I know it's come up in the mailing list and on twitter and I'd also really like to see the possibility to register with different kinds of proof of identity.
It's obvious that this would be a rather large feature and all the little quirks and bugs have to ironed out before any of the devs will have time to think about implementing something like this. But I'd like to use this issue for brainstorming and discussing ideas which possibilities of proof of identity exist, that are safer and / or more anonymous than phone numbers or email addresses.
TextSecure uses a security model called trust on first use or TOFU.
This means the TextSecure server checks if you control some unique identifier by which your contact's know you.
This is currently done with your phone number, which is great if your friends want to find you. But it's not ideal at all if you don't want to be found. And also for security reasons.
If this initial check was not compromised, you can be very sure that your communication can not be intercepted or faked by any known kind of attack on the transport. If TLS breaks (again) then an attacker with control to the data transport can tell that you are using TextSecure and probably also with which number you registered and who you talk to. But they won't be able to read your texts, unless they compromise your phone directly. But this isn't something TextSecure or any app can do much about. It's also a lot harder, more expensive, complex and dangerous (easier to detect) to do this on a wide scale than it is to compromise the transport.
Phone numbers are really bad for many reasons:
4 It's really easy for the network providers or anybody with a little incentive to trace you to a rather small physical area. If you want to know more about the phone tracing (for 15$), watch some of Karsten Nohl's talks from the differenc Chaos Communication Congresses.
In the future it will be possible to register with an email address, but that's not that great either. Let's see which of the above problems disappear by using an email.
So especially problem Number 5 still has to be solved.
Because this means that it's possible to do a man in the middle attack (MITM) on somebody who is using TextSecure.
Currently there aren't many ways to get a unique but anonymous identifier that is also extremely hard to impersonate.
One possible solution would be to use some kind of crypto currency.
Some possibilities I found:
Software:
Hardware:
It would be great if we found something that can be run on the clients themselves, otherwise we would still have to trust the TS server, that he has verified the identity (as it is now). But then all our effort would have been rather futile, because if the server gets compromised, the same attack as described above can happen.
However, the block chains of the crypto currencies that have a kind of id or alias system enabled are already too big to fit on most cell phones. If we just run a "light client", that asks a website if the person is indeed who he pretends to be, we have to trust this server that it hasn't been compromised. Sounds like a lot of work for nothing. We could ask several different servers, to lower the chances of an attack, but we can never be really sure.
Then there are things like Yubikeys or the Crypto-Stick. But they are so little used that there is currently no easy way to get them anonymously from a local shop.
I'm open for any suggestion.
Currently it seems to me like using anonymous email + verifying the keys after the exchange is probably the least effort.
This is also kinda connected to #838.
RetroSearch is an open source project built by @garambo | Open a GitHub Issue
Search and Browse the WWW like it's 1997 | Search results from DuckDuckGo
HTML:
3.2
| Encoding:
UTF-8
| Version:
0.7.4