Conversation about IM distress signals

Stefano Palazzo

Jul 13, 2011 20:05

I'm using OTR to communicate with someone. It'd be nice to have a special message that you can send that triggers a distress alarm on the other end, like "I'm being coerced into sending this message, don't trust its content"

AviD

@thisjosh good point.

@StefanoPalazzo how bout... "HELP!!!"

ahh, thats what you mean.

Scott Pack

Or, 'See the violence inherent in the system!'

this.josh

@Stefano you are looking for covert communication

AviD

someone a while ago (I think it may have been @nealmcb?) suggested using a different private key, used only for distress situations.

Stefano Palazzo

Mh I can't find anything related there

just this, seems to be unrelated:

> Steganography is the science of hidden writing, or using a covert communications channel that is totally visible — yet “unseen” — by a third party.

this.josh

Jul 13, 2011 20:09

interesting problem, signaling coerced communication. I would think that you would want the signal to be in-band

Stefano Palazzo

yes

as normal as possible. Only the client software at the other end should be able to detect the signal

I suppose :)

this.josh

I assume that the trigger mechanism must be subtle such that an observer would not be able to detect it, but require an overt action such that the sender does not accidently trip the mechanism

Stefano Palazzo

Shouldn't that be just as simple as sending a hash of your secret distress message to the other party, at the start of the conversation?

this.josh

quite contradictory

Stefano Palazzo

@thisjosh I'm thinking of a specified message that you know. Such as "Hello may I talk to you at this time" ← which would be an example of something I'm unlikely to type

this.josh

Jul 13, 2011 20:14

That might work as long as you are the only one who has access to the transmitter and a coercer is not dictating the message.

Stefano Palazzo

true, It'd be useless then.

I will ask a question on the site, why not

this.josh

No, you want a mechanism that you can trigger even if the coercer dictates the message.

Stefano Palazzo

yeah that's what I was responding to :)

the big flaw in my idea

this.josh

Something like typing the third word incorrectly and then deleting it and retyping it correctly.

Stefano Palazzo

thats a good call, but also fairly easy to do by mistake

AviD

Jul 13, 2011 20:18

@thisjosh sounds like a violation of kerkchoff's law.

Stefano Palazzo

then you'd have to go through the whole business of authenticating again (which would defeat the point of OTR being so easy to use)

this.josh

Yes @AviD, but the problem is the perform a signaling action while being observed without the observer detecting the signaling.

@AviD notice where I said 'the trigger mechanism must be subtle such that an observer would not be able to detect it, but require an overt action such that the sender does not accidently trip the mechanism'

AviD

@thisjosh of course. but I'm sure we should be able to figure out a protocol, that is secure even in the face of the attacker knowing the protocol

this.josh

btw how do you link to a previous chat line?

AviD

@thisjosh agree that

@thisjosh link == reply or quote?

this.josh

Jul 13, 2011 20:21

either

AviD

reply: theres a little arrow on the right corner, when you hover over a message.

this.josh

@AviD like this?

AviD

quote: you just paste the permalink.
like so:

1 min ago, by this.josh

btw how do you link to a previous chat line?

@thisjosh by jove I think she's got it!

for quoting it needs to be on its own line, for onebox effect.

for either, you can get it from the little popup menu for the message...

this.josh

testing permalink: chat.stackexchange.com/transcript/message/1346060#1346060

Iszi

Just in case anyone's interested, the Amateur Radio proposal on Area 51 is finally in the Commitment phase.

area51.stackexchange.com/proposals/1795/…

Scott Pack

Jul 13, 2011 20:23

@thisjosh One-Boxing must be on it's own line

Iszi

@thisjosh It only works if you post only the link.

this.josh

test

1 min ago, by AviD

quote: you just paste the permalink.
like so:

AviD

@RebeccaChernoff any response to my owasp meta q?

Stefano Palazzo

Mh.. there could be a protocol that triggers a signal when you fail to do something (well, it'd have to be unique so that the attacker doesn't know what it is, not the best idea I guess)

Iszi

@HendrikBrummermann Huh? I'm not quite sure what you're referring to.

AviD

Jul 13, 2011 20:25

@StefanoPalazzo but if they know the protocol, they can force you to do it.

Stefano Palazzo

absolutely, yeah.

this.josh

or not do it

AviD

that's why I like @nealmcb's idea, e.g. they force you to sign it with your private key, but they dont know which is the real one.

Stefano Palazzo

also, the usability people would not like it :)

Rebecca Chernoff

@AviD I'll raise it on our weekly call.

AviD

Jul 13, 2011 20:27

though, I suppose even that could be overcome by examining previous communications....

