Magic Wormhole is the intra team secure messaging tool you’ve been looking for.
At Monzo, we take security very seriously, you need to when you want to be trusted to run a bank. From the beginning we’ve been very diligent about using good sense security practices internally. Before i dive into how we use magic-wormhole i’d like to call out “the basics” that *everyone* should be using in 2017.
- You should be using a password manager. 1Password is worth it.
- Your hard disk should be encrypted. We use Macs, so that’s Filevault for us.
- You should have 2 factor authentication turned on for everything. Especially email. Especially your VPNs, also your github. Everything.
- You should be using a yubi key for your ssh key
We got all these things humming along nicely, and new staff members and engineers are helped to set up everything on their first day.
Previously we also taught engineers how to use GPG to send secrets to each other, but even with the best will in the world, gpg is a pain in the butt.
GPG also doesn’t have perfect forward secrecy, so if your secret key leaks, then one day that ciphertext that you’ve got lying around in Slack, or email might be decrypted again.
While we were chatting at CCC last year Filippo sent me a file, using this weird command line dropbox like thing called magic-wormhole.
It seemed so wrong, he ran a command, and gave me a crazy short password: 4-trombonist-clockwork
I then ran wormhole receive, typed in the phrase above, and boom. The file was on my machine.
My first thought was, cool, but there is no way that’s secure.
But then i looked into it and now i’m a convert.
First, the elephant in the room. Entropy. There’s not much in that passphrase, just 2 words, each taken from a 256 long word list.
The 4- at the beginning of this passphrase is the “channel”, literally, the lowest current integer thats not being used right now.
Run magic wormhole right now, and there’s a 1 in 65,536 chance that you’ll get this exact password. trombonist-clockwork
But the beauty of magic wormhole, is an attacker gets exactly 1 chance to guess the passphrase, since magic wormhole quits if sees the wrong password sent to it’s channel.
This property is such that you know the secret (or file) will be delivered to exactly one recipient. Combined with checking with your colleague that they actually got what they were expecting makes for a nice secure way of shifting around secrets.
Hypothetically, an attacker might try attacking us 1 time, and get very very lucky on their first attempt, and if that happened we’d know because the intended recipient wouldn’t have got their secret, and we’d have to reset/revoke it.
But this is extremely unlikely. A much more likely scenario is that we’d see the transfer fail over and over again and we’d know the channel was being attacked.
We use magic wormhole to send credentials, logins, aws keys (which are themselves protected by MFA) and this type of thing.
The friction is low and the security is commensurate with the risk.
There’s some other methods that achieve the same result that are worth mentioning. In a server environment, where either sender, or receiver are not humans (laziness is part of your protection here) you should use Vault by Hashicorp.
The other thing thats worth mentioning is that 1password lets you share secrets between vaults, so you can have a shared vault and move credentials in and out of there. Apparently they’ll soon have the ability to send credentials between team members directly, and then we’ll probably switch to that.
Need more convincing?
