<div dir="ltr"><div> </div><div> </div><div>hey peter, </div><div> </div><div>i must confess i don't quite follow your message? Could you tell me a bit mor? Unless it's a joke, then *please* don't explain it (nothing more awful than an dissected joke and punchline). </div><div> </div><div> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-style:solid;border-left-color:rgb(204,204,204);padding-left:1ex">Date: Tue, 9 Jun 2020 12:11:46 +0000 From: Peter Gutmann <<a href="mailto:pgut001@cs.auckland.ac.nz">pgut001@cs.auckland.ac.nz</a>> To: "<a href="mailto:messaging@moderncrypto.org">messaging@moderncrypto.org</a>" <<a href="mailto:messaging@moderncrypto.org">messaging@moderncrypto.org</a>> Subject: Re: [messaging] [FORGED] Crypto standards in modern-day consumer apps Message-ID: <<a href="mailto:1591704707218.93122@cs.auckland.ac.nz">1591704707218.93122@cs.auckland.ac.nz</a>> Content-Type: text/plain; charset="iso-8859-1" Mike Power <<a href="mailto:mike.power.casual@theguardian.com">mike.power.casual@theguardian.com</a>> writes: >Anyway, I'm researching a piece on Encro phones and crypto standards in >commercial phone software for a book i'm pitching, and also for a series of >planned articles. "Drown me! Roast me! Hang me! Do whatever you please," said Brer Cop. "Only please, Brer Criminal, please don't throw me into^H^H^H^Huse that specific brand of encrypted phone that I definitely can't break". Peter.</blockquote></div> <div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Tue, 9 Jun 2020 at 20:00, <<a href="mailto:messaging-request@moderncrypto.org">messaging-request@moderncrypto.org</a>> wrote: </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-style:solid;border-left-color:rgb(204,204,204);padding-left:1ex">Send Messaging mailing list submissions to <a href="mailto:messaging@moderncrypto.org" target="_blank">messaging@moderncrypto.org</a> To subscribe or unsubscribe via the World Wide Web, visit <a href="https://moderncrypto.org/mailman/listinfo/messaging" rel="noreferrer" target="_blank">https://moderncrypto.org/mailman/listinfo/messaging</a> or, via email, send a message with subject or body 'help' to <a href="mailto:messaging-request@moderncrypto.org" target="_blank">messaging-request@moderncrypto.org</a> You can reach the person managing the list at <a href="mailto:messaging-owner@moderncrypto.org" target="_blank">messaging-owner@moderncrypto.org</a> When replying, please edit your Subject line so it is more specific than "Re: Contents of Messaging digest..." Today's Topics: 1. Re: Crypto standards in modern-day consumer apps (Mike Hearn) 2. Re: Crypto standards in modern-day consumer apps (Thom Wiggers) 3. Re: Crypto standards in modern-day consumer apps (Daniel Lublin) 4. Re: [FORGED] Crypto standards in modern-day consumer apps (Peter Gutmann) 5. Re: Crypto standards in modern-day consumer apps (Jasper Spaans) 6. Re: Crypto standards in modern-day consumer apps (Mike Hearn) ---------------------------------------------------------------------- Message: 1 Date: Tue, 9 Jun 2020 02:18:47 -0700 From: Mike Hearn <<a href="mailto:mike@plan99.net" target="_blank">mike@plan99.net</a>> To: Mike Power <<a href="mailto:mike.power.casual@theguardian.com" target="_blank">mike.power.casual@theguardian.com</a>> Cc: <a href="mailto:messaging@moderncrypto.org" target="_blank">messaging@moderncrypto.org</a> Subject: Re: [messaging] Crypto standards in modern-day consumer apps Message-ID: <CANEZrP2=Urg3YcaUWGYhPai5tY+gdp6uc_Bh=<a href="mailto:sACmDxb-yErOw@mail.gmail.com" target="_blank">sACmDxb-yErOw@mail.gmail.com</a>> Content-Type: text/plain; charset="utf-8" Interesting question. Unfortunately their website offers little more information than the Liverpool Echo article you link to. It appears to simply be a customised Android phone, with a few features that are especially useful for criminals. Without a doubt 95% of the tech in them is the same as you can get on a regular Android phone, but the remaining 5% of the integration and feature work is sufficiently valuable to justify the eyewatering cost. >From looking over the advertised feature set, my guess is the value comes from a very small number of features. The majority of advertised features are industry standard and nothing special, e.g. disk encryption, secure boot, tamper proofing, the message cryptography they discuss etc. They advertise them because they're security related, but they're not actually a competitive advantage. I'd dig in to this mysterious "notary" verification process, which is presumably some method of verifying public keys. They say: "All clients directly negotiate keys automatically with each other’s devices. Our servers, located offshore in our datacenter, never create, store, or decrypt keys, message conversations or user data." To me this implies some sort of Bluetooth