Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Coder Who Encrypted Your Texts

wsj.com

Post reply on HN
Print view View original

111–120 of 191 posts

Re: The Coder Who Encrypted Your Texts

#111

Post by juhanima »

abalone wrote: post #24

I've had a ton of respect for Marlinspike ever since he published sslstrip, an incredibly simple defeat of HTTPS.[1] It's a perfect demonstration of the fundamental insecurity of the web thus far. When an insecure communication mode (HTTP) is the default and perfectly ok most of the time, the browser has no idea when you are supposed to be operating on a secure channel (HTTPS) but have been tricked into downgrading b…

> the browser has no idea when you are supposed to be > operating on a secure channel (HTTPS)

Agree about the sentiment, but there are some ways to help this. The server can for instance tell the client to always require https:

https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security

Doesn't help if the client hasn't yet connected to the right server at least once, though.

Re: The Coder Who Encrypted Your Texts

#112

Post by lostlogin »

blfr wrote: post #104
aw3c2 wrote: post #94

Earlier quoted context omitted.

And that is one country out of ~200.

Yes but it has 350M people living in it, half the HN, Silicon Valley, and Moxie with his team. It's not honest to say the US is just another country among 200.

Ones answer to that probably depends on where they live.

Re: The Coder Who Encrypted Your Texts

#113

Post by glogla »

I still can't get over Moxie wanting Google and Apple and Microsoft to be gatekeepers of what you can and can't do with your device and calling sideloading "that old broken desktop security model".

I admire your work Moxie, but sadly we stand on different sides of war on general purpose computing. I can't help but be saddened that "the other side" got someone so talented and dedicated.

Re: The Coder Who Encrypted Your Texts

#114

Post by glogla »

aw3c2 wrote: post #96
muppetman wrote: post #34

Earlier quoted context omitted.

People have sniffed the wire for the WhatApp client (on Android, towards another Android) and seen that it is encrypted. But your point stands - there's no UI to indicate if it was secure or not and the code isn't open so you can't know for sure.

Encryption on the transport != end-to-end encryption if you consider the users as the ends. The encryption might very well just be from your device to WhatsApp.

Or it might be like with skype - where according to some report (I don't have link right now, sadly) the encryption is used mostly for obfuscating the protocol and to make building alternative clients harder, but it is give so small entropy pool that it's useless for security.

Re: The Coder Who Encrypted Your Texts

#115

Post by glitchdout »

sergiotapia wrote: post #39

>Unfortunately, if Mr. Marlinspike’s encryption scheme can be applied to imagery, then childporn collectors thank him too. And there we go, highest voted comment on the article: a strawman about child pornography. Think of the keeeds

Either it's an uninformed person or it's a shill. Public opinion manipulating, as usual.

https://firstlook.org/theintercept/2014/02/24/jtrig-manipula...

Re: The Coder Who Encrypted Your Texts

#116

Post by Joeboy »

higherpurpose wrote: post #72
moxie wrote: post #5

I get a lot of credit for the stuff that Open Whisper Systems does, but it's not all me by a long shot. Trevor Perrin, Frederic Jacobs, Christine Corbett, Tyler Reinhard, Lilia Kai, Jake McGinty, and Rhodey Orbits are the crew that really made all this work happen.

Moxie, the progress on TextSecure/Signal integration seems to have slowed down quite a bit (at least as seen from the outside). I think it's been almost a year since Signal for iOS came out - yet still no word on Signal for Android. What is taking so long, if you don't mind me asking? Is there some sort of Signal 3.0 overhaul planned for all the platforms along with a big launch? Also, I think you've been quite retre…

> To monetize the apps have you considered trying to get Signal into enterprise

I agree with this bit. It seems weird that people with clear requirements for privacy, like doctors, lawyers, insurers etc, remain totally clueless about encryption.

While we might have more personal sympathy / affinity with political activists and nerds, they don't seem to be very good at proliferating encryption technology.

Re: The Coder Who Encrypted Your Texts

#117

Post by mike-cardwell »

moxie wrote: post #101
ianopolous wrote: post #98

I was a great fan of TextSecure until a few days ago. I had encouraged a bunch of friends to install it. One of them couldn't get rid of a notification from TextSecure about an unread message despite there being none, and eventually they uninstalled it. Then, for the next 4 months TextSecure blackholed every message I sent this friend without warning either them or me. They never received a single message from me. Af…

You'll find that this is true for every messenger on Android, since there is no way to detect someone uninstalling without unregistering. TextSecure has delivery receipts so you can see when your messages aren't being delivered, and there's a web-based unregistration flow on the Open Whisper Systems website so that users can unregister their numbers if they've uninstalled.

"there is no way to detect someone uninstalling without unregistering"

The TextSecure app could ping your server with a "I am still here" message if it goes a week without sending any messages. Don't hear from it for two weeks? Unregister it.

Would this not work?

Re: The Coder Who Encrypted Your Texts

#119

Post by mike-cardwell »

ianopolous wrote: post #102
moxie wrote: post #101

Earlier quoted context omitted.

You'll find that this is true for every messenger on Android, since there is no way to detect someone uninstalling without unregistering. TextSecure has delivery receipts so you can see when your messages aren't being delivered, and there's a web-based unregistration flow on the Open Whisper Systems website so that users can unregister their numbers if they've uninstalled.

Thanks for the reply, Moxie. I realise I sound negative, but I do love your work. The app gave me no indication that delivery was failing. Couldn't you detect the failure when you try and forward on the message from your servers (if it is a push architecture)? Happy to give you my details if you want to look into it.

It's using the Google Android push stuff, which means to deliver a message to a phone, Moxies server sends a message to Google to ask Google to push a message to the phone ASAP. So he gets no feedback.

Re: The Coder Who Encrypted Your Texts

#120

Post by Joeboy »

glogla wrote: post #113

I still can't get over Moxie wanting Google and Apple and Microsoft to be gatekeepers of what you can and can't do with your device and calling sideloading "that old broken desktop security model". I admire your work Moxie, but sadly we stand on different sides of war on general purpose computing. I can't help but be saddened that "the other side" got someone so talented and dedicated.

I don't know about Apple or MS, but building TextSecure from source and installing it on an android phone is about as easy as you could reasonably expect it to be. It seems churlish to complain that there are also easier ways to install it.

Edit: although, of course you have to trust Github or whoever if you install from source.

Post reply on HN