Home | Community | Message Board
You are not signed in.
Sign In New Account
Forum Index Search Posts Trusted Vendors Highlights Galleries FAQ User List Chat Store Random Growery


This site includes paid links. Please support our sponsors.

Community > Security and Safety
Threaded Mode Threaded  Previous topic Previous  View all topics Index  Next topic Next 

Welcome to the Shroomery Message Board! You are experiencing a small sample of what the site has to offer. Please login or register to post messages and view our exclusive members-only content. You'll gain access to additional forums, file attachments, board customizations, encrypted private messages, and much more!

Unfolding Nature Shop: Unfolding Nature: Being in the Implicate Order

Jump to first unread post Pages: 1
Secure Private Message not that secure.
    #4417221 -

Sorry to do this folks but the secure messages aren't that secure.
When are they secure?
1. When the server simply raided and a copy of the machine ( or the actualy machine ) is taken.
2. When someone compromises your account but does not have the private key or the passphrase. ( They are least likely to have the passphrase since it can't be stolen use a XSS [ cross site script ] where as your login and private key can be. ) <-- no protection will save you if they have all three
3. When someone can monitor a connect between you and the server but can not insert,delete,modify the data traveling over the connection. ( Passive attacks).

Whats the problem well the problem is both the decryption and encryption happen on the server. Why this bad? well if either the server or a connection to the server is compromised they can potential can read everything.

First the whe you setup secure message service you send the server the passphrase over a SSL/TLS tunnel to the server. It then sends you a copy of the private key over a SSL/TLS tunnel to the server ( and hopefully deletes the local copy of the key when you smack complete).

Message you send are sent over a SSL/TLS tunnel to the server. The server software then gets a copy of message you send in plain text. The server encrypts and stores and encrypted copy in the database. The reciever ask the for the message and the server send them a copy of the encrypted. The reciever then sends the server a copy of the passphrase and the privatekey file ( basicly private key encrypted with the passphrase ) over a SSL/TLS tunnel to the server. The server then sends an unencrypted copy of the message back to the user over a over a SSL/TLS tunnel.

Methods off attack.
1. Attack the SSL/TLS tunnel this can be done with a man in the middle attack if there a link between you and the server is compromised and they can view,modify,insert and delete data.

This allows them to get your passphrase and private key during the setup stage.
This allows them to read message you send before they are encrypted at the server.
This allows them to get your passphrase and private key during the decoding stage.
This allows them to read message you reciever before they are decrypted at the server.

Steps you can take protect yourself.
1. Don't send "private" messages.
2. Don't use the web based decoder download a copy of gnuPGP ( or other PGP utility ) and decode it locally on your own pc.
3. Disable all trusted Certificate authorities ask multiple people and peferable also the shroomy site owner for a copy of the SSL/TLS certificate and add this certificate as trusted certificate for the browser. If you do this and the certificate is changed (i.e. someone sends you a fake one which they have the private key of) you will know.

2. Attack the SSL/TLS tunnel with a compromised private key for shroomery.org.

This will allow the attacker to do everything in #1.

Prevention 1. and 2. from #1


3. Attack the server there are multiple ways to do this and will depends on the server itself.

This will allow the attacker to do everything in #1.
If they have your passphrase and private key they will be able to decrypt all your stored messages.

Prevention 1. and 2. from #1 and delete all stored messages.

Additional attacks.
Compromising your login this can be done either by a compromising a link between you and the server ( only requires them to be able to view your data ) or potential by XSS ( I don't know of any infopop ) this will allow them to login as you.

Solution to stop the potential of XSS attacks if one actually exists don't use the remeber my password. If the link is compromised theres nothing you can do.

Comprise of all stored if attacks #1 or #2 get your passphrase and private and an attack gets your login details.

Soltion use all the above mentioned solution and delete stored messages.


So if you really want to discuss stuff privately I'd suggest sharing your PGP keys with your friends and do all the PGP yourself and stop using the secure message functionality.

Edited by bloodbob (07/18/05 01:28 AM)

Extras: Filter Print Post Top
Re: Secure Private Message not that secure. [Re: bloodbob]
    #4417746 -

Hello,

Welcome to the board and thanks for your insight. You make some good points about electronic security and while I am certainly not an expert in cryptography, I believe there are a few areas where you overstate the risks involved. For instance:

Quote:
Attack the SSL/TLS tunnel this can be done with a man in the middle attack if there a link between you and the server is compromised and they can view,modify,insert and delete data.


This is not as easy as you make it sound. From Wikipedia:

Quote:
Client and server negotiate a common secret called "master secret". All other key data is derived from this secret (and the client- and server-generated random values), which is passed through a carefully designed "Pseudo Random Function". TLS has a variety of security measures: [...] Protection against several known attacks (including man in the middle attacks), like those involving a downgrade of the protocol to previous (less secure) versions, or weaker cipher suites.