based key transfer or key agreement, probably combined with the ability to send keys between users. Sort of like the PGP web of trust but integrated with the phone itself. The point of this would be to ensure police can't force EncroPhone to intercept messages by changing public keys, which is an issue for every centralised messenger otherwise. Users who buy this phone have demonstrated a huge willingness to make effort up front, as apparently to get one you have to know someone who can supply you. You can't buy them from shops. So, they can probably impose rules like "you may only communicate with someone you interacted with physically before, or someone they vouched for", whereas for normal consumer-oriented software it's all about maximum convenience so the messengers all use centralised public key directories linked to phone numbers. The other obvious eye-catching feature is the duress/capture stuff, like being able to request all your contact phones delete all your messages triggered by a panic PIN. There's even mention of a countdown which I suppose can be useful if you suspect you're walking into a trap - you could set up a timer, be grabbed immediately, your phone taken from you without even a chance to touch it at all, and all the evidence is still destroyed. Finally the ability to hide that you're using this phone via dual boot is quite clever. I'll now say something that may be a bit controversial for this list (though it's a point I've made before). It's worth observing that these sorts of features are in many ways a meaningless shell game. EncroPhone are a Dutch company with (presumably) known owners who can be found. All the fancy stuff they advertise is controlled by software. That makes it meaningless because EncroPhone can push a "security update" to their users that disables all of it, or adds arbitrary message interception facilities, without any visible change and at any time. For example, how do the users know the message deletions are really working? The only trustable evidence is complaints from the police. Even though stock Android will notify users that an update is available and ask them to apply it, users can't tell the difference between a real security update that makes their phone harder to hack by the police, and one that makes it easier. No matter what option they take (apply/ignore) there's a risk it's the wrong one. This is a fundamental problem with all end-to-end encrypted messaging services. Despite all the progress made in this space, it all still boils down to the trustworthiness of a brand because the service owners always have the option of just switching it off - and in ways users cannot actually detect except via some sort of hypothetical continuous reverse engineering effort, which nobody anywhere has ever mounted. Whilst pitched for privacy advocates, if that were true they'd presumably make it easier to buy them via their website and charge less. The fact that it's so expensive and that they're only leasable implies something odd is going on there. It won't surprise me if at some point EncroPhone gets silently taken over by the Dutch police and used in a sting operation, in the same way that Tor markets sometimes were. For them to be legally safe they'd have to avoid anything that could be used to prove a criminal conspiracy, which from your description of how they operate and the news articles sounds unlikely. W.R.T. your last question. All consumer messaging systems on smartphones route all messages via central datacenters. That's not unique to WhatsApp and is the entire motivation for the end-to-end encryption features to start with. The only "peer to peer" messaging system that works is SMS, and obviously it's peer to peer only in some pedantic technical sense that the telcos themselves communicate directly with each other (so e.g. messages stay in country). All app-based messengers route messages either via Google/Apple datacenters, or their own, or more typically a mix. Moreover most modern messengers use the same cryptography. Certainly Signal, WhatsApp and probably this EncroPhone thing (which sounds like it uses a modified version of Signal) all use the same underlying tech developed by the sort of people who are on this mailing list. Telegram I don't know, someone else can tell you about that, last I heard they were different and used their own thing. >From a pure cryptographic perspective none of them are really hiding the message metadata people care about and indeed cannot, as the Liverpool Echo story points out (police can still track EncroPhone users via cell sites and messengers must still route messages to the right devices). So with respect to what you can use that your contacts will trust, sorry but I have no idea. -------------- next part -------------- An HTML attachment was scrubbed... URL: <<a href="http://moderncrypto.org/mail-archive/messaging/attachments/20200609/5b2151ca/attachment-0001.html" rel="noreferrer" target="_blank">http://moderncrypto.org/mail-archive/messaging/attachments/20200609/5b2151ca/attachment-0001.html</a>> ------------------------------ Message: 2 Date: Tue, 9 Jun 2020 12:08:14 +0200 From: Thom Wiggers <<a href="mailto:thom@thomwiggers.nl" target="_blank">thom@thomwiggers.nl</a>> To: Mike Hearn <<a href="mailto:mike@plan99.net" target="_blank">mike@plan99.net</a>> Cc: Mike Power <<a href="mailto:mike.power.casual@theguardian.com" target="_blank">mike.power.casual@theguardian.com</a>>, <a href="mailto:messaging@moderncrypto.org" target="_blank">messaging@moderncrypto.org</a> Subject: Re: [messaging] Crypto standards in modern-day consumer apps Message-ID: <<a href="mailto:CABzBS7mC-5TBA_%2BniPMZoJk-Jm5YBP6PcWjFUwurzePHxH5XXw@mail.gmail.com" target="_blank">CABzBS7mC-5TBA_+niPMZoJk-Jm5YBP6PcWjFUwurzePHxH5XXw@mail.gmail.com</a>> Content-Type: text/plain; charset="utf-8" Hi, You wrote: Op di 9 jun. 2020 om 11:19 schreef Mike Hearn <<a href="mailto:mike@plan99.net" target="_blank">mike@plan99.net</a>>: > > Whilst pitched for privacy advocates, if that were true they'd presumably > make it easier to buy them via their website and charge less. The fact that > it's so expensive and that they're only leasable implies something odd is > going on there. It won't surprise me if at some point EncroPhone gets > silently taken over by the Dutch police and used in a sting operation, in > the same way that Tor markets sometimes were. For them to be legally safe > they'd have to avoid anything that could be used to prove a criminal > conspiracy, which from your description of how they operate and the news > articles sounds unlikely. > It's maybe worth to note that Dutch police have done so in the past, see e.g. the Ennetcom case ( <a href="https://www.theguardian.com/world/2016/apr/22/dutch-police-ennetcom-shut-down-owner-arrested" rel="noreferrer" target="_blank">https://www.theguardian.com/world/2016/apr/22/dutch-police-ennetcom-shut-down-owner-arrested</a> ) and IronChat ( <a href="https://nakedsecurity.sophos.com/2018/11/09/258000-encrypted-ironchat-phone-messages-cracked-by-police/" rel="noreferrer" target="_blank">https://nakedsecurity.sophos.com/2018/11/09/258000-encrypted-ironchat-phone-messages-cracked-by-police/</a> ). Cheers, Thom Wiggers > > _______________________________________________ > Messaging mailing list > <a href="mailto:Messaging@moderncrypto.org" target="_blank">Messaging@moderncrypto.org</a> > <a href="https://moderncrypto.org/mailman/listinfo/messaging" rel="noreferrer" target="_blank">https://moderncrypto.org/mailman/listinfo/messaging</a> > -------------- next part -------------- An HTML attachment was scrubbed... URL: <<a href="http://moderncrypto.org/mail-archive/messaging/attachments/20200609/a7588142/attachment-0001.html" rel="noreferrer" target="_blank">http://moderncrypto.org/mail-archive/messaging/attachments/20200609/a7588142/attachment-0001.html</a>> ------------------------------ Message: 3 Date: Tue, 9 Jun 2020 12:26:22 +0200 From: Daniel Lublin <<a href="mailto:daniel@lublin.se" target="_blank">daniel@lublin.se</a>> To: <a href="mailto:messaging@moderncrypto.org" target="_blank">messaging@moderncrypto.org</a> Cc: <a href="mailto:mike@plan99.net" target="_blank">mike@plan99.net</a>, Mike Power <<a href="mailto:mike.power.casual@theguardian.com" target="_blank">mike.power.casual@theguardian.com</a>> Subject: Re: [messaging] Crypto standards in modern-day consumer apps Message-ID: <<a href="mailto:20200609102622.GB34825@ot.lublin.se" target="_blank">20200609102622.GB34825@ot.lublin.se</a>> Content-Type: text/plain; charset=utf-8 > All app-based messengers route messages either via Google/Apple > datacenters, or their own, or more typically a mix. Moreover most modern > messengers use the same cryptography. Perhaps you still mean app-based *consumer* messengers here (and the subject still does). Briar is arguably not among those, but it is indeed an interesting example of a peer-to-peer messenger that tries to avoid leaking of metadata. It has been presented on the list before. <a href="https://briarproject.org/how-it-works/" rel="noreferrer" target="_blank">https://briarproject.org/how-it-works/</a> -- Daniel <a href="http://lublin.se" rel="noreferrer" target="_blank">lublin.se</a> ------------------------------ Message: 4 Date: Tue, 9 Jun 2020 12:11:46 +0000 From: Peter Gutmann <<a href="mailto:pgut001@cs.auckland.ac.nz" target="_blank">pgut001@cs.auckland.ac.nz</a>> To: "<a href="mailto:messaging@moderncrypto.org" target="_blank">messaging@moderncrypto.org</a>" <<a href="mailto:messaging@moderncrypto.org" target="_blank">messaging@moderncrypto.org</a>> Subject: Re: [messaging] [FORGED] Crypto