Other Software > Announce Your Software/Service/Product

FrogTea

<< < (2/2)

IainB:
Somewhat concerned after @fodder's comments above, that I might have inadvertently missed something about the functionality and security of FrogTea, I reread all the links that I had given above.
As far as I can see from the literature and references, xTEA (where TEA stands for "Tiny Encryption Algorithm") is the preferred foundation for FrogTea and is one of three TEA algorithms:

* TEA
* xTEA
* xxTEA
At http://m8e.com/, it says:
(Text copied below sans embedded hyperlinks/images.)
Text encryption

* This is a base64 enhanced version of the original encryption routine, found here. TEA
* The strong encryption with JavaScript implementation of David Wheeler & Roger Needham's Block TEA (Tiny Encryption Algorithm) by Chris Veness is done only on the client computer browser with JavaScript. Information is not sent or stored anywhere during encryption or decryption.
* The Tiny Encryption Algorithm is strong encryption. It is one of the fastest and most efficient cryptographic algorithm in existence. It's public domain. The code is lightweight and compact, which makes it practical for JavaScript implementation.
* The JavaScript source code of this program can be easily viewed as the source code of this HTML page. Security specialists do not recommend using encryption for which source code is not available for analysis.
* If the password is lost or forgotten, there is no practical way to recover the unencrypted text from the encrypted text.
* Check the laws of your country to determine if you can use strong encryption legally.
* This site is for illustrative purposes only and is not intended to be a TEA encryption service. There is NO warranty, expressed or implied as to the suitability for any purpose.
--- End quote ---

Furthermore, there is apparently no known/documented "best" attack for xTEA - refer Wikipedia - Cipher security summary

Well, that all looks pretty good, but some of the references here could be mistaken or out of date, I suppose. (I wouldn't know.) For those who are interested, there seems to be quite a lot of heavy academic documentation about it too, on the Internet.

Perhaps the potentially weakest link is the GUI provided by FrogTea.exe, and one would need to be able to verify the code for that too, I presume (in addition to verifying the Javascript for xTEA). I gather that the FrogTea.exe code is sourced by and copyright of HTConsulting.com.

If one wanted to explore this further, it could be interesting to know how xTEA has been broken, or something, and where that is documented, and how easy that might be to replicate for the average laptop/smartphone thief.

However, for the purposes of securely encrypting the typical user's portable bits of personal/private/confidential HTML and text-based data - e.g., to protect against (say) the event where the device holding the data is lost/stolen - with the ability to sync/share it across several devices (all having java and browsers), and between specific trusted people, it seems that FrogTea could potentially be rather useful. It could also protect against all but the most determined attacks from those pesky Ruskie, GCHQ and the NSA agents. That is, for those as might feel more secure with, and gain some "peace of mind" from such protection.

Come to think of it, I reckon that one of my neighbours might be a Ruskie - well, he calls himself "Dmitry" and walks around wearing a Russian Ushanka hat anyway, and sometimes sits in a deckchair in his garden drinking Vladivar and repeatedly pointing a revolver to his head and then spinning the cylinder around. He's a bit odd.
Hmm, maybe I should think of using FrogTea, just in case, like. Can't be too careful these days...

f0dder:
Well, that all looks pretty good, but some of the references here could be mistaken or out of date, I suppose. (I wouldn't know.) For those who are interested, there seems to be quite a lot of heavy academic documentation about it too, on the Internet.
(...)
If one wanted to explore this further, it could be interesting to know how xTEA has been broken, or something, and where that is documented, and how easy that might be to replicate for the average laptop/smartphone thief.
-IainB (April 04, 2017, 03:10 AM)
--- End quote ---
I haven't scoured the net, but I assume the notes on wikipedia are correct with regards to TEA attacks. A 2^59 chosen plaintexts is "not excatly trivial", but the attack is six years old by now - and XXTEA probably isn't getting a lot of (public) attention since it's not a sexy thing to break. It's not one of the normally used ciphers, so why bother throwing a lot of resources at it?

For academia, that is. Our friendly three-letter agencies haven't got the same resource constraints, nor a drive for public glory.

However, for the purposes of securely encrypting the typical user's portable bits of personal/private/confidential HTML and text-based data (...)-IainB (April 04, 2017, 03:10 AM)
--- End quote ---
If you have a hard requirement of no other requirements than a browser (e.g. no executables), perhaps - but I'd still look for other solutions. And it wouldn't be hard to cook up something with a proper encryption algorithm that still decrypts from html+js.

Other than that: threat modeling.

IainB:
@fodder:
This seems to be talking at cross-purposes. I am not positioning myself as an advocate or supporter of FrogTea, about which I am relatively ignorant - don't even use it - but merely as a supporter of the innovative idea of the usefulness of something like FrogTea and which I had always considered a novel approach, though not one that I would necessarily advocate using under all circumstances.
In doing this, I am thus attempting to contribute something positive, constructive and potentially useful to DC Forum members, by extending and building on a discussion based on someone else's (@berry's) proposal regarding an encryption tool.

