Again: I'd much rather trust Protonmail than installing unknown software. If Protonmail ever compromises their core principles, they won't survive.
Lavamail chose to shutdown instead of fooling its users and being silent under a gag order. It was a USA corporation. Can't this happen in Switzerland? I think it can, because USA forced Swiss banks to close American accounts and to reveal all account activity to American authorities.
Also, as much as I value privacy, I value and respect the judicial system. The reason? Civilized society is setup to protect private property and privacy, at least in principle. So if police wants data on someone and they come to me with a court order, it is my principle to respect the law and to comply with the request. However, if I simply can't help because of the way the protocol is implemented, I do well by both the law and by privacy of clients. In contrast, Protonmail, Signal, WhatsApp, et. al. could MITM any user by issuing rogue public keys. Crosspass is safer because in order for the Crosspass server operator to MITM a client, he would have to guess the PIN, which is as hard as guessing 11 coin flips.
Guessing 3 out of 10,000 is like 1 out of 3333, and that's harder than guessing a sequence of 11 flips of a coin. It's good enough for a bank apparently.
The difference is that a bank also requires a piece of hardware to go with the PIN. If the Lookup ID is public, that's like handing out your bank card to random strangers to try their luck.
What's the difference, if in total only three attempts are permitted? Does it matter which three people use up these attempts? The bank is happy with a 4 digits PIN because it can limit the number of attempts. Long passwords are needed only when a brute force attack cannot be prevented (when password hashes are leaked).
Crosspass is relying on the OTP model for authentication. In common usage OTPs are short and yet they unlock a person's account. Why is this safe? The time limit on the OTPs prevents theft through shoulder surfing or internet traffic harvesting. The limit on tries prevents brute forcing. (You can achieve the former with Crosspass by deleting a share after 5 minutes.)
If you've installed malware, it's safe to assume it's still there after you try to delete it. That's why I don't like installing unknown software outside a controlled environment (such as a VM or spare laptop). I've setup my spare laptop to wipe and reinstall it in minutes, and I use this when dealing with untrusted Forkcoin wallets. I can't do that on my phone, and even spare phones are less easy to properly wipe and use again.
I understand this, but the person to whom your are sending sensitive stuff (or receiving from) most likely will not. It takes two to tango. If the recipient is a busy accountant, realtor, or a doctor, he will not do all this work. So if we are to have any adoption of secure practices, we need to package it in a form-factor he will use without friction.
The other issue is: are you willing to keep your laptop online until you establish a shared key by Diffie-Hellman? The choice to put Crosspass on a
smartphone was made because it is always online, like a personal server in a pocket. Twenty years ago people kept their desktops online, serving a website from it. With the prevalence of laptops this ended while computers which are always online had moved to the cloud.
The problem is still the same: there will be a 3 in a million chance for someone to find the private key I sent. That's an unacceptable risk.
- Not just any someone, it would have to be someone who is a MITM. Otherwise, you will know the key was stolen if your friend has not received it. Crosspass will release the shared secret only once, and expire the PIN.
- Then send a public key, not a private key: establish a private key by Diffie-Hellman (DH) and verify the public keys by Crosspass to ensure that there was no MITM in the Diffie-Hellman exchange. (You can do this in practice with the Signal app by sending Signal's Safety Numbers by Crosspass.)
In any case, if you do transfer a private key by Crosspass and it is used to initialize a Signal protocol chat, then one chat round (e.g. "Hello Alice" and "Hello Bob") are sufficient to establish a new Diffie-Hellman key, essentially using the original private key only for authentication.
I've never used Google's app payment system, and I never will. Again, I guess I'm not the average user here, but I refuse to pay for small pieces of software on a small screen when I have complete open source operating systems with loads of software at my disposal free of charge.
Crosspass one day will be a free of charge CLI which you can install with Apt or Brew, from source. That will cover the cool cats, but what about the laymen they have to deal with? As mentioned above, most other people who receive or send stuff to you will not be able to use it in this form.
End-to-end encryption was almost non-existent in adoption until WhatsApp. In order to make encryption habitual, it must be put into a form that everyone can use. This was my design goal with Crosspass.
P.S. If you want to support Crosspass, please give some love to @entelecheia_inc Twitter account which I just created.
