platform is focusing on #privatemessaging and #Reels for future updates, including easier access and algorithm changes. https://www.theverge.com/news/784784/instagram-3-billion-monthly-users-reels-dms-updates?eicker.news #tech #media #news
-
The Register: Forget disappearing messages – now Signal will store 100MB of them for you for free. “Encrypted messaging app Signal is rolling out a free storage system for its users, with extra space if folks are willing to pay for it. The company will gift all users 100MB of free storage for images, video, GIFs and other media from the prior 45 days of use.”
-
@avoca @Ketakater I also got all of my family and a lot of my wider circle on it using these two strategies:
1. Getting a device that simply does not have #Whatsapp / proprietary messaging apps, i.e.: #Linuxmobile: #Flx1, #LibertyPhone, #Librem5, #Jolla2c, etc. People typically won't care enough about #privacy but they will understand if WA simply does not work on your phone.
2. Kids: They don't have phone numbers (or phones in many cases) but want to be included in family group chats. Once kids got in on it, #DeltaChat spread like wildfire among our extended family, relatives, inlaws and friends. Even a kid with #downsyndrome onboarded their grandpa in seconds while I had earlier struggled to get him on #Signal!
A great thing about Delta Chat is that, unlike #ElementMessenger and other fully-featured #Matrix clients, there's no search and discovery feature so kids do not stumble upon untrusted groups and strangers' profiles.
#foss #floss #freesoftware #opensource #freedomtech #permissionlesstech #libretech #libresoftware #e2eemessaging #privatemessaging
-
CNBC: Jack Dorsey launches a WhatsApp messaging rival built on Bluetooth. “Block CEO Jack Dorsey spent the weekend building Bitchat, a new decentralized, peer-to-peer messaging app that works entirely over Bluetooth mesh networks, with no internet, central servers, phone numbers or emails required.”
-
Don’t Use Session (Signal Fork)
Last year, I outlined the specific requirements that an app needs to have in order for me to consider it a Signal competitor.
Afterwards, I had several people ask me what I think of a Signal fork called Session. My answer then is the same thing I’ll say today:
Don’t use Session.
The main reason I said to avoid Session, all those months ago, was simply due to their decision to remove forward secrecy (which is an important security property of cryptographic protocols they inherited for free when they forked libsignal).
Lack of forward secrecy puts you in the scope of Key Compromise Impersonation (KCI) attacks, which serious end-to-end encryption apps should prevent if they want to sit at the adults table. This is why I don’t recommend Tox.
And that observation alone should have been enough for anyone to run, screaming, in the other direction from Session. After all, removing important security properties from a cryptographic security protocol is exactly the sort of thing a malicious government would do (especially if the cover story for such a change involves the introduction of swarms and “onion routing”–which computer criminals might think sounds attractive due to their familiarity with the Tor network).
Unfortunately, some people love to dig their heels in about messaging apps. So let’s take a closer look at Session.
I did not disclose this blog post privately to the Session developers before pressing publish.
I do not feel that cryptographic issues always require coordinated disclosure with the software vendor. As Bruce Schneier argues, full disclosure of security vulnerabilities is a “damned good idea”.
I have separated this blog post into two sections: Security Issues and Gripes.
Security Issues
- Insufficient Entropy in Ed25519 Keys
- In-Band Negotiation for Message Signatures
- Using Public Keys as AES-GCM Keys
Insufficient Entropy in Ed25519 Keys
One of the departures of Session from Signal is the use of Ed25519 rather than X25519 for everything.
Ed25519 Keypairs generated from their
KeyPairUtilitiesobject only have 128 bits of entropy, rather than the ~253 bits (after clamping) you’d expect from an Ed25519 seed.fun generate(): KeyPairGenerationResult { val seed = sodium.randomBytesBuf(16) try { return generate(seed) } catch (exception: Exception) { return generate() }}fun generate(seed: ByteArray): KeyPairGenerationResult { val padding = ByteArray(16) { 0 } val ed25519KeyPair = sodium.cryptoSignSeedKeypair(seed + padding)As an implementation detail, they encode a recovery key as a “mnemonic” (see also: a gripe about their mnemonic decoding).
Does This Matter?
You might think that clearing the highest 128 bits of the Ed25519 seed is fine for one of the following reasons:
- It’s hashed with SHA512 before clamping.
- Ed25519 only offers 128 bits of security.
