{"action":"created","issue":{"url":"https://api.github.com/repos/vector-im/vector-web/issues/2413","repository_url":"https://api.github.com/repos/vector-im/vector-web","labels_url":"https://api.github.com/repos/vector-im/vector-web/issues/2413/labels{/name}","comments_url":"https://api.github.com/repos/vector-im/vector-web/issues/2413/comments","events_url":"https://api.github.com/repos/vector-im/vector-web/issues/2413/events","html_url":"https://github.com/vector-im/vector-web/issues/2413","id":181021258,"number":2413,"title":"E2E devices may lull users into a false sense of security in the face of cloned devices","user":{"login":"ara4n","id":1294269,"avatar_url":"https://avatars.githubusercontent.com/u/1294269?v=3","gravatar_id":"","url":"https://api.github.com/users/ara4n","html_url":"https://github.com/ara4n","followers_url":"https://api.github.com/users/ara4n/followers","following_url":"https://api.github.com/users/ara4n/following{/other_user}","gists_url":"https://api.github.com/users/ara4n/gists{/gist_id}","starred_url":"https://api.github.com/users/ara4n/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ara4n/subscriptions","organizations_url":"https://api.github.com/users/ara4n/orgs","repos_url":"https://api.github.com/users/ara4n/repos","events_url":"https://api.github.com/users/ara4n/events{/privacy}","received_events_url":"https://api.github.com/users/ara4n/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/vector-im/vector-web/labels/bug","name":"bug","color":"fc2929"},{"url":"https://api.github.com/repos/vector-im/vector-web/labels/p2","name":"p2","color":"fbca04"},{"url":"https://api.github.com/repos/vector-im/vector-web/labels/question","name":"question","color":"cc317c"},{"url":"https://api.github.com/repos/vector-im/vector-web/labels/security","name":"security","color":"5319e7"},{"url":"https://api.github.com/repos/vector-im/vector-web/labels/type:e2e","name":"type:e2e","color":"5319e7"}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":2,"created_at":"2016-10-04T22:27:44Z","updated_at":"2016-10-09T14:11:22Z","closed_at":null,"body":"By making an effort to model each device separately and applying verification/blocking per-device, we are ignoring attacks where someone clones a device by stealing all its key data.  I wonder if we are lulling people into a somewhat false sense of security there, compared to models where there is one identity key that is trusted across an opaque set of devices..."},"comment":{"url":"https://api.github.com/repos/vector-im/vector-web/issues/comments/252488602","html_url":"https://github.com/vector-im/vector-web/issues/2413#issuecomment-252488602","issue_url":"https://api.github.com/repos/vector-im/vector-web/issues/2413","id":252488602,"user":{"login":"Zenexer","id":504130,"avatar_url":"https://avatars.githubusercontent.com/u/504130?v=3","gravatar_id":"","url":"https://api.github.com/users/Zenexer","html_url":"https://github.com/Zenexer","followers_url":"https://api.github.com/users/Zenexer/followers","following_url":"https://api.github.com/users/Zenexer/following{/other_user}","gists_url":"https://api.github.com/users/Zenexer/gists{/gist_id}","starred_url":"https://api.github.com/users/Zenexer/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Zenexer/subscriptions","organizations_url":"https://api.github.com/users/Zenexer/orgs","repos_url":"https://api.github.com/users/Zenexer/repos","events_url":"https://api.github.com/users/Zenexer/events{/privacy}","received_events_url":"https://api.github.com/users/Zenexer/received_events","type":"User","site_admin":false},"created_at":"2016-10-09T14:11:22Z","updated_at":"2016-10-09T14:11:22Z","body":"Can technologies such as TPM reasonably be used to mitigate this issue, at least on some platforms?  Chrome OS does make extensive use of TPM.  For example, [the documentation on Chrome OS TPM usage](https://www.chromium.org/developers/design-documents/tpm-usage#TOC-Protecting-Certain-User-RSA-Keys) says:\r\n\r\n> Also, any keys generated using the Webkit ‘keygen’ tag will use the TPM-backed token by default.\r\n\r\nAt the same time, [MDN says that the tag is deprecated](https://developer.mozilla.org/en-US/docs/Web/HTML/Element/keygen), including in Chrome 49+.  The currently favored alternative seems to be using [SubtleCrypto.generateKey()](https://developer.mozilla.org/en-US/docs/Web/API/SubtleCrypto/generateKey).  You can check [CryptoKey.extractable](https://developer.mozilla.org/en-US/docs/Web/API/CryptoKey/extractable) to ensure that the key actually resides within TPM."}}
{"actor":{"display_login":"Zenexer"}}