If breaking SSL was trivial, ecommerce would be impossible because thieves would grab every credit card number that traveled across the net. While no method of communication is bulletproof, and you are correct that running PGP locally eliminates one possible avenue of attack, in general I would say that if someone puts the effort into cracking your secure PMs through a compromised SSL connection you're probably going to end up in trouble no matter what.

Quote:
2. Attack the SSL/TLS tunnel with a compromised private key for shroomery.org.
3. Attack the server there are multiple ways to do this and will depends on the server itself.



Again you say this like it's trivial, but really it's just a fact that any 'secure' system is only as strong as its weakest link. Yes, if someone gains access to our server they could steal our private key or even just covertly edit the PM script to include them as the recipient of any secure message. Ultimately we rely on a couple of dedicated and talented admins who make sure our boxes are as bullet-proof as possible. So far they've been doing an excellent job. :smile:

While you generally give good advice for ways to reduce or eliminate the potential risks of our secure PM system, people should understand that it is still much more secure than plain-text e-mail or IMs. For our members who don't want to mess with PGP and aren't used to taking any extra security precautions with their correspondence, this is a quick and easy way to add a layer of protection to anything they may wish to discuss.

Peace,

-Y

Extras: Filter Print Post Top
Re: Secure Private Message not that secure. [Re: Ythan]
    #4417837 -

Ythan said:
If breaking SSL was trivial, ecommerce would be impossible because thieves would grab every credit card number that traveled across the net.

Yeah it is pretty trival you can do a man in the middle attack with a squid proxy server http://www.squid-cache.org/Doc/FAQ/FAQ-19.html#ss19.2 how else would you cache and encrypted connection.
Its not quite this simple in practice because it would require middle man to get in between each transaction and well any reputably site has a certificate sign by a certificate authority. Now if you pay money ect to a CA to get a certificate there is going to be a paper work trail back to you and well this kind of activity would be illegal without a warrent. Also if anyone noticed a change in the certificate it would be a dead give away it only takes one person but how often do people check?

Quote:
Quote:
2. Attack the SSL/TLS tunnel with a compromised private key for shroomery.org.
3. Attack the server there are multiple ways to do this and will depends on the server itself.


Again you say this like it's trivial,

All it would take is the apprioate court order and gag order due to the nature of this website it is a possiblity( though doubtful its more likely gonna have the plugged pulled ).

Quote:
While you generally give good advice for ways to reduce or eliminate the potential risks of our secure PM system, people should understand that it is still much more secure than plain-text e-mail or IMs. For our members who don't want to mess with PGP and aren't used to taking any extra security precautions with their correspondence, this is a quick and easy way to add a layer of protection to anything they may wish to discuss.


That is of course quite true and you'll be safe if any of these happen
Quote:
1. When the server simply raided and a copy of the machine ( or the actualy machine ) is taken.
2. When someone compromises your account but does not have the private key or the passphrase. ( They are least likely to have the passphrase since it can't be stolen use a XSS [ cross site script ] where as your login and private key can be. )
3. When someone can monitor a connect between you and the server but can not insert,delete,modify the data traveling over the connection. ( Passive attacks).


Edited by bloodbob (07/18/05 05:10 AM)

Extras: Filter Print Post Top
Jump to top Pages: 1

Unfolding Nature Shop: Unfolding Nature: Being in the Implicate Order

Community > Security and Safety
Threaded Mode Threaded  Previous topic Previous  View all topics Index  Next topic Next 

Similar ThreadsPosterViewsRepliesLast post
* Secure private message question. Delinquentes 408 1 02/17/06 07:10 PM
by dblaney
* The BASICS of Securing your computer and E-mail. Cyber 2,905 12 06/09/09 05:34 PM
by Alan Rockefeller
* Security status of privatly used forums? What internet security rules apply? PsillyNilly 921 6 03/08/05 11:34 PM
by THE KRAT BARON
* security of aol IM drewcifer 1,195 4 03/02/04 03:16 PM
by valour
* Secure Email theocean06 1,522 12 01/24/05 10:58 AM
by nife
* a simple philosophy on security wilshire 642 3 10/10/05 07:13 PM
by License_to_Chill
* Firewall advice and help reflectedlight 2,296 8 11/01/03 04:51 PM
by FiddleMyDiddle
* A Little SSL maybe???? Elemicin 338 1 09/22/05 07:43 PM
by Ythan

Extra information
You cannot start new topics / You cannot reply to topics
HTML is disabled / BBCode is enabled
Moderator: Enlil, Alan Rockefeller
1,098 topic views. 0 members, 1 guests and 0 web crawlers are browsing this forum.
[ Show Images Only | Sort by Score | Print Topic ]
Search this thread:

Copyright 1997-2026 Mind Media. Some rights reserved.

Generated in 0.028 seconds spending 0.006 seconds on 15 queries.