- Some secret third (and possibly unreasonable) argument.
It’s true that Ed25519 targets the 128-bit security level, if you’re focused on the security of the Elliptic Curve Discrete Logarithm Problem (ECDLP).
Achieving 128 bits of security in this model requires 256-bit secrets, since the best attack against the ECDLP finds a discrete logarithm in guesses.
Additionally, having 256-bit secrets makes the multi-user security of the scheme easy to reason about, whereas 128-bit secrets makes it a lot harder. (This mostly comes up in criticism of AES, which has a 128-bit block size.)
When your secret only has possible values, your multi-user security is no longer as secure as Ed25519 expects.
Additionally, you can shove the SHA512 + clamping in your attack script (thus negating the first objection) and find the corresponding secret key in queries if you know the top 128 bits were initialized to 0, using a modified version of Pollard’s rho for discrete logarithms.
This means that Session’s
CMYKatKeyPairUtilitiesclass only provides 64 bits of ECDLP security.What does 64 bits of ECDLP Security actually mean?
I provided a technical definition already, but that’s probably not meaningful to most people outside computer security.
What this means is that a distributed computing effort can find the secret key for a given Ed25519 public key generated from this algorithm in only queries.
For flavor, queries is approximately the attack cost to find a SHA1 collision, which we know is possible and economical.
Based on this attack, the authors projected that a collision attack on SHA-1 may cost between US$75K and US$120K by renting GPU computing time on Amazon EC2 using spot-instances, which is significantly lower than Schneier’s 2012 estimates.
— from the Shattered paper, page 2.
I don’t know if this was mere stupidity or an intentional NOBUS backdoor that only well-resourced adversaries can crack. (I also don’t have hundreds of thousands of dollars lying around to test this myself.)
How would you exploit this in practice?
If you’re not familiar with Pollard’s rho, then this section might be a bit abstract and difficult to follow.
Instead of directly passing a full 256-bit value to your oracle with each iteration (like you do with a standard Pollard’s rho implementation), you would need mutate the output the same way Session does (n.b., replace 128 bits of the seed with zeroes), hash & clamp that, and then perform the scalar multiplication.
It should be a bit more expensive than a raw ECDLP attack against a 128-bit curve (due to the hashing), but the strategy should succeed in the expected number of queries (average case).
Although this makes the attack totally feasible for a nation state, I do not have the resources to build and test a proof of concept against a candidate keypair. If anyone does, get in touch, it would make for a fun research project.
CMYKatAlternatively, Pollard’s kangaroo might be a better cryptanalysis technique for Session’s setup.
Note: If there is any classified government algorithm especially suited for cracking Ed25519 keys constructed exactly like Session does, it’s not one I’ve ever heard of. I don’t have any security clearances, nor do I want one.
However, ECDLP security of elliptic curve-based protocols is extremely well-understood in the cryptography literature.
In-Band Negotiation for Message Signatures
If you thought the previous issue was mitigated by the use of Ed25519 signatures on each message, don’t worry, the Session developers screwed this up too!
// 2. ) Get the message partsval signature = plaintextWithMetadata.sliceArray(plaintextWithMetadata.size - signatureSize until plaintextWithMetadata.size)val senderED25519PublicKey = plaintextWithMetadata.sliceArray(plaintextWithMetadata.size - (signatureSize + ed25519PublicKeySize) until plaintextWithMetadata.size - signatureSize)val plaintext = plaintextWithMetadata.sliceArray(0 until plaintextWithMetadata.size - (signatureSize + ed25519PublicKeySize))// 3. ) Verify the signatureval verificationData = (plaintext + senderED25519PublicKey + recipientX25519PublicKey)try { val isValid = sodium.cryptoSignVerifyDetached(signature, verificationData, verificationData.size, senderED25519PublicKey) if (!isValid) { throw Error.InvalidSignature }} catch (exception: Exception) { Log.d("Loki", "Couldn't verify message signature due to error: $exception.") throw Error.InvalidSignature}What this code is doing (after decryption):
- Grab the public key from the payload.
- Grab the signature from the payload.
- Verify that the signature on the rest of the payload is valid… for the public key that was included in the payload.
Congratulations, Session, you successfully reduced the utility of Ed25519 to that of a CRC32!
