Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Subrosa – An encrypted communication platform

subrosa.io

Post reply on HN
Print view View original

11–20 of 50 posts

Re: Subrosa – An encrypted communication platform

#11

Post by api »

Scaevolus wrote: post #2

Matasano's "Javascript Cryptography Considered Harmful" is yet again applicable. http://matasano.com/articles/javascript-cryptography/ These statements are mutually exclusive: End to end encrypted: Nobody, not even us, can read or listen into your conversations. Works everywhere: Visit subrosa.io from any computer. No download or install needed.

Everything this article says is true. That being said, it also applies to any regular application that can be upgraded automatically or that's upgraded at all by a third party. Anything you get off an app store can have its code switched out from under it with minimal and routine or in some cases even no user interaction. All someone has to do is compromise the signing key, which is probably not that hard in many cases.

Re: Subrosa – An encrypted communication platform

#12

Post by phibit »

Scaevolus wrote: post #2

Matasano's "Javascript Cryptography Considered Harmful" is yet again applicable. http://matasano.com/articles/javascript-cryptography/ These statements are mutually exclusive: End to end encrypted: Nobody, not even us, can read or listen into your conversations. Works everywhere: Visit subrosa.io from any computer. No download or install needed.

Can you explain how these two statements are mutually exclusive?

These statements are mutually exclusive: End to end encrypted: Nobody, not even us, can read or listen into your conversations. Works everywhere: Visit subrosa.io from any computer. No download or install needed.

Re: Subrosa – An encrypted communication platform

#13

Post by explorigin »

hluska wrote: post #8
Scaevolus wrote: post #2

Matasano's "Javascript Cryptography Considered Harmful" is yet again applicable. http://matasano.com/articles/javascript-cryptography/ These statements are mutually exclusive: End to end encrypted: Nobody, not even us, can read or listen into your conversations. Works everywhere: Visit subrosa.io from any computer. No download or install needed.

That is such a good article and I cannot believe that I am just reading it for the first time now. Thank you so much for posting the article and your explanation of the two mutually exclusive statements. Crypto is just about the coolest thing I have ever heard of and I love learning about different types of attacks!

This is not a "good" article. It's very hand wavey with lots of fud.

For example, he talks about the chicken and egg problem of delivering javascript over an insecure connection and then solves it later with SSL/TLS (but he doesn't acknowledge that this is a valid solution). Furthermore, we're all harping on javascript when you can't download PuTTY over an SSL connection.

He talks about browser cache but says that javascript can't control it. That doesn't mean it can't be controlled (see MANIFEST file).

I could go on, but the point is made, there are answers to the problems raised in the article. They may not be _easy_ (as the article complains some things are complex), but it's security on wildly complex systems...of course it's hard.

Re: Subrosa – An encrypted communication platform

#14

Post by vsakos »

phibit wrote: post #10
vsakos wrote: post #3

First impression: - There is no demo, i can only guess that this is a "browser-based skype". I hate when i can't try it but it's free. - Open-source, but no git repo? Btw I had the same idea before (I posted it to an Idea Sunday thread) but I dropped the idea because i realized that no one needs this level of security, NSA is not interested in your chat with family and friends...

"There is no demo" -- just make an account quickly and try it out. I did this and it was easy. "Open-source, but no git repo" -- Open-source does not always entail git or Github. "I dropped the idea because i realized that no one needs this level of security, NSA is not interested in your chat with family and friends..." -- I'm glad you dropped the idea because someone who doesn't understand why privacy is important…

I know it can be open source without git, but GitHub gives a lot of benefits.

Also as I understood, you don't have Facebook, Twitter, Skype, Googe, Outlook, YouTube, and even HN account because NSA could one day transform everything against you?!

Re: Subrosa – An encrypted communication platform

#15

Post by CJefferson »

phibit wrote: post #12
Scaevolus wrote: post #2

Matasano's "Javascript Cryptography Considered Harmful" is yet again applicable. http://matasano.com/articles/javascript-cryptography/ These statements are mutually exclusive: End to end encrypted: Nobody, not even us, can read or listen into your conversations. Works everywhere: Visit subrosa.io from any computer. No download or install needed.

