Status Meetup // July 2018 Security Summit, 4 Jul 2018

Previous Meeting

⏯

youtube image

►

From YouTube: Status July 2018 Security Meetup (Day 1: Morning session)

Description

Status July 2018 Security Meetup (Day 1 Morning session)
00:00:00 Introduction
00:07:37 Security
00:09:56 Coercion resistance
00:14:04 Privacy
00:21:05 Short history about security at Status
00:27:55 Wall of Shame
00:47:20 Audit Process
01:07:46 Bug Bounty Program
01:12:20 Hiring
01:15:34 Security at Status

A

Personal information.

A

Saying we would.

A

Like to accept your.

B

Maybe embarrassing.

A

For the people that stick out their necks.

C

Names also want to say that, yes, it's a legal gray zone but like what is morally right. It's a very different thing and what is correct by this people may not be reflected in law.

C

Don't if anyone's thinking that illegally grazing is.

D

Right ask whoever is talking to be a little bit louder, because that's the only my we have.

A

All right, yeah.

D

A

Right so today, in this meeting, this is what we're about right now, let's forget for a minute about that right. This meeting was largely about chat right and of.

B

Course, a little interface.

A

With all those other things we will see later on our, for example, your organizational stuff can help us with query resistance, and this is a this- is a phrasing that I used in the job. A messenger.

B

A

Extreme security, resistance in mind and and that effects us developers we might become targeted. It affects the organization it might become targeted. It affects the technology that we work with. It meant used in a way that we did not anticipate.

A

C

Think that's fine for communicating like, like in a wider audience, I wouldn't tweak the message of things to talk about like it's about communication right like we're building.

B

C

A communication tool with extreme security and corrosion resistance of privacy in life, but with communication that is kind of the foundation layer for like legal systems of law, which is why you can build things like money.

E

C

Top of it, you can also build like institutions on top of it, which is old for sites, it's not contracts and that's what the crypto tokens and sex network cooking hints. So it's like this fundamental layer. The way we are solidifying and giving these these rights to regardless of the environment they're in.

A

A

A

A

A

A

We have methodologies going up. Maybe my personal strategy is.

B

A framework for evaluating.

A

Whether future state.

B

A

From from a hostile environment and point of view, it's kind of like a checklist that we'll use as I help if you're unsure whether it feature that you're introducing takes us to step forwards or backwards on the scale of security, and that can serve as alpha when deciding whether the trade-off is worth it.

A

There's technologies we're going to talk about the movie.

A

For secrecy, darkness, which is about.

A

Mesh networking, which helps all the royalties issues bootstrapping, something like the algorithm- can be done in very many ways on this very beautiful mathematical construction.

A

But it can also.

E

A

Other ways and then you can so we're going to.

A

Just a little bit about the morning, you get shot down by asleep in shapes and forms right and that that can happen like because somebody takes over our cluster, because we.

B

F

A

I think about school, like everyone have been fumbling ethereal, I was going down to the foundation, one of the main developers.

A

Thank you. Oh yeah,.

C

Yeah yeah yeah.

A

It was working on Casper, I.

C

Usually, when a formal verification and stuff yeah.

A

So I don't know if it was that and your.

A

C

Wasn't willing to accept that risk yeah at least publicly whether it is.

A

A

It's also got our like our source code that survivors with us. What.

B

Does it survive something that.

A

When I was doing this, the DMC aching.

A

G

Little bit earlier, if you.

A

A

Take Krypto out of the states a lot of it was developed there today we have created verses that they would sing the source code or translate this or salinity notes. They would like writer writing in the book like language.

A

A

Distribution where we have people and I mentioned one example just appear.

A

In Cuba they have this Harbor that travels the country.

A

Again, this reminds me what.

G

I was doing and I was changing.

A

The stats give some very blank history with you somewhere else, back yeah, very good stuff. Just a good old kitchen right, see.

A

Precisely because.

A

These technologies that are going to be perfectly safe.

A

C

Like having cones on your house, the street a.

A

A

A

C

I find this really interesting, because the next panel discussion right, basically the attempt to to find other sources of analytics, is essentially based on our metadata leaks right. So it's kind of a really interest. It's a really interesting way to do that, because, as analyzing.

