WhatsApp, SSH Sign, TLS, 7-zip, AES

1. Studied WhatsApp (@ Wikipedia) multi-device beta implementation and message storage, where, how and how long messages are stored. With traditional single device mode it was (at least said) that messages aren't kept after delivery. It seems that the multi-device mode transmits messages multiple times, encryption separately for each device. Hmm, quite inefficient, but sure can be done. Also messages are encrypted to all devices, recipient and sender devices as well. There's also sync protocol which allows retrieving old messages from devices. This is the thing which is afaik the most vulnerable aspect. Even if messages aren't kept, those can be retrieved retroactively. Ref: WhatsApp multi-device (@ fb.com) and About end-to-end encryption (@ WhatsApp.com)

2. It's Now Possible To Sign Arbitrary Data With Your SSH Keys (@ agwa.name) - Nice post. Yet once again, SSH is not everywhere, nor everyone knows how to use SSH. And as we see, it's basically just as complex to use as PGP is. But let's not say it's bad, it's always good to have options! Then best suitable option for every occasion can be chosen. Tested it immediately and worked like a charm. Adding signature public key to my public keys on my homepage.

3. Finally a Nginx version which allows disabling TLSv1.2 and not only allow adding TLSv1.3. Done, awesome. Now only TLSv1.3 is being used. Don't whine, update your browsers & clients.

4. It would be so nice to have a Matrix room with hidden members, or members only visible to administrators / moderators. Bit like Telegram channel or in classical terms BCC mailing list, if anyone remembers those anymore.

5. New 7-zip version (@ 7-zip.org) with well, warmly welcomed and pretty obvious things. I've been wondering "What's so hard about it". 7-Zip now reduces the number of working CPU threads for compression, if RAM size is not enough for compression with big LZMA2 dictionary. - 7-Zip now can create and check "file.sha256" text files that contain the list of file names and SHA-256 checksums in format compatible with sha256sum program using the -thash option. Naturally immediately cross tested it and it worked great. - Next, Linux update, plz? - Anyway, 7-zip is just awesomeness. Thank you so much Igor! Also got significant performance improvements: 5734 -> 7293 that's over 27% performance improvement! kw: 7z, xz, lzma

6. Weekend packet sniffing, so much fun. One old proprietary military-grade encryption turned out to be AES-128 (@ Wikipedia) using ECB (@ Wikipedia) mode of operation with password SHA-1 (@ Wikipedia) key. AES-128 still provides key recovery resistance, so it's not trivial to figure out the key. But known plaintext attack work against that extremely well, allowing trivial spotting of future references to that known plaintext after the code book mapping. ECB is so easy to spot, even by eye in wildly scrolling HEX dump. What? Repeated "random" patterns, every 16 / 32 bytes, well, I know what that is. - Next point is of course again the real world vs security theater fantasy. Most of users never enable security features, so even if the encryption would be good, it wouldn't be used anyway. So why bother with good encryption, if nobody actually cares about it? - Painful truths. - After observing some more traffic, it's clear that very high percentage of users didn't even use the bad encryption, and even if it would be state of art, they still probably wouldn't use it anyway. So does it matter if the encryption is bad?

7. Lots of discussion in closed privacy group about technical details of Session, Briar, Delta Chat and how those compare to other options like Signal and classic OpenPGP. What are the pros and cons of every solution and how the design choices affect practical security. How it can be defined if contact can be "trusted". Well, it's technically impossible. That's exactly the problem with NFTs now when I said it. Even if the solution confidentiality and technical trust would be absolutely flawless truly perfect, it still doesn't mean that the you should contact the other end aka counter party.

8. Something different? - Next Generation Air Dominance (NGAD) (@ Wikipedia), interesting project to watch in future. Also see: F/A-XX (@ Wikipedia) - ADaptive VErsatile ENgine Technology (ADVENT) (@ Wikipedia).

2023-01-22