nkobeissi

My only question is the following: what protection is there against the server sending a correct remote attestation for the code being executed to the client, and then, right after this attestation is validated, the server rerouting the network pipe so that the contact list the client sends goes to a different server running different, non-SGX code?

I ask that as a non-expert in SGX, so this might be something that has an obvious answer.

Edited to add: Also, isn't it the case that verifying SGX remote attestations requires phoning home to Intel? If that's the case here (and I'm not sure that it is,) is Intel consequently able to build an IP address graph of Signal users?

1. Original Note 7 phones were blowing up, Samsung issued a recall.

2. Samsung released (suspiciously quickly) a new phone that used new batteries made by Amperex, which also provides batteries for the iPhone line. [A]

3. A report comes in of a post-recall, "safe" phone blowing up while not being connected to a charger and being turned off to be put in the owner's pocket. [B]

4. Another report of a "safe" phone blowing up while in the back pocket of its owner. [C]

5. Two more reports come in, both of a Note 7 blowing up overnight while their owners were asleep. [D,E]

Second, here's what I don't understand:

* We know the batteries are likely safe since they come from a reputed manufacturer also providing iPhones their batteries. Heck, even the initial battery manufacturer was Samsung itself, and Li-Ion batteries aren't exactly a new and unstudied technology.

* Even after the new batteries were put in use, the phones are still exploding even when not connected to a charger, as explicitly stated by reports [D] and [C], and as is likely the case for [B] and [E].

How are these phones blowing up when, in all likelihood, the batteries are safe and have been replaced, and the phone isn't even under heavy use at the time of the explosion? Maybe you could blame CPU heating or a faulty charging mechanism, but the phones were not charging or under heavy load. All they were doing was discharging at an idle rate. This is literally the state least likely to cause this kind of explosion.

Can anyone explain what I'm missing?

Sources:

* AES-CTR counter-reuse (2012)

* Biased Fortuna CSPRNG implementation [1] (2013)

To be sure, Cryptocat's substandard reputation was well-deserved; but all the same, I think that every vulnerability that did pop up was addressed responsibly and with full disclosure.

Since then, there has been a major rewrite that I am conversely quite happy with.

Given that I'm mentioned by name (and tied to a bunch of exaggerated claims), I'd like to clarify a few points.

1. I never claimed that a GPL violation was impossible because of different programming languages. I merely questioned whether this was the case with Wire's Rust codebase [0], given that its data structures, namespacing etc. are substantially different from the OWS Java code [1]. To me, different code organization + different implementation style + different programming language don't exactly amount to a line-by-line conversion from Java to Rust as OWS seems to be claiming.

2. Cryptocat does not compete with Signal: it's a desktop XMPP client that focuses on synchronous messaging (that I write in my free time and with no funding or business plan, to boot), and does not at all target the mobile space. I was very happy to adopt a variant of Signal Protocol into Cryptocat and consider Signal's contributions to the field of secure messaging to be highly valuable. I'm not sure why tptacek brings up Cryptocat (completely unrelated to this discussion) but by all means, don't avoid it! The recent rewrite is pretty good, actually.

Overall, this situation just struck me as very ugly. Moxie seemed at some point to be reticent to allow fully independent implementations of the protocol, and Wire's lawsuit was pretty aggressive. Both parties locked in a catfight and then (apparently?) realized their approaches were counterproductive and gave it up.

The best resolution here, in my view, would have been for Moxie to publish a public-domain reference specification document of Signal Protocol that's independent of the code, and for Wire to be allowed to write a Rust implementation of it without any party causing drama.