91–100 of 137 posts
Earlier quoted context omitted.
Coding is a purely ancillary function to my day job; I am not a developer.
"I hate coding" would be a problem for us, but "I ship software every day", not so much.
Earlier quoted context omitted.
"I hate coding" would be a problem for us, but "I ship software every day", not so much.
How about "I really enjoyed microcorruption and the crypto challenges, but am mostly working as a mechanical engineer"?
Earlier quoted context omitted.
It is also important to always remember that a crypto app isn't like other apps. If the protesters in Turkey rely on shoddy crypto today, it might cost them their lives a few months from now. I sincerely hope it doesn't come to that but it is a realistic example. Always be sure of what you are doing, rely on external review and never, I repeat, _never_ overstate the security of your crypto system.
This point cannot be emphasized enough. In the extreme case, which Cryptocat marketing materials have employed, secure communications software is life safety critical on a level similar to medical or aviation software. As such, the admit-your-mistakes-and-fix-them-later model of development isn't agile, open, or any of those buzzwords. It's a way to get people killed.
This is most alarming. CryptoCat's OTR implementation on all platforms allows a chat peer to change their OTR key during a chat session without user notification. An attacker performing a man-in-the-middle attack against the client's XMPP or HTTPS stream can inject their own OTR key in the discussion after a user has authenticated their peer's OTR fingerprint. This permits the attacker to decrypt all messages that foll…
(The 'issue E' that it references is https://github.com/cryptocat/cryptocat/issues/606 .)
Earlier quoted context omitted.
Speaking of the vulnerabilities that our team found, here is our blog post about it and a link to our report and the github issue tickets that we opened: Here is our blog post about our audit of Cryptocat, which was also announced today: https://leastauthority.com/blog/
There is great stuff in here, including the CTR nonce reuse bug that Nadim wrote about earlier. Ouch.
Earlier quoted context omitted.
I just reviewed all open and closed bugs in TextSecure's Issues page and didn't see a single crypto protocol bug. Admittedly, I looked quickly and casually. Could you point us to one?
"I just reviewed all open and closed bugs in TextSecure's Issues page and didn't see a single crypto protocol bug. Admittedly, I looked quickly and casually. Could you point us to one?" You could not have reviewed all open and closed bugs in 8 minutes ;) Issue 1073: https://github.com/WhisperSystems/TextSecure/issues/1073 Another one: Just sent an encrypted photo to someone? The photo is stored unencrypted on your ph…
It's also true that until recently we didn't have an encrypted group chat protocol, but at no point in the past did TextSecure ever indicate that group chat was encrypted. Just the opposite.
It's important to realize that TextSecure is simultaneously a standard unencrypted SMS app as well as an encrypted chat app.
Earlier quoted context omitted.
Generally 10-50k is a good starting point for this level. Most firms are full up on work most of the time, but will often try to get interesting new companies or projects even if they're less profitable since 1) they can grow into better stuff 2) good for reputation and for retention of their own employees. Compliance-only is usually cheaper; you can buy rubber stamps for <$10k.
It's important to distinguish that the places offering the Places like that are just running a scanner against your website. In the case of an app like this (which was an iOS app), you might find a cheap place to run it through a source code analyzer (either through a cloud-hosted service like Veracode, or by running an app like AppScan). Assuming you wanted to hire a "respectable" firm to actually perform a real app…
You can also get a better deal if 1) you're open source, and the audit becomes part of someone's portfolio 2) you provide really clear documentation, security model, etc. to make the process more efficient 3) your app is already well-architected so the security-critical part is small, and you only audit that part.
There's probably a 100x bigger pool of people capable of doing "IT audits" and "hosting environment audits" well vs. appsec for webapp or mobile app (or especially desktop app).
Earlier quoted context omitted.
I just reviewed all open and closed bugs in TextSecure's Issues page and didn't see a single crypto protocol bug. Admittedly, I looked quickly and casually. Could you point us to one?
"I just reviewed all open and closed bugs in TextSecure's Issues page and didn't see a single crypto protocol bug. Admittedly, I looked quickly and casually. Could you point us to one?" You could not have reviewed all open and closed bugs in 8 minutes ;) Issue 1073: https://github.com/WhisperSystems/TextSecure/issues/1073 Another one: Just sent an encrypted photo to someone? The photo is stored unencrypted on your ph…
I will agree with you about the UI design until the revamp in the latest release, though.
Earlier quoted context omitted.
Was it commissioned by you? The audit I saw had the Open Technology Fund's logo on it. OTF is a US Government effort driven by Radio Free Asia and the Broadcast Board of Governors. OTF, again (smartly) using US taxpayer dollars, funds audits of a variety of privacy technologies. For instance, they also funded a good-sized chunk of the Truecrypt audit.
Hi Thomas, OTF provides a form projects like ours can fill to commission this type of audit. So basically, we asked OTF to commission it for us and they accepted. TextSecure, a great encryption app that I've seen you recommend, also approached OTF and obtained an audit from iSEC via this same process. However, TextSecure decided not to publish their audit results. You can read about OTF's reaction to these audits her…
Also, during the period of time when TextSecure received audits from firms as part of an OTF grant, publishing the results was not an option that was contractually available to us. It's not something we "decided."
Earlier quoted context omitted.
Hi Thomas, OTF provides a form projects like ours can fill to commission this type of audit. So basically, we asked OTF to commission it for us and they accepted. TextSecure, a great encryption app that I've seen you recommend, also approached OTF and obtained an audit from iSEC via this same process. However, TextSecure decided not to publish their audit results. You can read about OTF's reaction to these audits her…
To clarify, these audits aren't a choice , they are a contractual obligation as part of receiving grant funding from OTF. Projects are allowed some flexibility in terms of when they schedule it, but it has to be done. I think it's a great idea. Also, during the period of time when TextSecure received audits from firms as part of an OTF grant, publishing the results was not an option that was contractually available t…
That being said, what is stopping you from publishing the audits today?