Security Considerations

This is a non-exhaustive list of possible security considerations when developing using Shelter Protocol (and other protocols).

Public-key cryptography

Quantum computers or flaws in ECC implementation or design. To mitigate against this possibility the protocol is designed to be upgradeable and agnostic to the ciphers used.

Malicious Server Brute Forcing Password

If, instead of using unique keys per device, developers use password salts, servers will have access to password salts and therefore will be able to attempt to brute force weak passwords.

The best way to mitigate against this is to use a password manager that generates strong random passwords for you.

Weak Passwords

If, instead of using unique keys per device, developers use password salts, then accounts could be compromised if passwords are easily guessed, or, in the case of password reuse, could be compromised if the user had an account on another server that was compromised and reused that password on their account using Shelter Protocol.

The best way to mitigate against this is to use a password manager that generates strong random passwords for you.

Malicious JavaScript

If the server is responsible for distributing the app itself, then it could inject malicious JavaScript to compromise the protocol. Alternatively, malicious JavaScript could be injected by an HTTPS Man-in-the-Middle or by browser extensions.

The best way to mitigate against these attacks is to keep the distribution of the client software separate from the server that is used to store messages by bundling the JavaScript into an app using tools like Tauri, or similar software. However, that won’t protect you from compromised app stores.

Additionally, Shelter Protocol implementations themselves could be compromised through supply chain attacks on the dependencies used to implement the software.

The best way to mitigate against these types of attacks is for developers to avoid using dependencies. If that is not possible, then the next best thing is to avoid installing unnecessary dependencies, or dependencies that themselves have other dependencies. Other approaches, like using automated software analysis tools, conducting thorough pull request reviews, and security audits, are also helpful.

Malicious Contracts & Sandbox Escape

If Shelter Protocol implementations incorrectly implement their sandbox, then it’s possible that malicious contracts loaded by users could result in compromised data. To mitigate against this, make sure to conduct security audits of sandbox approaches and only load contracts from trusted developers.

Compromised End-User Devices

The end-user device could have malware installed on it such as keyloggers, rootkits, or other malware. It’s also possible that the hardware of the end-user device is compromised by manufacturers in some way (intentionally or otherwise). There is nothing Shelter Protocol (or any other protocol) can do to defend against these types of end-user compromise.