Sure, I can see some potential weaknesses in the use of FrogTea, but what puzzled me in your initial response was what seemed to be your outright damning of the whole thing in this thread - for no compelling, apparent, verifiable and substantive reason - as though it could not possibly be any kind of useful encryption tool. That would seem to be absurd.
In the other thread, you went further and even asked what use/purpose it had and were seemingly mistakenly implying/thinking that I was putting FrogTea forward as some kind of a proposed technological solution to address the issues/problems in that other thread (which I decidedly wasn't doing and which would have been an absurd thing to do in any case).

So you apparently couldn't see the purpose of FrogTea, and yet you effectively damned it as being entirely not fit for purpose, which would seem to be contradictory.
That all rather seemed to me as though you might be having an irrational outburst of some kind, as though you simply just didn't like the thing, nor any part of it, ignoring its potential - although it had what seemed to be a valid and clear set of some strong pros and fewer cons as an encryption tool filling a niche (QED).

You could be (say) largely correct in what you write above, but where you write:
...For academia, that is. Our friendly three-letter agencies haven't got the same resource constraints, nor a drive for public glory. ...
_____________________
-f0dder (April 04, 2017, 10:37 AM)
--- End quote ---
- it seems to be based on requirements from your perspective that might be somewhat purist/stringent and thus a tad over-the-top for the kind of domestic situation that I postulated for the average Joe:
However, for the purposes of securely encrypting the typical user's portable bits of personal/private/confidential HTML and text-based data - e.g., to protect against (say) the event where the device holding the data is lost/stolen - with the ability to sync/share it across several devices (all having java and browsers), and between specific trusted people, it seems that FrogTea could potentially be rather useful.
_______________________
-IainB (April 04, 2017, 03:10 AM)
--- End quote ---
Indeed, it still does seem true that "...FrogTea  could potentially be rather useful" - in that niche.
I could be wrong, of course, but I don't see where HTConsulting were suggesting that the requirement was to lock out potential attacks from the likes of the NSA, or suggesting that it was even desirable to have such a high standard of security that one could lock out the likes of the NSA. Maybe if @berry was a habitué of the DC Forum, he would be able to enlighten us both on this matter, but meanwhile we shall just have to suppose.

That's why I made the joke about the unlikely extreme perspective - in the shape of my neighbour Dmitry - and pointed out the more likely relevance of a typical use case:
...If one wanted to explore this further, it could be interesting to know how xTEA has been broken, or something, and where that is documented, and how easy that might be to replicate for the average laptop/smartphone thief.
____________________
-IainB (April 04, 2017, 03:10 AM)
--- End quote ---
- because that is arguably likely to be the typical use case that could be most relevant/applicable for the average Joe. However, it would be incorrect to interpret that - as you seemed to do - as meaning that the requirement was necessarily a "...hard requirement of no other requirements than a browser (e.g. no executables)".
I was not touching on what the requirements really were or should be.
On the contrary, all I was attempting was to retrofit the features to suggest that FrogTea seemed to have the potential to be quite handy if one felt one could make use of such-and-such FrogTea features as it possessed.
This is always remembering that features are not the same thing as requirements, and vice versa.

If we were concerned with the objective of locking out the SS (Secret Services) of this world for ordinary domestic IT users like myself, then I would suggest that this objective is already infeasible and would be "p#ss#ing in the wind", self-defeating and a huge waste of effort.
The SS have already amply demonstrated their power and that they are unstoppable, and if they are blocked from covertly entering through the back door, then they will simply overtly break down the front door and enter that way, and then subject the user to methodical and excessively disproportionate violence (e.g., Kim Dotcom raid) and subsequent public and harmful, punitive treatment using an expensive and compliant state-controlled police and judiciary across nations. This makes extraordinary public examples of those who fail to obey, to dissuade others from disobeying in  future.
If I had thought that FrogTea was potentially that good, then I probably would not recommend its use. It would probably only provoke the SS. So "threat modelling" would be excessive and going over the top again - for most domestic security purposes.

f0dder:
Sure, I can see some potential weaknesses in the use of FrogTea, but what puzzled me in your initial response was what seemed to be your outright damning of the whole thing in this thread - for no compelling, apparent, verifiable and substantive reason - as though it could not possibly be any kind of useful encryption tool. That would seem to be absurd.-IainB (April 04, 2017, 03:58 PM)
--- End quote ---
Not really.

The reasons I listed against using FrogTea are pretty sound. If anything is absurd, it's that insistance that there's some merit in using an unmaintained, closed-source program with problematic encryption - while not philosophically untrue, it's about as ridiculous as insisting that it's better to wear a pajamas in a blizzard than being naked.

In the other thread, you went further and even asked what use/purpose it had and were seemingly mistakenly implying/thinking that I was putting FrogTea forward as some kind of a proposed technological solution to address the issues/problems in that other thread (which I decidedly wasn't doing and which would have been an absurd thing to do in any case).-IainB (April 04, 2017, 03:58 PM)
--- End quote ---
You seem intent on muddling things up. I tried keeping this thread about FrogTea in and by itself (which can be kept fairly technical), whereas the other thread is political, and it's in that context I struggle to see how tech is supposed to be a solution for a political problem.

IainB:
^^
@f0dder: Ah. I see. You must be right.

Navigation

[0] Message Index

[*] Previous page