41–50 of 50 posts
I don't know much about WebRTC, but I think it's something you can set and Subrosa should be doing so in app-webrtc.js.
Earlier quoted context omitted.
Sure, but if you run your own server, then the site's claim that there was "no download or install needed" doesn't apply to you. If you don't run your own server, the site's claim that "nobody, not even us, can read or listen into your conversations" doesn't apply to you. There's nobody to whom both claims apply at the same time!
If you run your own server, you can make trusted calls from machines that don't have any client software set up, as can others using your server. Seems straightforward enough. It's clear the "no install" claims are about the client.
The developers might well be thinking along the lines that you describe, but I don't think that a visitor to the site is likely to understand the threats that way.
Edit: Looking at https://subrosa.io/security I think it's even more clear that they're making these claims for their own hosted instance of their software -- and that's what people here are most skeptical of.
Earlier quoted context omitted.
Sure, but if you run your own server, then the site's claim that there was "no download or install needed" doesn't apply to you. If you don't run your own server, the site's claim that "nobody, not even us, can read or listen into your conversations" doesn't apply to you. There's nobody to whom both claims apply at the same time!
If you run your own server, you can make trusted calls from machines that don't have any client software set up, as can others using your server. Seems straightforward enough. It's clear the "no install" claims are about the client.
Subrosa's value proposition is more as a meeting place then as a "secure" chat software.
In the description of the key exchange mechanism (section 'Conversation Keys' under 'Security') it sounds like they're using one symmetric key for both directions of a two-way channel. If true, this is a pretty serious security flaw. Anyone from Subrosa care to comment?
They keep repeating they've been audited but not naming the auditors.
Earlier quoted context omitted.
Everything this article says is true. That being said, it also applies to any regular application that can be upgraded automatically or that's upgraded at all by a third party. Anything you get off an app store can have its code switched out from under it with minimal and routine or in some cases even no user interaction. All someone has to do is compromise the signing key, which is probably not that hard in many cas…
Sure; but there's a world of difference between communicating with a webapp that claims to protect your privacy even from the NSA (but actually cannot) vs. "any regular application", which makes no such security claims, and from whom savvy users won't expect that kind of protection. People with important information to communicate that they must protect from the powers that be (quite possibly to protect their own liv…
"Nobody, not even us, can read or listen into your conversations." This cannot possibly be true, given they are the root of trust for establishing the recipient's authentic public key. Also, minified javascript really does not count as a source code release.
Quite right. If they were compelled -- e.g., "insert this backdoor or we'll imprison you" -- they might trivially serve up a tweaked version of their JavaScript to the one user the NSA was interested in. And it wouldn't take a complicated tweak at all to sneak the real password (or some sufficient version of it) back to the server, after which point certainly "even us" can read & listen in to all of that user's conve…
At first I thought it was an extra layer of security , like most online games have, to discourage username/password bruteforcing. (It's an obscurity layer, but obscurity layers are not by definition bad.) But you need to tell others your username to communicate with them.
Earlier quoted context omitted.
Everything this article says is true. That being said, it also applies to any regular application that can be upgraded automatically or that's upgraded at all by a third party. Anything you get off an app store can have its code switched out from under it with minimal and routine or in some cases even no user interaction. All someone has to do is compromise the signing key, which is probably not that hard in many cas…
Scarily true. The amount of damage malicious actors with keys can do is greatly magnified by the auto-update mechanisms that developers love.
I take fairly strong precautions with my keys: offline storage, encrypted, signing on an air-gapped machine. I'd bet you money that most people aren't so careful. There are probably a lot of secret signing keys sitting in DropBox.
First impression: - There is no demo, i can only guess that this is a "browser-based skype". I hate when i can't try it but it's free. - Open-source, but no git repo? Btw I had the same idea before (I posted it to an Idea Sunday thread) but I dropped the idea because i realized that no one needs this level of security, NSA is not interested in your chat with family and friends...
"There is no demo" -- just make an account quickly and try it out. I did this and it was easy. "Open-source, but no git repo" -- Open-source does not always entail git or Github. "I dropped the idea because i realized that no one needs this level of security, NSA is not interested in your chat with family and friends..." -- I'm glad you dropped the idea because someone who doesn't understand why privacy is important…