Hey guys!
First of all i want to say Great job for this project.
I want to ask you about wbb chat app.
Can some1 pls explain me, i am no tech, why this chat is so safe compare with other similar product(telegram messenger etc)
Thanks
Hi,
sure it has a much higher encryption standard to start with .
Users are created with two ECC (secp521) key pairs one for key derivation, and one for signing.
The username plus key pairs create a ‘WBB Chat identity’. This identity is stored on the device symmetrically encrypted using 256 bit AES-GCM with a PKCS5S2 key derived from the user’s password (plus salt and other data). The public keys are uploaded to the server where they are signed by the server using the server’s private key. A user may create multiple identities and switch between them at will.
To login the client generates a signature using the identity’s private signing key against the username, password, and randomly generated data. The server validates the client provided username, password, and aforementioned signature against its stored public signing key for the identity in question.
As the exchange occurs over SSL, session cookies are thought to be a secure enough mechanism to facilitate authentication. The fact that messages could not be decrypted by a session hijacker given the end to end encryption nature of the system also factors into this decision.
Use case: lost/stolen phoneuser lost his phone, luckily he has his identities backed up on Google drive
user buys a new phone and installs WBB Chat & WBB Dashboard
user restores his identities from the backup
user generates a new pair of key pairs successfully
attacker with old phone receives revoke message
old phone knows revoke message is from the same user and promptly logs out and deletes any related data
any subsequent authentication attempts on old phone will be rejected
In a nutshell
Thanks
WBB & 1EX Dev
That's pretty sweet actually, didn't know it was that in depth...impressive.
Telegrams specs here to compare:
https://en.wikipedia.org/wiki/Telegram_(software)
Architecture[edit]
Encryption scheme[edit]
A simplified illustration of the MTProto encryption scheme.
Telegram uses a symmetric encryption scheme called MTProto. The protocol was developed by Nikolai Durov and other developers at Telegram and is based on 256-bit symmetric AES encryption, RSA 2048 encryption and Diffie–Hellman key exchange.[39]
Since 2013,[44] cryptography experts have expressed both doubts and criticisms on the MTProto encryption scheme, saying that deploying home-brewed and unproven cryptography may render the encryption vulnerable to bugs that potentially undermine its security, due to a lack of scrutiny.[45][46] It has also been suggested that Telegram did not employ developers with sufficient expertise or credibility in this field.[47]
In December 2015, two researchers from Aarhus University published a report in which they demonstrated that MTProto does not achieve indistinguishability under chosen-ciphertext attack (IND-CCA) or authenticated encryption.[45] The former means that it is possible to turn any ciphertext into a different ciphertext that decrypts to the same message. The researchers stressed that the attack was of a theoretical nature and they "did not see any way of turning the attack into a full plaintext-recovery attack".[45]
Servers[edit]
Telegram Messenger LLP has servers in a number of counties throughout the world to improve the response time of their service.[48] Telegram's server-side software is closed-source and proprietary. Pavel Durov has said that it would require a major architectural redesign of the server-side software to connect independent servers to the Telegram cloud.[49]
The Electronic Frontier Foundation (EFF) has listed Telegram on its "Secure Messaging Scorecard". As of 7 December 2015, Telegram's default chat function has a score of 4 out of 7 points on the scorecard. It has received points for having communications encrypted in transit, having its code open to independent review, having the security design properly documented, and having completed an independent security audit. Telegram's default chat function is missing points because the communications are not encrypted with keys the provider doesn't have access to, users can't verify contacts' identities, and past messages are not secure if the encryption keys are stolen. Telegram's optional secret chat function, which provides end-to-end encryption, has a score of 7 out of 7 points on the scorecard.[62] An earlier version of the EFF's scorecard was criticized for being inaccurate, misleading and vague, but not specifically with regard to its evaluation of Telegram.[63]