A

C

That's gonna add, like I mean having these kinds of constraints doesn't mean you can't achieve similar goals. It's just that you have to think laterally. It won't create now.

B

C

Section or Olaf onion, it's the second cake, given these constraints, how we designed them.

A

What our discussion didn't any Wars was.

E

Finding that creative.

A

Ways of solving this problem, and mainly rephrasing me balloons, it's not the exactly be a doer number that can lead with. We need an educational.

A

C

And I mean also it's like you mentioned it's like a film in Anacostia on the percent of the time as long I'm kind of at least. Maybe this is personal opinion, but I'm kind of comfortable if we're educating the user and they voluntarily do these things to a certain extent but like guaranteeing that they're well educated and they're, guaranteeing that they absolutely know that like say opting into tracking, for example. They don't really understand what that means right, but if they can bring topic discussions, are we going to it? But you.

B

Know being voluntary is.

C

A

The information is.

A

D

A

Make a good choice such that we.

C

We're still you're, basically here I'm just going to curious I.

F

Mean reduced intensity.

C

Right here, I mean, if you're registered of there's between it's already.

C

Short of collaborative brainstorming might be useful, so a lot of people recent.

G

Started working.

C

I guess six or so months ago we had this thing where our slap is open and we had lots of phishing attempts. So people were pretending to be call or Jared. They sent like a missive saying, like Oh simp, isn't heed to this address, and then you get some freebies new stuff, and this was like untenable. Like was a huge problem and slack was completely useful and people lost three money and I guess Oh someone lost like ten grand is something this.

C

So so it wasn't trivial yeah I mean the fishing account was multiple states, so they got like a hundred grand every time. They did it right yeah. So so it was able to be program and we were trying to find a way to solve it. That what we end up. Having is that we moved to riot. But then the reason for moody to riot is because then you could do this thing with links. We could control control the links.

C

You need permission to post certain things, so you put in post like a fake version of if it's kind of like, if you wallet whatever it had one iteration yeah I mean original's exactly exactly and I guess that's sort of like an isolated thing, but it touches on something so interesting like it touches on the fact that you need identity solutions, because it's easy to hear someone and migration tools in these things, but also being one was of journalists and in terms of past, and we want to go and so on.

C

Is we had this problem and then the way we chose to solve? It was a sort of mood to riot, but it was sort of done in this way. Where now we know we're still using slack right and it's not like you're right, we just retracted so I.

C

Think, generally speaking, is totally. We have done security decisions in a curve half-assedly way and I. Think that's what we want to change and Twitter's like how? How do you go about it? One one approach of this is just coming to some kind of shared agreement on what sort of currently broken right and I think this has been floated a few times and I started. Writing it myself, but I thought we could do it together, which is a kind of wall of shame.

C

If you will, where essentially we list things that we think are currently broken, and it can be anything no specific sort of constraints on it. But it's a brain stem around it and I was thinking. We could just very roughly a photography had sort of categorize it from. This is like a complete blockers. If you man escape from one to five or one, it's like this is a complete Locker. We should pull that from the app store and find us like. This is okay. We don't have to solve this within the next two years.

C

Deepika will just be interesting to get ear on this room on the same page, because it gives us at least some direction with a small structure in terms of attacking sort of the biggest problems and I. Think it also maybe seed discussions over the next coming days, so I know which I think. But my idea was. We can just have a hack, MB surf session of share link and then we can have like maybe five minutes where everyone does writes phase five. Ten minutes people just write free.

C

So if you get twenty broken and then we can have sort of a voting station of draft where people just put like a number and then we get some shares.

C

C

Ya know this is like.

H

And that's very easier to think about what could go wrong so I.

C

Think to me this just matter so succeeding, because people.

G

B

C

Different backgrounds and so on, and it's like.

A

C

E

F

C

Right I can type it. People want to jump in as well, so just throw things.

B

C

You can also just shut things up. You can just do it from you.

B

H

We don't have the me like informational certificates,.

G

C

Mean it's kinda! Why we have all these journals will have multiple users right and as a classic example, the convenience of a subprime scenario. It's like dear Jude, one to have like as a user. Is it okay to.

