41–48 of 48 posts
Earlier quoted context omitted.
That's a funny statement, considering PGP and OTR is the go-to and has held up for all of these years.
What's the next example?
OpenVPN. SSH-2 with RSA keys.
What proprietary software with good track records did you have in mind?
Most of the comments so far focus on the fact that WhatsApp is a closed-source system. And just to be clear, it would absolutely be better to have source code. Source code gives you a 1000-foot view of the application and lets you spot obvious problems quickly. But source code can also lie to you. To really understand what the application is doing, you need to do what security auditors do irrespective of source code…
It the source were available, I could compile it into a binary myself and calculate a file checksum and compare it against the binary downloaded from the App Store. Obviously not the case here, but i don't think you'd need to "performs the steps above" to verify.
Earlier quoted context omitted.
What's the next example?
Truecrypt, also confirmed by NSA documents published by Der Spiegel to be 'catastrophic.' OpenVPN. SSH-2 with RSA keys. What proprietary software with good track records did you have in mind?
OpenVPN is built on OpenSSL and was Heartbleedable.
Until a few years ago, SSH was a fiasco. Cryptographically, it has approximately the same security track record as SSL. It's also not a messaging system.
I didn't say I had a closed-source alternative for you. There aren't good answers here. I like TextSecure. I also like GPG, a lot. And I have a 4-figure bet with Matthew Green that OTR is more resilient than the other messaging systems. But OTR is mostly only OK if you don't use it with an actual chat client; once libpurple is in the picture, nothing is OK anymore.
Earlier quoted context omitted.
Truecrypt, also confirmed by NSA documents published by Der Spiegel to be 'catastrophic.' OpenVPN. SSH-2 with RSA keys. What proprietary software with good track records did you have in mind?
Truecrypt isn't a messaging system, is barely open source, and is barely trusted (though I think that's unfair). Compare, on the other hand, to "real" open-source disk encryption projects like EncFS/Ecryptfs. OpenVPN is built on OpenSSL and was Heartbleedable. Until a few years ago, SSH was a fiasco. Cryptographically, it has approximately the same security track record as SSL. It's also not a messaging system. I did…
Earlier quoted context omitted.
Would someone actually looking through those entries trying to find a problem fail? Or is it just "first glance doesn't show any problems" stuff? I thought it was 2.
It would be great to throw entries at actual security auditors, mixed with innocent versions, and see how they fare.
Earlier quoted context omitted.
It would be great to throw entries at actual security auditors, mixed with innocent versions, and see how they fare.
We need a name for this. How about Bug-complete Turing Test? Or just Buggy Turing Test.
Most of the comments so far focus on the fact that WhatsApp is a closed-source system. And just to be clear, it would absolutely be better to have source code. Source code gives you a 1000-foot view of the application and lets you spot obvious problems quickly. But source code can also lie to you. To really understand what the application is doing, you need to do what security auditors do irrespective of source code…
It the source were available, I could compile it into a binary myself and calculate a file checksum and compare it against the binary downloaded from the App Store. Obviously not the case here, but i don't think you'd need to "performs the steps above" to verify.
Earlier quoted context omitted.
Truecrypt, also confirmed by NSA documents published by Der Spiegel to be 'catastrophic.' OpenVPN. SSH-2 with RSA keys. What proprietary software with good track records did you have in mind?
Truecrypt isn't a messaging system, is barely open source, and is barely trusted (though I think that's unfair). Compare, on the other hand, to "real" open-source disk encryption projects like EncFS/Ecryptfs. OpenVPN is built on OpenSSL and was Heartbleedable. Until a few years ago, SSH was a fiasco. Cryptographically, it has approximately the same security track record as SSL. It's also not a messaging system. I did…
"approximately the same security track record as SSL"? i'd say heartbleedable (openssl ssl) vs not heartbleedable (openssh) would be a rather incorrect approximation.
also, a messaging system could be tunneled through ssh.