Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Moxie Marlinspike Makes Encryption for Everyone

popsci.com

Post reply on HN
Print view View original

41–50 of 144 posts

Re: Moxie Marlinspike Makes Encryption for Everyone

#41

Post by sandebert »

simoncion wrote: post #38
sandebert wrote: post #10

Earlier quoted context omitted.

Well, no. You could have a situation where there's a policy in place forbidding installing GPL-licensed products. (I don't have any info about it, but I wouldn't be surprised if that was the case at Microsoft a while ago.) EDIT: I'm getting downvotes and don't understand why. I'm seriously interested, can someone explain the reason?

> I'm getting downvotes and don't understand why. I'm seriously interested, can someone explain the reason? Probably because your comment is of the form "Well, here's a ridiculously unlikely (as well as patently ridiculous) thing that I'm going to use as a counter to your argument." Preemptive downvoter shield attempt: I'm deliberately taking a very uncharitable view of sandebert's comment in order to answer his ques…

Thanks, that could be it, I suppose.

But I don't understand why my comment would be considered that ridiculous. I've worked at a company where it was not forbidden, but strongly frowned upon to use open source of any kind ("because we need to be able to keep someone accountable if the software breaks"). And on top of my mind I recall several stories by Patio11 where he talks about trying to get a piece of software in his days as salary man. And getting plain refused from his manager, because the software was way too cheap.

Agreed, none of these examples are specifically about GPL, but they would very well cover the statement I responded to: "GPL code can be used anywhere".

And just to be super clear: I wasn't trying to make a "cute" comment about a super extreme situation. I was merely trying to present a little more nuance to the statement given.

Re: Moxie Marlinspike Makes Encryption for Everyone

#42

Post by aexaey »

oh_sigh wrote: post #22
blablablaat wrote: post #18

Earlier quoted context omitted.

I can understand that he sets his own priorities. But in this case someone else took the sourcecode, built the app and published it to F-Droid. The only thing Moxie had to do was not threaten them with legal action.

The problem is that, at that point, Moxie couldn't confirm that the uploaded binary was the same one as packaged by their official release. Secure communication protocols are irrelevant if the client which you are communicating on is compromised.

What you have described is pretty much an opposite of how F-droid works. One can't just take binary (whether official or compromised) and upload it there. [1]

Instead, to publish an app there, you need to provide source code repository [2], and their build farm would build it, sort-of [3] providing guarantee that source code you can inspect is the same one you got running on your phone.

[1] There are exceptions, i.e. apps uploaded as binary-only (for example Firefox), but those come with big red warning that user sees before installing them.

[2] https://f-droid.org/wiki/page/FAQ_-_App_Developers#Will_my_a...

[3] Sort-of because reproducible builds for Android not here yet, so you can't just rebuilt it yourself and compare sha256, unfortunately.

Re: Moxie Marlinspike Makes Encryption for Everyone

#43

Post by lorenzhs »

aexaey wrote: post #42
oh_sigh wrote: post #22

Earlier quoted context omitted.

The problem is that, at that point, Moxie couldn't confirm that the uploaded binary was the same one as packaged by their official release. Secure communication protocols are irrelevant if the client which you are communicating on is compromised.

What you have described is pretty much an opposite of how F-droid works. One can't just take binary (whether official or compromised) and upload it there. [1] Instead, to publish an app there, you need to provide source code repository [2], and their build farm would build it, sort-of [3] providing guarantee that source code you can inspect is the same one you got running on your phone. [1] There are exceptions, i.e.…

Signal has reproducible builds for Android: https://whispersystems.org/blog/reproducible-android/ ...that just doesn't work with F-Droid. And building on their farm means that you have to trust them, and their build farm becomes a prime target if you want to infect lots of apps at once. In the play store, you sign your build, and Android will only let you install builds signed with that same key as updates. By moving the signing to F-Droid, you have to completely trust them.

Re: Moxie Marlinspike Makes Encryption for Everyone

#44

Post by abalone »

I've respected Moxie Marlinspike ever since he made sslstrip, a simple illustration of the fundamental insecurity of browser-based HTTPS.

However I do question his premise that criminals already have the wherewithal to opt in to "clunky" strong encryption before engaging in criminal activity.

In fact there are many scenarios where criminals simply go with the default security configuration in consumer devices, either because they (a) did not plan the crime in advance or (b) aren't as smart about opsec as you might expect.

There are many good arguments to make strong encryption the default for consumer devices, but here I feel he was attempting to take an easy way out by pretending it's orthogonal to investigating crimes. In fact it is a tradeoff, granting us security from cybercriminals and bad state actors (if there's even a difference), while making it harder for law enforcement in some scenarios.

Re: Moxie Marlinspike Makes Encryption for Everyone

#45

Post by tombrossman »

simoncion wrote: post #35
blablablaat wrote: post #7

Not for people who don't want Google on their device. He only wants distribution via Google, and even went as far to demand that free/libre Play-alternative F-droid removed their build of TextSecure. See: https://fdroid.eutopia.cz/

> He only wants distribution via Google... Untrue. He only wants distribution through channels that provide the same security assurances and deployment features that Google does through the Play Store. [0][1][2] He's also quite open to replacing use of GCM with WebSockets or some equivalent tech, but if you don't use GCM, the replacement is likely going to significantly reduce battery life of phones on cell networks.…

These are some good points but when you say "He only wants distribution through channels that provide the same security assurances and deployment features that Google does through the Play Store." it must be noted that this isn't a guarantee of security.

