Show HN: EZing – Mobile email client that looks like Messenger and uses PGP
1–10 of 35 posts
Re: Show HN: EZing – Mobile email client that looks like Messenger and uses PGP
#2I wish the site had a contact address for feedback or an announcement list. It looks like a good idea; I'm looking for more information. Digging for the Kickstarter to look for more information there...
Re: Show HN: EZing – Mobile email client that looks like Messenger and uses PGP
#3I heard* that all smartphones/cellphones are inherently insecure because:
1. By design, the cellular radio controller (called the baseband) accepts important/privileged commands from the cell tower. (For example, "update firmware". Sometimes, there's even "read range of bytes from phone's internal storage".)
2. Portable fake cell towers exist (called Stringrays).
Therefore, unfortunately, it seems unreasonable to claim that private keys generated by this eZing app never leave the phone.
* Probably previously here on HN. Couldn't find the link today.
UPDATE: This pgp-centric secure email is not open source? giggle Where do these people come from?
Re: Show HN: EZing – Mobile email client that looks like Messenger and uses PGP
#4Definitely a concept I have been considering and am interested in! But it's not open source! Site claims source will be available for review after beta but that is obviously futile, the devs could make an implementation mistake the very day after review is completed and bork the whole security model.
Try again.
Re: Show HN: EZing – Mobile email client that looks like Messenger and uses PGP
#5> eZing is a messaging app that closes follows concepts of well-known messengers to achieve the same comfortable reading and writing of messages.
closely
Re: Show HN: EZing – Mobile email client that looks like Messenger and uses PGP
#6I heard* that all smartphones/cellphones are inherently insecure because: 1. By design, the cellular radio controller (called the baseband) accepts important/privileged commands from the cell tower. (For example, "update firmware". Sometimes, there's even "read range of bytes from phone's internal storage".) 2. Portable fake cell towers exist (called Stringrays). Therefore, unfortunately, it seems unreasonable to cla…
That doesn't mean developing secure asynchronous messaging apps for smart device platforms is a bad idea (although adopting PGP over libaxolotl seems a tad foolish these days), it only means people should understand their threat model. If your threat model includes an adversary capable of taking over a cell tower or using IMSI catcher, then use a device with no baseband, like a simple tablet.
Re: Show HN: EZing – Mobile email client that looks like Messenger and uses PGP
#7I heard* that all smartphones/cellphones are inherently insecure because: 1. By design, the cellular radio controller (called the baseband) accepts important/privileged commands from the cell tower. (For example, "update firmware". Sometimes, there's even "read range of bytes from phone's internal storage".) 2. Portable fake cell towers exist (called Stringrays). Therefore, unfortunately, it seems unreasonable to cla…
That doesn't mean developing secure asynchronous messaging apps for smart device platforms is a bad idea (although adopting PGP over libaxolotl seems a tad foolish these days), it only means people should understand their threat model. If your threat model includes an adversary capable of taking over a cell tower or using IMSI catcher, then use a device with no baseband, like a simple tablet.
This is an important conversation people should have when discussing security. The dream is perfect security and trust - something that no singular person could ever have completely, because it basically requires a ton of things to happen:
* You need to audit the blueprints for all hardware.
* You need to verify, physically, the products of manufacturing - the physical hardware you will use - often requiring you to know the design and likewise guarantee the implementation of the fab process.
* You need to audit and verify all firmware and software running on the system - from your flash controller to your chipset to your CPU to your GPU. This is on top of already having trust in the hardware.
* You need to then use software that is secure. Perfect security - mathematically proven security - is probably the most expensive thing you could try in software.
It is already impossible for any one individual to have audited all the hardware parts and the underlying OS and firmware, but then they need to also personally verify or write themselves the software implementations of security they will use.
We all, by using computers, are yielding an immense amount of security in the form of trust. One of the cornerstones of the free software and open hardware movements are how untrustworthy a singular set of eyes upon hardware or software truly are - that having the ability to independently have someone else inspect the code, or most importantly your own ability to do so, is what gives us reasonable expectations of security.
So nothing you ever use you can truly claim to be perfectly secure - you are always trusting that someone else is telling the truth when they say it is secure. In the best case scenario, a lot of unaffiliated people claim it is secure (ie, free software / free hardware). But we are well beyond the point anyone using an Internet based messaging app can presume perfect security, ever. The question is always who you are willing to trust when they claim to offer security - and to recognize when vendors are not promising (legitimate) security at all, as is the case with cell phones.
Re: Show HN: EZing – Mobile email client that looks like Messenger and uses PGP
#8I heard* that all smartphones/cellphones are inherently insecure because: 1. By design, the cellular radio controller (called the baseband) accepts important/privileged commands from the cell tower. (For example, "update firmware". Sometimes, there's even "read range of bytes from phone's internal storage".) 2. Portable fake cell towers exist (called Stringrays). Therefore, unfortunately, it seems unreasonable to cla…
If you're worried about an adversary with access to your phone's baseband, one alternative is to get a 4G hotspot and connect over wifi from an iPod Touch, iPad, or similar.
You're still relying on the wifi stack not having any holes that a compromised hotspot baseband could get through, and for that matter, relying on the whole OS not having any other holes they could attack. Either way, it's a smaller attack surface.
Re: Show HN: EZing – Mobile email client that looks like Messenger and uses PGP
#9Definitely a concept I have been considering and am interested in! But it's not open source! Site claims source will be available for review after beta but that is obviously futile, the devs could make an implementation mistake the very day after review is completed and bork the whole security model. Try again.
Definitely agree, something like this really needs to be open source. This sort of project is way too difficult for just one person or a small group to do on their own.
I love the idea, but I'd never trust this, and I'd never recommend someone use it.
Re: Show HN: EZing – Mobile email client that looks like Messenger and uses PGP
#10"Necessary keys are generated within the app so the private key never leaves the device"
Funny. With my email+PGP setup, my private key never even enters the device - https://grepular.com/An_NFC_PGP_SmartCard_For_Android