Hallo 
Gruß Ingo
Gerade wieder einen neuen Messenger entdeckt:
Meshenger
Github: https://github.com/meshenger-app
GooglePlay: https://play.google.com/store/apps/details?id=app.meshenger
Bis jetzt ohne bekannte Tracker: https://reports.exodus-privacy.eu.org/de/reports/search/app.meshenger/
Hallo
Gruß Ingo
Das ist zwar nicht wirklich ein Artikel, aber im Signal Forum gibt es einen Post von einem User über Threema (in Englisch), der erklären will, warum Threema's Verschlüsselung trotz des neuen IBEX Protokolls und die Sicherheit von Gruppenchats im Vergleich mit Signal's Implementierung unterlegen ist (ich habe den Text mal hier her kopiert):
Disclaimer: This is obviously not a formal audit, as I only looked at the whitepaper. I didn’t look at the source code, nor did I perform any in vivo experiments.
I can ignore all the FUD Threema spreads for the sake of this analysis, but one problem persists - we know nothing about the people behind Threema. We don’t know who created this cryptographic/architectural design, which makes me wonder: aren’t they proud of their work? (This is purely informational and I acknowledge that if the work is sound, you don’t need to attach your CV.)
- Threema’s group messaging design is susceptible to invisible salamanders, because “when a user sends a message to a group, it is individually encrypted and sent to each other group member”. This problem persists from the original Threema protocol and was first described here by Soatok.
"[Threema’s design] provides no group messaging authentication whatsoever. A user with a malicious Threema client can trivially join a group then send different messages to different recipients.
[…] Additionally, there’s an invisible salamanders attack with media files. […] To exploit the Invisible Salamanders attack: 1. Generate two (or more) XSalsa20-Poly1305 keys that will encrypt different media files to a given ciphertext + tag. 2. Send a different key to a different subset of group participants.
Both parties will download the same encrypted file, but will see a different plaintext."- What are the reasons they use XSalsa20 instead of AES or ChaCha20?
- Why do they say stuff like “Note that Threema does not use the flawed Dual_EC_DRBG random number generator”? Why would they point out what they do not use in the whitepaper?
- PFS [Perfect Forward Secrecy] can be enabled per contact using a switch in the contact’s details…
- They say PFS relays on ephemeral Curve25519 key pairs, but there’s no information when those keys are rotated. That’s important, because we’ve seen some truly mind-boggling concepts (looking at you - Telegram!), like rotating the keys after 100 messages/1 week.
- They try to use some kind of a ratchet, but it’s very strange:
“For each message, a new chain key is derived by hashing the previous chain key using BLAKE2b […] From the chain key, an actual message encryption key is derived by applying BLAKE2b again”
Using plain hash function here instead of an HKDF (KDF based on HMAC aka key derivation function based on hash-based message authentication code) is technically good enough, but it’s not the best practice. Using HKDF you can generate several keys, which is exactly what Signal Protocol does, and use one as a chain key to advance the ratchet and the other a message key to encrypt the message.- “The Threema app remembers the nonce of every message that has been sent in the past, and rejects messages with duplicate nonces. Since the server cannot successfully modify the nonce of a message without knowing the private key of one of the parties involved in the communication, this prevents a malicious server from replaying/duplicating previously sent messages.”
Wait a minute… Why would the app need to store nonce of every message?! In case of Signal’s Double Ratchet such “replaying” would be impossible, because ratchets have already been moved forward! (In case you’re wondering how Signal/Double Ratchet handles out-of-order messages: messages’s number in the sending chain is included in the message header. “This enables the recipient to advance to the relevant message key while storing skipped message keys in case the skipped messages arrive later.”)- Threema uses off-the-shelf WebRTC, which makes their attack surface larger than Signal’s handcrafted WebRTC fork and middleware library written in Rust - RingRTC (More information: Signal media coverage — please post articles you found about Signal - #1897 by VerifiedSignalUser 1)
- Threema for iOS is protected using the iOS Data Protection class NSFileProtectionCompleteUntilFirstUserAuthentication (The file is stored in an encrypted format on disk and cannot be accessed until after the device has booted.), which is a significant issue from a forensics perspective!
Signal uses NSFileProtectionComplete (apart from message notification sounds and some temporary directory) which means its data is stored encrypted and cannot be accessed while the device is locked or booting.- If the user chooses to synchronize their contacts - HMAC-SHA256 of normalized phone numbers are uploaded to the directory server. “[Servers] never store hashes uploaded during synchronization in persistent storage, but instead discard them as soon as the list of matching IDs has been returned to the client.”
No secure enclaves, no oblivious RAM, why bother!?
Signal’s making 3 nm semiconductors, while Threema’s stuck with stone tools.Architecturally Threema still lacks the maturity and polish of Signal. Their new protocol, while being a significant improvement over its predecessor, cannot outweigh dubious design choices in the app itself.
When Signal introduces usernames and phone number privacy there would be no incentive to use Threema over Signal.
Der Kommentar im Signal Forum ist (leider) grösstenteils FUD. Bzgl. NSFileProtectionCompleteUntilFirstUserAuthentication vs. NSFileProtectionComplete kenne ich mich nicht aus.
Korrekt ist:
Die anderen Punkte sind FUD:
Ein weiterer Bericht über WhatsApp:
Ein (weiterer) Bericht über xx messenger:
Exodus hat aber 2 Tracker gefunden:
Wohl eher Telegramm?
Im Ernst ... hatte schon Sorge, dass Telegram in Europa aufgrund der nahenden Chatkontrolle eingestellt wird
(und damit möglicherweise auch Threema)
So wie WhatsApp in GB einen Rückzug angekündigt hat.
Da hab ich wohl gaaaaanz unabsichtlich das zweite "m" vergessen 
Konnte nicht widerstehen 
👍 Daumen hoch, auch wenn es Peanuts sind.
Die irische sog. Datenschutzbehörde ist ja sowieso mehr ein Lobbyverein für BigData.
Also kein Datenschutz oder wie muss man dies konkret verstehen?
Also kein Datenschutz oder wie muss man dies konkret verstehen?
Nur wenn Datenschutzbehörden anderer Staaten die Iren mit der Nase drauf stoßen überlegen diese, ob sie vielleicht doch mal etwas tun müssen …