A quick search of 'Google Play malware' returns many results from 2016 and going back to when it was still called Android Market. This isn't hand-waving, there are many concrete and specific examples of security lapses in the Google Play store and this is a persistent problem. Plenty of bright people over there who care and are working on it I'm sure, but not solved yet.

Bottom line is it's his decision to make, but the only certainty that using Google's store brings is that you must have a first-party relationship with Google to use his app. It's better than downloading APKs from some warez site but not a guarantee of security. Framing it this way misses the bigger picture.

Re: Moxie Marlinspike Makes Encryption for Everyone

#46

Post by tombrossman »

ScottBurson wrote: post #12
vechernyaya wrote: post #5

Oh the irony of an article about encryption on a site sans encryption.

Huh? I'm connecting over HTTPS right now. Have you tried it?

How are you connecting to the site? Genuinely curious as it definitely does not support HTTPS which the sibling comments confirm. Are you on a work computer with proxied MITM certificates, maybe some badly-configured security software (like Superfish), or something else? It would be good to know why this is happening.

Re: Moxie Marlinspike Makes Encryption for Everyone

#47

Post by mikekchar »

blablablaat wrote: post #7

Not for people who don't want Google on their device. He only wants distribution via Google, and even went as far to demand that free/libre Play-alternative F-droid removed their build of TextSecure. See: https://fdroid.eutopia.cz/

I think we're missing some information here. The supplied link says that the applications have been renamed due to legal threats. This seems completely reasonable to me. The names of the apps are trademarks and for a security product, who builds it is important to the integrity of the mark.

I'm trying to remember how Android works, but I seem to recall that you need to sign the packages differently on Play and Fdroid. So you literally can't redistribute the same Play package with Fdroid (someone correct me if I'm wrong). This means rebuilding... and hence rebranding.

It seems that MM was asked to provide a build for Fdroid. He decided not to. That's completely his right. He doesn't go into a lot of detail about why he has decided this, but it's completely up to him.

So all I can tell is that there is an Fdroid version, which has a different name. You can't switch easily between the Play and Fdroid versions because of code suckage... which sucks, but isn't a GPL violation.

Is this just a tempest in a teapot, or am I missing something?

Re: Moxie Marlinspike Makes Encryption for Everyone

#48

Post by yarou »

lorenzhs wrote: post #43
aexaey wrote: post #42

Earlier quoted context omitted.

What you have described is pretty much an opposite of how F-droid works. One can't just take binary (whether official or compromised) and upload it there. [1] Instead, to publish an app there, you need to provide source code repository [2], and their build farm would build it, sort-of [3] providing guarantee that source code you can inspect is the same one you got running on your phone. [1] There are exceptions, i.e.…

Signal has reproducible builds for Android: https://whispersystems.org/blog/reproducible-android/ ...that just doesn't work with F-Droid. And building on their farm means that you have to trust them, and their build farm becomes a prime target if you want to infect lots of apps at once. In the play store, you sign your build, and Android will only let you install builds signed with that same key as updates. By moving…

> By moving the signing to F-Droid, you have to completely trust them.

Which you do anyway if you use Google Play Services.

...

Re: Moxie Marlinspike Makes Encryption for Everyone

#49

Post by kuschku »

lorenzhs wrote: post #43
aexaey wrote: post #42

Earlier quoted context omitted.

What you have described is pretty much an opposite of how F-droid works. One can't just take binary (whether official or compromised) and upload it there. [1] Instead, to publish an app there, you need to provide source code repository [2], and their build farm would build it, sort-of [3] providing guarantee that source code you can inspect is the same one you got running on your phone. [1] There are exceptions, i.e.…

Signal has reproducible builds for Android: https://whispersystems.org/blog/reproducible-android/ ...that just doesn't work with F-Droid. And building on their farm means that you have to trust them, and their build farm becomes a prime target if you want to infect lots of apps at once. In the play store, you sign your build, and Android will only let you install builds signed with that same key as updates. By moving…

F-Droid also has reproducible builds – and not just ones where you have to download a binary from a questionable source and use it to compile things.

You can sign with your own key on F-Droid, too – if you use their way of dealing with reproducible builds.

Re: Moxie Marlinspike Makes Encryption for Everyone

#50

Post by kuschku »

mikekchar wrote: post #47
blablablaat wrote: post #7

Not for people who don't want Google on their device. He only wants distribution via Google, and even went as far to demand that free/libre Play-alternative F-droid removed their build of TextSecure. See: https://fdroid.eutopia.cz/

I think we're missing some information here. The supplied link says that the applications have been renamed due to legal threats. This seems completely reasonable to me. The names of the apps are trademarks and for a security product, who builds it is important to the integrity of the mark. I'm trying to remember how Android works, but I seem to recall that you need to sign the packages differently on Play and Fdroid…

> I'm trying to remember how Android works, but I seem to recall that you need to sign the packages differently on Play and Fdroid. So you literally can't redistribute the same Play package with Fdroid (someone correct me if I'm wrong). This means rebuilding... and hence rebranding.

You can distribute the same build on F-Droid and Play, and also signed with your own key, if you use proper reproducible builds

(And not the TextSecure variant of "let’s download this huge image and let it compile the app", because that opens you to evil compiler issues).

Post reply on HN