What the CIA WikiLeaks Dump Tells Us: Encryption Works
1–10 of 270 posts
Re: What the CIA WikiLeaks Dump Tells Us: Encryption Works
#2Seriously - does it?
Re: What the CIA WikiLeaks Dump Tells Us: Encryption Works
#3What a welcome shift in public sentiment. Mainstream media is starting to recommend end-to-end encryption, without back doors, for everybody. (Though the New York Times might represent the leading edge of the change in popular opinion.)
Re: What the CIA WikiLeaks Dump Tells Us: Encryption Works
#4Or is that what they want us to think
Re: What the CIA WikiLeaks Dump Tells Us: Encryption Works
#5I remember reading a poll where European Parliament members claimed that encryption (esp. HTTPS and E2E) was the biggest obstacle to espionage. I'm glad to see that this is a widespread sentiment.
Re: What the CIA WikiLeaks Dump Tells Us: Encryption Works
#6The article mentions WhatsApp multiple times as a service that successfully made the transition to end-to-end encryption, but it always seemed to me that this claim is rather meaningless when we don't have the possibility of auditing their source code.
Re: What the CIA WikiLeaks Dump Tells Us: Encryption Works
#7What a welcome shift in public sentiment. Mainstream media is starting to recommend end-to-end encryption, without back doors, for everybody. (Though the New York Times might represent the leading edge of the change in popular opinion.)
(Though the New York Times might represent the leading edge of the change in popular opinion.)
Note this is an AP article.
Re: What the CIA WikiLeaks Dump Tells Us: Encryption Works
#8It also tells us that Wikileaks is (still) important
Re: What the CIA WikiLeaks Dump Tells Us: Encryption Works
#9The article mentions WhatsApp multiple times as a service that successfully made the transition to end-to-end encryption, but it always seemed to me that this claim is rather meaningless when we don't have the possibility of auditing their source code.
How can you personally verify that any 3rd party service is doing what it claims?
Unless you're a security expert with plenty of time to comb through someone else's code, you're still relying on others to be truthful and competent. Even then you're relying on layers upon layers of software and hardware. Far too much for an individual to verify.
Re: What the CIA WikiLeaks Dump Tells Us: Encryption Works
#10The article mentions WhatsApp multiple times as a service that successfully made the transition to end-to-end encryption, but it always seemed to me that this claim is rather meaningless when we don't have the possibility of auditing their source code.
It seems that most people are completely in the dark when it comes to security, including myself, but there are some principles that should be unwavering that regularly get ignored again with every new iteration of "secure" software:
* If there is a weak layer in the stack, from the physical layer to to UI, then the system is not secure. Even if your messaging app is secure, your messages are not secure if your OS is not secure
* If the source code is not available for review, the software is not secure
* If you or someone you trust has not done a full and thorough review of all components of the stack you are using, the software is not secure
* Even if the source code is available, the runtime activity must be audited, as it could download binaries or take unsavory actions or connections.
* On the same note, if you do not have a mechanism for verifying the authenticity of the entire stack, the software is not secure.
* If any part of the stack has ever been compromised, including leaving your device unlocked for five minutes in a public place, the software is not secure.
I could go on, and I'm FAR from a security expert. People compromise way too much on security, and make all kinds of wrong assumptions when some new organization comes out and claims that their software is the "secure" option. We see this with apps like Telegram and Signal, where everyone thinks they are secure, but if you really dig down, most people believe they are secure for the wrong reasons:
* The dev team seems like honest and capable people
* Someone I trust or some famous person said this software is secure
* They have a home page full of buzzwords and crypto jargon
* They threw some code up on github
* I heard they are secure in half a dozen tweets and media channels