@RebeccaChernoff thanks!

Stefano Palazzo

I suppose you could have a hidden distress button, just like they have in banks - but that's hard to do in software :P

Iszi

@HendrikBrummermann Nevermind. I think I got it now. Sometimes it's just tricky to parse references to parts of a conversation that happened hours ago.

this.josh

@AviD are you propoing that the trigger is part of the protocol

Iszi

...and, while I'm catching up on my Inbox, it seems I'm missing some interesting discussion...?

AviD

@thisjosh protocol, I meant "security protocol", not "network protocol".

@Iszi strange, right? security talks are only 4th or 5th on our list of preferred topics!

Iszi

Jul 13, 2011 20:30

@AviD Exactly. That's why this was totally unexpected!

Scott Pack

@AviD We haven't talked about food or drink since yesterday (that I can think of)

AviD

@ScottPack speaking of which, I am quite hungry. I think its dinner time.

this.josh

@AviD Yea I understand that, but I don't think that a trigger is necessarily part of a protocol. Clicking a send button on a web page isn't part of http.

AviD

and just to round it out, I'm gonna need a whiskey to get me through the piles of fortify crap I have waiting for me tonight...

Scott Pack

@AviD Getting pretty close for me too. I don't know what I'm having for dinner, but I do know that I'm taking a 5L keg to the gaming table tonight.

Hendrik Brummermann

Jul 13, 2011 20:32

@Iszi Sorry, i was not able to reply to your message. I saw it in the drop down notification list, but it opened another window without chat box and without reply arrow.

AviD

@thisjosh um Im not sure I'm understanding you? the trigger is the protocol.

@ScottPack oo niiice

what flavor?

Stefano Palazzo

> I could dispatch a distress call through the computer... Lynn glanced at her
screen from afar and saw that her backup had been completed, immedi-
ately embarrassed that she had cared about the backup at all. Always the
scientist. Some strange loony in your room and you think about your data.
Clever. Darwin Award, here I come. (from 'Schemata', by Michael Markefka)

Scott Pack

@AviD Newcastle. Nothing fancy, but for the kegerator our host has it's either that or Heineken.

AviD

@ScottPack ehh. Dont know newcastle, but I'm sure its better than heineken.

this.josh

@AviD I don't see it that way

Iszi

Jul 13, 2011 20:34

@HendrikBrummermann There's a trick to that. Copy the permalink, nuke everything but the last string of numbers, put a colon in front of it and then a space and your reply behind it.

AviD

not that its bad, per se, but not my favorite....

Scott Pack

@AviD It's a mass produced English brown ale.

AviD

wouldnt that make it a lager?

Scott Pack

@Iszi Or you hover over the message, and click the 'reply' arrow on the right hand side

@AviD No, because it's an ale :)

Iszi

@HendrikBrummermann Example...
For permalink: `http://chat.stackexchange.com/transcript/message/1346182#1346182`
Reply like so: `:1346182 This is my reply`

this.josh

Jul 13, 2011 20:36

I think of a protocol as a set of rules regarding the passing of messages and the setting of states after receiving messages.

Iszi

@ScottPack Doesn't work if you're trying to reply to a message from an older log.

Odd. MarkDown didn't parse my back-ticks there.

Scott Pack

@Iszi From the transcripts? I could believe that, I haven't tried that before.

AviD

@thisjosh okay, right... so, isnt the "trigger" just a definition of what messages to pass?

Iszi

@ScottPack It's an annoyance.

AviD

or did you mean an actual trigger??

Stefano Palazzo

Jul 13, 2011 20:38

the protocol without any trigger is pretty trivial :)

this.josh

I meant overt action taken by the message sender to invoke the part of the protocol that sends the message 'I'm being coerced' within the normal message passing.

nealmcb

Japan beats Sweden, so it's US-Japan on Sunday....

Stefano Palazzo

you just have to make the distress-message look like any other message, so that a MITM can't filter it (if we're thinking of unlikely scenarios anyway)

this.josh

Not so unlikely @Stefano

AviD

@thisjosh ah now I see - we are talking about different things. In my mind, the protocol may not require a special message - but a different form of message. e.g. different signage.

anyway, the overt action would have to be part of the protocol, thats what its defining, no?

Stefano Palazzo

Jul 13, 2011 20:40

the distress-protocol, whatever trigger it uses, it has to be designed to be easy to trigger

this.josh

It is quite easy to add a protocol analyzer to most common communications channels.

Stefano Palazzo

so maybe it's really more of a user-interface question

this.josh

Yes, I'm separating the problem into parts. I assume that the coercer is observing the sender. The sender is sending a message using a method known well to the coercer.