C

H

Usually I mean we might protect something by something, you know something you have and something we essentially it's usually for financial stuff. You need to prove to of this differently, so it should be like something you know like your password, plus something you have like a mobile phone with with Google Authenticator or something on it. So it's.

F

Like combined so.

H

It's just just a minute passport is not enough to steal your all your date or your money, I'm, not sure how it work with blockchain in general, but.

B

There are multi.

H

H

I

Convenient abilities yeah, you know it.

H

I

I

The deployment.

I

Like when you read the corrosion resistance particle.

H

B

Can even remove.

H

The application from the.

C

I

Mean you know, price of information we week something same that you're not being.

A

Today, you can for suit yeah.

I

Yeah and also yeah, the MUTCD is very important language like that that person's.

I

I

C

I mean publisher, but I mean we can do.

A

This, which is this last exchange.

A

I

A

C

Let's say signing we commit because only really concern.

A

Is because we're on kpop.

C

And illiterate that identifying to keep up there, whereas if you include anonymous and signing like I'm pseudo, normal society,.

C

I

Diversity Committee will actually be pretty interesting because to change the way we do the pull request like not knowing if it's someone from steady score or complete, stronger, because I assume that, like we.

C

E

I

People who are from the organization, so we are so that if we do that- and we have to pay more attention to every.

E

We're at lunchtime I think.

C

I guess people does I. Think one thing, though we did something we can do nature doing this, but what I also want together this in terms of writing things and things that we wanna block on now, like we shouldn't do development. This is fixed kind of thing versus things that okay with you solves in three years, because right now, I think it's kind of this old generally ideal weather than have this, but I feel like that's lacking.

C

I was hoping to do something about doing some kind of at least get any fearful people things like mix, bouncy baby talk for some people like. Oh, we shouldn't do this with it. We should take move now now people say Oh, maybe in two years time, whatever.

C

C

C

I just wanted to say that, like we should be very open, we shouldn't act like I've noticed some people in the organization trying to fight these things and I. Think that's disingenuous and it certainly.

C

F

Why I was putting.

C

This in discuss, or even the community.

F

Should address first but yeah, that's the typical! You know coming from corporate scenarios.

F

Yeah I don't know.

A

Sorry to say, one thing about lunch is that they tend to close around to here. I.

D

H

We can already a new company and we like to review the things that were added after their defeat. Sorry, we also people like this program.

H

That was also like kind of interesting.

H

So yeah so I see a problem. We cooperate with the Jefferson reading, they are from from Canada, I, guess or Scotto CLO yeah and yeah.

B

The cooperation.

H

With them is pretty good, so they are responsive, they are the big stuff in law and the first engagement that's pretty successful. They found excuse to the major stuff and they all like elongated professional from their sites. So so that was a good experience. That's why we decided to follow and sign up for the next engagement.

H

However, this whole process of it and kind of not really meeting our needs, as we are developing very rapidly and changing adding features every every week, improving stuff and the whole process, they work and the kind of aquatic engagement, skills and wonderful, wonderful principle. So what happens? Is that pretty much be quite Scott? First and habit.

E

D

H

Half months two months before the art starts, so so you know this is already like two months period where there should be no new things, then they've got it. They're gonna eat it. So that's already when they finished out it. It's it's already two months of work that we could deliver restock and they probably are not gonna need it or they are just just think big audience just a little bit, not really deeply checked so so the whole model does not really work and that's not really excuse our our needs.

H

So so, like I, said this versus coping, so pretty much I mean presenting them all the modules they are actually looking into code. It's not like video, just gravity they're a big problem, but they are looking into the code so we're providing ly pretty much in tax free for us.

H

They're doing that for both status, constituent repositories yeah. So this is like for space, we're, probably scope and then there's some time when we negotiate the final timeline. And what next are the.

H

That's why the earth plane has providing specific so that you know, because would they analyze this in the space before they started eating they? Don't you didn't want to do this cup to be changed, so that's why they really require.

H

That so, for example, the chance.

C

H

A

C

Security threats and.

I

They analyzed it wrong.

C

The u.s. try and break the experience I'm a little scared that at the moment, this is a whole bunch of all the mission we think about that before you.

E

C

And is no guarantees.

