Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: ChatSecure iOS v3.0 (OTR + Tor + XMPP)

chatsecure.org

Post reply on HN
Print view View original

21–29 of 29 posts

Re: Show HN: ChatSecure iOS v3.0 (OTR + Tor + XMPP)

#21

Post by richardwhiuk »

tyrion wrote: post #7

If you are so concerned about privacy and security, why use an iOS device at all? Note: I am not trolling. It is a serious question. I mean, probably no one would be using ChatSecure if it were not Free Software, rightly, because nobody could audit its source code, but then isn't it a security/privacy issue using it on top of a completely closed platform?

That way lies the path of not having a smartphone.

All smartphones on the market involve some level of closed source - whether that's the baseband, the graphics blob, the chipset, the ROM, the firmware, or the complete operating system. Any of these could theoretically intercept the voice from the microphone / speaker, encode it and ship it on some back channel to the Five Eyes.

At that point it's simply a matter of where you draw the line between paranoia (that the NSA are reading your thoughts and have compromised everything) / idealism (e.g. RMS) and ease of use.

Re: Show HN: ChatSecure iOS v3.0 (OTR + Tor + XMPP)

#24

Post by gnur »

acdha wrote: post #13
tyrion wrote: post #7

If you are so concerned about privacy and security, why use an iOS device at all? Note: I am not trolling. It is a serious question. I mean, probably no one would be using ChatSecure if it were not Free Software, rightly, because nobody could audit its source code, but then isn't it a security/privacy issue using it on top of a completely closed platform?

1. You are using the device you already have 2. You know that for non-experts the free software distinction is pointless because almost nobody actually audits the installed binaries either way 3. You value the security benefits from iOS's more restrictive app sandbox and mandatory code auditing. (That last is not an Android slam – both policies have their merits but the net effect is that Android has more malware tha…

It is clear that there really is no iOS's mandatory code auditing. If there was, there would be no iOS apps that pose as one app but are actually an other (like emulators).

There is some auditing, but it isn't fool proof and for developers it is a huge pain in the butt.

And there are multiple ways to get code on an Android device, but by default only the play store is enabled. You need to go into settings and accept multiple warnings to sideload apps.

Re: Show HN: ChatSecure iOS v3.0 (OTR + Tor + XMPP)

#25

Post by jakeogh »

tyrion wrote: post #7

If you are so concerned about privacy and security, why use an iOS device at all? Note: I am not trolling. It is a serious question. I mean, probably no one would be using ChatSecure if it were not Free Software, rightly, because nobody could audit its source code, but then isn't it a security/privacy issue using it on top of a completely closed platform?

Good point. Until we control of the baseband it's somewhat moot what smartphone you use.

Anyone working on an open LTE stack? I'm looking for the donate link @ http://bb.osmocom.org/trac/ ...

Re: Show HN: ChatSecure iOS v3.0 (OTR + Tor + XMPP)

#26

Post by jakeogh »

avree wrote: post #15
tyrion wrote: post #7

If you are so concerned about privacy and security, why use an iOS device at all? Note: I am not trolling. It is a serious question. I mean, probably no one would be using ChatSecure if it were not Free Software, rightly, because nobody could audit its source code, but then isn't it a security/privacy issue using it on top of a completely closed platform?

Because there's a tradeoff between 'privacy and security' and 'convenience', and most people like to fall somewhere in the middle. It's like locking your doors on your house. Sure, a burglar could break the door down, smash a window, follow you around and steal your keys, etc., but it adds a level of security and precaution that keeps some of the bad guys out while not being insanely inconvenient. I care about the pr…

A closer analogy would address a group controlled by a few which has the resources to install people (whom believe that are doing good things) into positions that have access to your private keys. It's more like there is an automatically updated encrypted manifest of your house available. The bunker analogy is bad unless you think we should meet in the middle on infosec. At some point, this same conversation will be about hardware inside our heads, we already use these devices like second brains.

Re: Show HN: ChatSecure iOS v3.0 (OTR + Tor + XMPP)

#27

Post by avree »

jakeogh wrote: post #26
avree wrote: post #15

Earlier quoted context omitted.

Because there's a tradeoff between 'privacy and security' and 'convenience', and most people like to fall somewhere in the middle. It's like locking your doors on your house. Sure, a burglar could break the door down, smash a window, follow you around and steal your keys, etc., but it adds a level of security and precaution that keeps some of the bad guys out while not being insanely inconvenient. I care about the pr…

A closer analogy would address a group controlled by a few which has the resources to install people (whom believe that are doing good things) into positions that have access to your private keys. It's more like there is an automatically updated encrypted manifest of your house available. The bunker analogy is bad unless you think we should meet in the middle on infosec. At some point, this same conversation will be…

Yeah, my housecleaner, dogwalker, and certain other people have keys.

I run the risk of them deciding to one day loot everything I own, and yet, I realize that the convenience of the services they provide is worth that minimal risk.

Same case with my cell phone.

Re: Show HN: ChatSecure iOS v3.0 (OTR + Tor + XMPP)

#28

Post by acdha »

gnur wrote: post #24
acdha wrote: post #13

Earlier quoted context omitted.

1. You are using the device you already have 2. You know that for non-experts the free software distinction is pointless because almost nobody actually audits the installed binaries either way 3. You value the security benefits from iOS's more restrictive app sandbox and mandatory code auditing. (That last is not an Android slam – both policies have their merits but the net effect is that Android has more malware tha…

It is clear that there really is no iOS's mandatory code auditing. If there was, there would be no iOS apps that pose as one app but are actually an other (like emulators). There is some auditing, but it isn't fool proof and for developers it is a huge pain in the butt. And there are multiple ways to get code on an Android device, but by default only the play store is enabled. You need to go into settings and accept…

> It is clear that there really is no iOS's mandatory code auditing. If there was, there would be no iOS apps that pose as one app but are actually an other (like emulators).

If you believe that, you need to do some research first. Many people have verified that apps are flagged for using private APIs, certain syscalls, trying to access certain file paths, etc. Nobody's claiming that Apple has solved the halting problem or that static analysis can't be bypassed (see e.g. http://www.news.gatech.edu/2013/07/31/georgia-tech-uncovers-...) but static analysis + even limited runtime monitoring is a lot more than than the disastrous status quo for the desktop world.

> And there are multiple ways to get code on an Android device, but by default only the play store is enabled. You need to go into settings and accept multiple warnings to sideload apps.

This is exactly why I noted the users’ inability to make security decisions reliably. That doesn't mean Android is bad or that the iOS model lacks drawbacks – it's just an explicit tradeoff: J. Random Hacker loses the ability to install an app on iOS without going through the app store process so J. Random Phisher can't convince someone to install their app for free games/movies/coupons/porn/alleged security benefits/etc. Given that has already happened to non-trivial numbers of people, I can understand why they made that decision even if I'm not completely comfortable with the implications.

Re: Show HN: ChatSecure iOS v3.0 (OTR + Tor + XMPP)

#29

Post by xxdesmus »

chrisballinger wrote: post #20
xxdesmus wrote: post #18

Earlier quoted context omitted.

Signal doesn't do messaging on iOS right now, only phone calls.

It will soon! After playing around with their latest Signal 2.0 beta that integrates TextSecure support, I honestly would recommend using Signal unless you specifically need Tor/OTR or want to host your own XMPP infrastructure.

Oh nice, I'd love to give the Signal 2.0 beta a go if you have any invites into the beta testing? :)
Post reply on HN