AviD

@thisjosh and, the coercer is familiar with the protocol ;)

this.josh

The sender must perform an action to invoke a protocol which signals to the message receiver that the sender is being coerced.

AviD

Jul 13, 2011 20:44

dont forget kerckoff...

@thisjosh without the coercer knowing, even though he's looking for it.

this.josh

precisely!

AviD

hmm... can we assume greenfield?

this.josh

Think of a coercer forcing someone to phone their bank to transfer a large sum of money.

AviD

no, that wouldnt make sense...

e.g. calling from the wrong phone number.

this.josh

Greenfield?

AviD

Jul 13, 2011 20:46

i.e. no prior history of communications.

Stefano Palazzo

@AviD I'd rather not, let's assume we design an add-on to the OTR plugin

this.josh

Do you think that is out of band?

Stefano Palazzo

oh I misunderstood, never mind

AviD

like e.g. with the bank, someone can peruse the phone records, to see if the wrong # was used before.

@thisjosh no, I think it defines the band.

this.josh

Yes, the coercer is going to be looking for the sender to signal distress

AviD

Jul 13, 2011 20:48

@thisjosh not only that, the coercer knows how the sender is supposed to signal distress.

this.josh

So a sophisticated coercer who is analyzing the message must not be able to detect the message

Iszi

Holy crap, the chat is busy today. And on-topic. Who knew this would happen just from the site graduating?

AviD

@Iszi LOL!!

I blame @StefanoPalazzo

i.e. the protocol encapsulates down to a small secret, or key.

Stefano Palazzo

I'll not take credit for that :-) It's your awesome design and, more importantly, the content it's makes me want to look at

AviD

i.e. Kerchkoff's Law! :)

this.josh

Jul 13, 2011 20:49

i.e. If the coercer has a network analyzer of the cat5e coming out of your computer they better not see 'I'm being coerced' in the plaintext

AviD

@thisjosh and, if you suddenly start talking about "popcorn" or "bananas" it better be ontopic.

this.josh

Yes, and the smaller it is the less detectable it is, but the smaller it is the more error prone it may be.

Stefano Palazzo

if you put it like this, it's very hard indeed.

you could imagine something like ending a sentence with the letter Q. but that doesn't work when the attacker is looking for a distress signal, even though there are millions of variations on that method, of which you could negotiate one at the start of the conversation

this.josh

@AviD bingo! The coercer is expecting the sender to send a covert signal.

So the coercer can not observe the sender initiating the signal, i.e pressing some complicated keyboard sequence you would not normally see

AviD

i think now you have the basis for a meaty question. why dont you pop it up, see who throws a cat at the flagpole?

there might already be answers to this.

Stefano Palazzo

Jul 13, 2011 20:53

It's a bit open ended but I will, yes

AviD

my money is on either @ThomasPornin or @bethlakshmi...

nealmcb

@AviD [hmm - which is this link?]

AviD

@nealmcb no? what?

this.josh

Verry difficult, preventing the coercer from noticing the 'triggering', hiding the message in the transmission, preventing accidental triggering, and preventing error from destroying the message before getting to the sender.

nealmcb

I wish there was an easier workflow while reading a long backlog for keeping track of what I want to reply to (but not replying until I learn whether others ahve replied....)

AviD

Jul 13, 2011 20:55

@nealmcb oh yeah. I usually read only during the day, and answer (wall o' text) at night...

@thisjosh throw in a log of previous communications for comparison, if we're talking APT.

nealmcb

@AviD That may refer to some technique in steganography and file encryption where you have multiple options, or hidden files within hidden files

Stefano Palazzo

uhm, what are good tags for this?

intrusion and authentication?

AviD

@nealmcb ah, yeah, that could be it...

this.josh

@AviD Yes, but I was thinking more generally. I am sure another carrier protocol could be used it it worked better with that.

AviD

@StefanoPalazzo i would say more physical than intrusion.

this.josh

Jul 13, 2011 20:57

[confidentiality]

AviD

privacy?

Stefano Palazzo

I can't create tags despite my blue username :)

AviD

@thisjosh put in a [tag: ...

Stefano Palazzo

People will find the edit button :)

0

Q: What's a good way to trigger a hidden 'distress signal' in instant messaging?

Here's the scenario: Alice and bob use Off-the-record messaging to communicate over IM. The have: Encryption Authentication Deniability Perfect forward secrecy They communicate after authenticating, being reasonably sure of each others identity. Now a rouge party breaks into Alice's house. ...

also, add your possible problems and things to consider to the question

The DMZ

Participants