F

It wasn't pretty.

H

H

So so yeah so regarded did this space. Would they actually start working that there's like a kind of initial place where they are looking into code and maybe drugs from general check out so like, for example, there are like they're trying to see the opposite of network traffic when you do not use it like something suspicious networks, or so it's like kind of basic stuff they're trying to look into the files.

H

For example, during this initial phase, they like doing this general checkup, they notice that our applications, tapes files are encrypted, and they just that inside, is an encrypted file. Fairly sensitive information like the passphrase were on retreats or chats that we started yeah.

H

The later is like me, no need so we are everything weekly or even more with their engineers and who are talking about.

H

More or providing some more information if they need it, so so yeah some of me that actually it's not like the earth somewhere and they're in there like working for two weeks, and you just provide us some document. But they are this promise kind of like they're in.

H

Pretty good and airily they're like from dream on this, so they're also trying to understand the code so, for example, good guy and Dan was the to us actually asking questions of always to see parts of the code, so you can see that they are actually doing and in the end they are kind of taking everything what they found into single document.

H

It is quite cool because it's gonna be published to the community and it's also which somewhere for us think about everybody all the PDS about it out. They also include some recommendations, so maybe, like Megan, mentioned a track star in Irving's. This recommendations are not necessarily issues that that effects applications now, but should they are good things that that we should consider in the future how we can improve them?

H

The app from from different points of view select from user experience of furmity the user point of view Lee, for example, they mentioned also related comedic accountant, wiping out all the data thoughtlessly will right now easily. So they at this kind of things. So.

C

What concerns me here is I'm getting the impression the scope is quite large in terms of like opening the application and the final AP orbital period was three weeks. Yeah.

H

At first, the first pink was pretty large because they were.

C

From the status network so good, we engage roughly about four different or five different security team and the codebase is arguably a little smaller I mean employable beautiful, but they all want at least a minimum of a month. Yes, so.

H

That's to here it's like pretty much we're pointing that means, there's specific modules, so they are not really following all it always yeah. So, for example, for the.

H

It's still quite a little code, so we didn't really get any response from them. Yet.

H

Yeah, it's more about the volume level rather than for I. Think that's also disingenuous from.

C

A communication standpoint, then you know we basically said we have this on it and it's fully baked we're really.

C

C

H

H

Yeah yeah, so um a few things yeah there are overlooked, but also in the previous engagement. We we were also like I.

E

H

The first the latter be first and the second and then the first engagement across the border, also by ourselves, but have some external to look into that. But.

C

Yeah yeah, let me drop this right now. We don't have enough security expertise right, so that's sort of the thing we could do, which would at least give us some experts looking at what there's no way or not like. Ideally, we have multiple security at first. You want to have dedicated sort of experts working on that and also just general what we do now we're getting more people to think about this in creative culture and security chapters, and so on.

C

So it's like a several front attack, but this was just the best we could do, given that we want to release a better and you will have at least some mushroom is wrong for things like some sexy signings of people.

H

Actually required at least once a year to get external company to order to be record new beers. These are two different things. One things we know for your internal, but it's basic white tiger that you also have like once or twice a year because they tend to fire.

H

And also we put really emphasize don't in the first one gauge mean that really important for us: the key management, the same transactions, this kind of stuff. So they really do really look into that. First late, early start and other things like this trailing in order that were not as much because yet the personal management was also kind of support. They were not doing.

E

H

Three weeks and timing that they targeted everything the ages and what we hand off them from three weeks and they audio with a what they could so yeah. That s like.

H

So I've done impression than the quality of their work is really good. Big, big.

H

H

Yes, this binary Curtis is already pretty nice pink. They are.

H

Like a lot of drawbacks to the pressroom is one approach for us: it's not really cool because, as I mentioned this big two months of death and we pretty much going to freeze what are you gonna? Have it it?

H

So that's that's not the idea for us for two months we are doing stuff, so so the the cover they're looking into this already. We know that it how they did changing this postcard. So we did it during the person Beach with that, but tapping for microscopy or a week for them to analyze in years ago and extended the audit by a week or two to actually the changes so and yeah. So that was not actually it's not very efficient to.