Can you explain how these two statements are mutually exclusive? These statements are mutually exclusive: End to end encrypted: Nobody, not even us, can read or listen into your conversations. Works everywhere: Visit subrosa.io from any computer. No download or install needed.

subrosa can choose at any time to send you javascript which will send your password back to them. You have no way of checking for this (well, except reading all the javascript, every time you log in)

Re: Subrosa – An encrypted communication platform

#16

Post by orthecreedence »

vsakos wrote: post #14
phibit wrote: post #10

Earlier quoted context omitted.

"There is no demo" -- just make an account quickly and try it out. I did this and it was easy. "Open-source, but no git repo" -- Open-source does not always entail git or Github. "I dropped the idea because i realized that no one needs this level of security, NSA is not interested in your chat with family and friends..." -- I'm glad you dropped the idea because someone who doesn't understand why privacy is important…

I know it can be open source without git, but GitHub gives a lot of benefits. Also as I understood, you don't have Facebook, Twitter, Skype, Googe, Outlook, YouTube, and even HN account because NSA could one day transform everything against you?!

Possible scenario: you are chatting with a friend about how you bought bitcoin at 300 and sold at 500, making 6000USD on the trade. Your money is in an offshore exchange. Next year, you receive a bill from the IRS wanting their cut of the $6000. How did they know? You never pulled out your money.

Well, the NSA gave them a tip.

Now imagine you're running for public office and your opponents will pay top dollar for dirt on you. Imagine that one day you're at odds with your government and they'll use every piece of information they can to prosecute you.

Privacy from one's government and those who control/buy into it is something that nobody needs until they do.

That doesn't mean you can't have a public life as well. But why give out more than you need to?

Re: Subrosa – An encrypted communication platform

#17

Post by phibit »

vsakos wrote: post #14
phibit wrote: post #10

Earlier quoted context omitted.

"There is no demo" -- just make an account quickly and try it out. I did this and it was easy. "Open-source, but no git repo" -- Open-source does not always entail git or Github. "I dropped the idea because i realized that no one needs this level of security, NSA is not interested in your chat with family and friends..." -- I'm glad you dropped the idea because someone who doesn't understand why privacy is important…

I know it can be open source without git, but GitHub gives a lot of benefits. Also as I understood, you don't have Facebook, Twitter, Skype, Googe, Outlook, YouTube, and even HN account because NSA could one day transform everything against you?!

You misunderstood, completely. I never indicated that I don't have any FB/Twitter/Skype/... accounts.

The idea of having a secure communication channel doesn't mean that ALL your communications have to be over secure channels, that would be ridiculous. Having the option to bank on a secure channel for conversations you deem private is a perfectly reasonable compromise. People in government agencies switch between insecure and secure mediums regularly.

Having a FB/Twitter/Skype/HN account just means that I am willing to make a tradeoff of privacy to use these services, one that I am okay with. This does not completely exclude me from occasionally using a secure medium, right?

Re: Subrosa – An encrypted communication platform

#18

Post by phibit »

CJefferson wrote: post #15
phibit wrote: post #12

Earlier quoted context omitted.

Can you explain how these two statements are mutually exclusive? These statements are mutually exclusive: End to end encrypted: Nobody, not even us, can read or listen into your conversations. Works everywhere: Visit subrosa.io from any computer. No download or install needed.

subrosa can choose at any time to send you javascript which will send your password back to them. You have no way of checking for this (well, except reading all the javascript, every time you log in)

Ah yes, that makes sense, thanks!

Re: Subrosa – An encrypted communication platform

#19

Post by dublinben »

explorigin wrote: post #13
hluska wrote: post #8

Earlier quoted context omitted.

That is such a good article and I cannot believe that I am just reading it for the first time now. Thank you so much for posting the article and your explanation of the two mutually exclusive statements. Crypto is just about the coolest thing I have ever heard of and I love learning about different types of attacks!

This is not a "good" article. It's very hand wavey with lots of fud. For example, he talks about the chicken and egg problem of delivering javascript over an insecure connection and then solves it later with SSL/TLS (but he doesn't acknowledge that this is a valid solution). Furthermore, we're all harping on javascript when you can't download PuTTY over an SSL connection. He talks about browser cache but says that ja…

>we're all harping on javascript when you can't download PuTTY over an SSL connection

This shouldn't matter, and would just provide a false sense of security. You ought to be verifying the signature of any program you're installing before you use it. Since you're running Windows the point is probably moot, but it is possible to install software reasonably securely.

Post reply on HN