https://blog.cryptographyengineering.com/2020/07/10/a-few-thoughts-about-signals-secure-value-recovery/
By Matthew Green
July 10, 2020
Over the past several months, Signal has been rolling out a raft of new
features to make its app more usable. One of those features has recently been
raising a bit of controversy with users. This is a contact list backup feature
based on a new system called Secure Value Recovery, or SVR. The SVR feature
allows Signal to upload your contacts into Signal’s servers without —
ostensibly — even Signal itself being able to access it.
The new Signal approach has created some trauma with security people, due to
the fact that it was recently enabled without a particularly clear explanation.
For a shorter summary of the issue, see this article. In this post, I want to
delve a little bit deeper into why these decisions have made me so concerned,
and what Signal is doing to try to mitigate those concerns.
What’s Signal, and why does it matter?
For those who aren’t familiar with it, Signal is an open-source app developed
by Moxie Marlinkspike’s Signal Technology Foundation. Signal has received a lot
of love from the security community. There are basically two reasons for this.
First: the Signal app has served as a sort of technology demo for the Signal
Protocol, which is the fundamental underlying cryptography that powers popular
apps like Facebook Messenger and WhatsApp, and all their billions of users.
Second, the Signal app itself is popular with security-minded people, mostly
because the app, with its relatively smaller and more technical user base, has
tended towards a no-compromises approach to the security experience. Wherever
usability concerns have come into conflict with security, Signal has
historically chosen the more cautious and safer approach — as compared to more
commercial alternatives like WhatsApp. As a strategy for obtaining large-scale
adoption, this is a lousy one. If your goal is to build a really secure
messaging product, it’s very impressive.
[...]
--
Subscribe to InfoSec News
https://www.infosecnews.org/subscribe-to-infosec-news/
Follow InfoSec News on Twitter
https://twitter.com/infosecnews_
Follow InfoSec News on LinkedIn
https://www.linkedin.com/company/infosecnews/