H

And the most it's not, they are not very thoughtful innovative. So during the I'll give you, of course, can we have to close with this weekend. You can ask Barry, stop and they're sort of, but yeah they are not really colorful daily basis. So, whatever teams working on some feature and like to get some insight from the expert, it's not really possible.

H

So we still that that's. Why I'm here we're having this this.

I

Security, a senior security engineer position of that diversity trying to find someone.

H

That could lead this effort and be helpful for the team's on.

H

Yeah so I said yeah we have this false, like with P bucks. Music's more often make every today direct map stand up, so they are. They are informing us what they are working right now, the next thing, and we can ask them some questions about secure in their answer. But you know what that all depends it just. You know it's not possible, because the earth, water, peace and they're not really.

C

Thing you know, but in this particular case there was a very large push to get to this plate up and so that we started.

H

This probable premature.

H

Yeah you'd like to finish this before the end of September. That may be, because there we have some nice to have by some fixes and prepare a release for point here and two main areas that like to how'd. It is be an encryption of message, and so this is all this year see.

H

Other usage on the train for 38 years they're also checking the integrity of you, so so this is slate it's possible by a malicious user to change. The view is some way, so the users not.

H

So so yeah, that's the two main areas under a couple smaller that feels.

A

Change the encryption yes.

F

A

We have to understand feature. Why are you.

H

H

B

H

About the program so I say: perfect: I've already won right.

H

There were no truly any, which is good because actually.

C

That was kind of interesting right. The bug bounties that we did have come in were essentially a hidden they they could use against us and something in like a few bits accessing things kind of interesting and those nice and people that were trying to hold the reputation of status against them. Sonique nine things yeah.

C

D

C

C

This medium things like it's really not like it's smoking, very suppressed, but it's a great example, so small horse fires and things early in the course like, if you have small fires and then the course actually gets more bust and stronger we're together. If you don't have any fights, if you could down all four Slice, then you have a fire and- and the horses appears right.

C

So this is a great example that, where we are not accused of wrapped these things by saying, okay, we're not really together, but not going to use these mix to make partial systems stronger. So this is really a blessing in disguise like this is not a bad thing. It's really good thing. It would be better. The more of these things that we see I think just.

H

Ready so we support it, but they were not reiterated to the Aqsa, so they were related to our domain Venus figuration. So the scent makes me think.

H

About open importance and our servers.

H

Web sites there are like pretty minor things, but but yeah, so some people actually think this is reached a couple of people and they were actually.

H

D

H

Something is that really may be deep fried, but there was no successful submissions about any voter.

E

H

Not exactly sure, if we tracked how this bounty, we like how many people about the program reached so because we didn't run it of medium, so I guess that chopped up some of our ways of measuring that we.

D

We naturally can't know we did a couple things, but we haven't like run out now. Well also, the numbers: are there hi good, like yeah minutes between two thousand and fifty thousand, if she doesn't feel like the worst vulnerability reason. So far, our parents have been paid out, I. Think it's out I think it's out the notes for each of them. Yes least three of them mm yeah.

H

But the early yeah they were not related to themselves, so I imagined that, first of all, also the candidates that we reached so far through hiring, so when we have liked it exercise for them after day it's free and they're kind of most voices are saying that it's just too much to dive into that. So one of our try to analyze the up and try to point Social Security calls and people are like it's too much. It's you know. I would need someone to dig into that. So that might be complexity of the.

H

So that's what we want one thing, but the.

C

Drops of this dedicated community into there are these dedicated the communities to penetration testing all these things in the air and then push the drills. So it might be that if you are in excess, the counter right like we just look in these forums, you just that for you, that's your human world vacuumed, yes, resound and literal meaning.

H

Many of the a lot of people, corporate environment and.

E

They are like having.

H

A lot of loss of.

H

Words once the operations, that means a lot of the right people, this kind of stuff.

A

H

Just to find that yeah, it's things that we just mentioned so yeah only one kind. It's really like what are we releasing.

H

It really makes sense to the other hand, we.

B

Know that we're.

H

Yeah I'm, just quick think about security.

H

Also, this is for all security topics that we can wrap a Regis.

E

So we hungry yet do we wanna keep going I think it would be nice in general just to get some air.