standards in modern-day consumer apps Message-ID: <<a href="mailto:1591704707218.93122@cs.auckland.ac.nz" target="_blank">1591704707218.93122@cs.auckland.ac.nz</a>> Content-Type: text/plain; charset="iso-8859-1" Mike Power <<a href="mailto:mike.power.casual@theguardian.com" target="_blank">mike.power.casual@theguardian.com</a>> writes: >Anyway, I'm researching a piece on Encro phones and crypto standards in >commercial phone software for a book i'm pitching, and also for a series of >planned articles. "Drown me! Roast me! Hang me! Do whatever you please," said Brer Cop. "Only please, Brer Criminal, please don't throw me into^H^H^H^Huse that specific brand of encrypted phone that I definitely can't break". Peter. ------------------------------ Message: 5 Date: Tue, 9 Jun 2020 14:33:31 +0200 From: Jasper Spaans <<a href="mailto:jasper@startmail.com" target="_blank">jasper@startmail.com</a>> To: Mike Power <<a href="mailto:mike.power.casual@theguardian.com" target="_blank">mike.power.casual@theguardian.com</a>> Cc: <a href="mailto:messaging@moderncrypto.org" target="_blank">messaging@moderncrypto.org</a> Subject: Re: [messaging] Crypto standards in modern-day consumer apps Message-ID: <<a href="mailto:676E5E86-D49E-49B7-B7ED-307EE59913EC@startmail.com" target="_blank">676E5E86-D49E-49B7-B7ED-307EE59913EC@startmail.com</a>> Content-Type: text/plain; charset=us-ascii Hi, > On 8 Jun 2020, at 19:45, Mike Power <<a href="mailto:mike.power.casual@theguardian.com" target="_blank">mike.power.casual@theguardian.com</a>> wrote: > > Almost every murder case or major drug bust in Liverpool involves these devices. > <a href="https://encrophone.com/en/" rel="noreferrer" target="_blank">https://encrophone.com/en/</a> Completely off-topic and I have no knowledge of this product, but "encro" sounds like a poor play on the words "encryption" and "Mocro" - the latter being slang for Morocco/Moroccan, popularised some time ago in Dutch by rappers of Moroccan descent, and currently by the book and TV-series "Mocro-maffia". Can't believe that would truly be the origin of this name... Cheers, Jasper ------------------------------ Message: 6 Date: Tue, 9 Jun 2020 06:23:05 -0700 From: Mike Hearn <<a href="mailto:mike@plan99.net" target="_blank">mike@plan99.net</a>> To: Daniel Lublin <<a href="mailto:daniel@lublin.se" target="_blank">daniel@lublin.se</a>> Cc: Mike Power <<a href="mailto:mike.power.casual@theguardian.com" target="_blank">mike.power.casual@theguardian.com</a>>, <a href="mailto:messaging@moderncrypto.org" target="_blank">messaging@moderncrypto.org</a> Subject: Re: [messaging] Crypto standards in modern-day consumer apps Message-ID: <CANEZrP3PHf=agE=<a href="mailto:uWw1LV7DpxWmEnVknasZee4L_7wFOHj%2Bbxw@mail.gmail.com" target="_blank">uWw1LV7DpxWmEnVknasZee4L_7wFOHj+bxw@mail.gmail.com</a>> Content-Type: text/plain; charset="utf-8" Thanks! I didn't know about Briar. Sounds interesting. I used the Orchid library for integrating Tor into Java apps before, it's quite easy to do, surprising we don't see more of it. At least on Android. -------------- next part -------------- An HTML attachment was scrubbed... URL: <<a href="http://moderncrypto.org/mail-archive/messaging/attachments/20200609/81d8b1d1/attachment-0001.html" rel="noreferrer" target="_blank">http://moderncrypto.org/mail-archive/messaging/attachments/20200609/81d8b1d1/attachment-0001.html</a>> ------------------------------ Subject: Digest Footer _______________________________________________ Messaging mailing list <a href="mailto:Messaging@moderncrypto.org" target="_blank">Messaging@moderncrypto.org</a> <a href="https://moderncrypto.org/mailman/listinfo/messaging" rel="noreferrer" target="_blank">https://moderncrypto.org/mailman/listinfo/messaging</a> ------------------------------ End of Messaging Digest, Vol 576, Issue 1 ***************************************** </blockquote></div> <div style="font-size:1.3em;font-family:Arial,Helvetica,sans-serif"><hr></div><div>This e-mail and all attachments are confidential and may also be privileged. If you are not the named recipient, please notify the sender and delete the e-mail and all attachments immediately. Do not disclose the contents to another person. You may not use the information for any purpose, or store, or copy, it in any way. Guardian News & Media Limited is not liable for any computer viruses or other material transmitted with or as part of this e-mail. You should employ virus checking software.</div><div> </div><div>Guardian News & Media Limited is a member of Guardian Media Group plc. Registered Office: PO Box 68164, Kings Place, 90 York Way, London, N1P 2AP. Registered in England Number 908396</div><div style="font-size:1.3em;font-family:Arial,Helvetica,sans-serif"> </div><div style="font-size:1.3em;font-family:Arial,Helvetica,sans-serif"> </div>