Art: AJUsing Public Keys As AES-GCM Keys
I wasn’t entirely sure whether this belongs in the “gripes” section or not, because it’s so blatantly stupid that there’s basically no way Quarkslab would miss it if it mattered.
When encrypting payloads for onion routing, it uses the X25519 public key… as a symmetric key, for AES-GCM. See,
encryptPayloadForDestination().val result = AESGCM.encrypt(plaintext, x25519PublicKey)deferred.resolve(result)
Session also does this inside of
encryptHop().val plaintext = encode(previousEncryptionResult.ciphertext, payload)val result = AESGCM.encrypt(plaintext, x25519PublicKey)
In case you thought, maybe, that this is just a poorly named HPKE wrapper… nope!
/** * Sync. Don't call from the main thread. */internal fun encrypt(plaintext: ByteArray, symmetricKey: ByteArray): ByteArray { val iv = Util.getSecretBytes(ivSize) synchronized(CIPHER_LOCK) { val cipher = Cipher.getInstance("AES/GCM/NoPadding") cipher.init(Cipher.ENCRYPT_MODE, SecretKeySpec(symmetricKey, "AES"), GCMParameterSpec(gcmTagSize, iv)) return ByteUtil.combine(iv, cipher.doFinal(plaintext)) }}This obviously doesn’t encrypt it such that only the recipient (that owns the secret key corresponding to the public key) can decrypt the message. It makes it to where anyone that knows the public key can decrypt it.
I wonder if this impacts their onion routing assumptions?
Why should I trust session?
(…)
When using Session, your messages are sent to their destinations through a decentralised onion routing network similar to Tor (with a few key differences) (…)
Gripes
Some of these aren’t really security issues, but are things I found annoying as a security engineer that specializes in applied cryptography.
- Mnemonic Decoding Isn’t Constant-Time
- Unsafe Use of SecureRandom on Android
Mnemonic Decoding Isn’t Constant-Time
The way mnemonics are decoded involves the modulo operator, which implicitly uses integer division (which neither Java nor Kotlin nor Swift implement in constant-time).
return wordIndexes.windowed(3, 3) { (w1, w2, w3) -> val x = w1 + n * ((n - w1 + w2) % n) + n * n * ((n - w2 + w3) % n) if (x % n != w1.toLong()) throw DecodingError.Generic val string = "0000000" + x.toString(16) swap(string.substring(string.length - 8 until string.length))}.joinToString(separator = "") { it }This isn’t a real security problem, but I did find it annoying to see in an app evangelized as “better than Signal” on privacy forums.
Unsafe Use of SecureRandom on Android
The recommended way to get secure random numbers on Android (or any Java or Kotlin software, really) is simply
new SecureRandom(). If you’re running a service in a high-demand environment, you can take extra care to make a thread-local instance of SecureRandom. But a local RNG for a single user isn’t that.What does Session do? They use SHA1PRNG, of course.
public static byte[] getSecretBytes(int size) { try { byte[] secret = new byte[size]; SecureRandom.getInstance("SHA1PRNG").nextBytes(secret); return secret; } catch (NoSuchAlgorithmException e) { throw new AssertionError(e); }}And again here.
SecureRandom secureRandom = SecureRandom.getInstance("SHA1PRNG");Why would anyone care about this?
On modern Android devices, this isn’t a major concern, but the use of SHA1PRNG used to be a source of vulnerabilities in Android apps. (See also: this slide deck.)
Closing Thoughts
There are a lot of Session’s design decisions that are poorly specified in their Whitepaper and I didn’t look at. For example, how group messaging keys are managed.
When I did try to skim that part of the code, I did find a component where you can coerce Android clients into running a moderately expensive Argon2 KDF by simply deleting the
noncefrom the message.val isArgon2Based = (intermediate["nonce"] == null)if (isArgon2Based) { // Handle old Argon2-based encryption used before HF16That’s hilarious.
Cryptography nerds should NOT be finding the software that activists trust with their privacy hilarious.
CMYKatSo if you were wondering what my opinion on Session is, now you know: Don’t use Session. Don’t let your friends use Session.
If you’re curious about the cryptography used by other messaging apps, please refer to this page that collects my blogs about this topic.
#AESGCM #Android #asymmetricCryptography #cryptography #E2EE #Ed25519 #Java #Kotlin #messagingApps #OnlinePrivacy #privateMessaging #Session #Signal #SignalAlternatives #vuln
