Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Darknet Messenger Briar Releases Beta, Passes Security Audit

briarproject.org

Post reply on HN
Print view View original

11–20 of 90 posts

Re: Darknet Messenger Briar Releases Beta, Passes Security Audit

#11

Post by QAPereo »

sillysaurus3 wrote: post #10
QAPereo wrote: post #9

Earlier quoted context omitted.

Purely naively I would guess that it means during whatever audit they ran, no signs of insecurity were observed. Maybe it would be better to say that it didn't "fail" the audit?

You can't really fail an audit though. The point of an audit is to make your application more secure. Using terms like pass/fail just reinforces a sense of fear where there shouldn't be any. A pentest consists of an analysis period, typically about a week. Then any flaws in your app are communicated to you, along with steps to reproduce them. When you feel you've fixed the issues, a retest is scheduled and the pentes…

>You can't really fail an audit though. The point of an audit is to make your application more secure. Using terms like pass/fail just reinforces a sense of fear where there shouldn't be any.

I see, that's a good point I hadn't considered.

Re: Darknet Messenger Briar Releases Beta, Passes Security Audit

#12

Post by burkaman »

baby wrote: post #4

"passes security audit". Is security audit an exam? What does passing mean?

Yes, a security audit is an examination of an application and the processes around it. In this case passing means the application "is able to offer a good level of privacy and security. In other words, the Briar secure messenger can be recommended for use."

Re: Darknet Messenger Briar Releases Beta, Passes Security Audit

#13

Post by Veratyr »

freshhawk wrote: post #7
kobeya wrote: post #2

Feedback: darknet has come to mean places where you go buy drugs online, not p2p applications generally.

Does it? I know it has that meaning on the evening news, but even on network television it means something like "the secret internet where crazy stuff is". I mostly hear it used to mean what it is supposed to mean, but that is rarely from non-technical people.

The problem is that as long as the name has that association at all, it's going to be a way to attack Briar.

Darknet now: Anonymous place drugs sometimes happen

Darknet if it becomes bigger: That place where terrorists and criminals hide, the FBI and NSA say it's a risk to national security and we have to stop it at all costs! What do you mean it's just a secure messaging app? I'm not a terrorist, I don't need anything like that!

Re: Darknet Messenger Briar Releases Beta, Passes Security Audit

#14

Post by rhizome »

Veratyr wrote: post #13
freshhawk wrote: post #7

Earlier quoted context omitted.

Does it? I know it has that meaning on the evening news, but even on network television it means something like "the secret internet where crazy stuff is". I mostly hear it used to mean what it is supposed to mean, but that is rarely from non-technical people.

The problem is that as long as the name has that association at all, it's going to be a way to attack Briar. Darknet now: Anonymous place drugs sometimes happen Darknet if it becomes bigger: That place where terrorists and criminals hide, the FBI and NSA say it's a risk to national security and we have to stop it at all costs! What do you mean it's just a secure messaging app? I'm not a terrorist, I don't need anythi…

They already say that about encryption in general, though.

Re: Darknet Messenger Briar Releases Beta, Passes Security Audit

#16

Post by Veratyr »

rhizome wrote: post #14
Veratyr wrote: post #13

Earlier quoted context omitted.

The problem is that as long as the name has that association at all, it's going to be a way to attack Briar. Darknet now: Anonymous place drugs sometimes happen Darknet if it becomes bigger: That place where terrorists and criminals hide, the FBI and NSA say it's a risk to national security and we have to stop it at all costs! What do you mean it's just a secure messaging app? I'm not a terrorist, I don't need anythi…

They already say that about encryption in general, though.

Yes but there's also a number of existing applications of encryption that are widely deemed acceptable, like securing bank transactions and medical data. Anonymity is much harder to defend, as it doesn't have such clearly worthy purposes.

Re: Darknet Messenger Briar Releases Beta, Passes Security Audit

#17

Post by the8472 »

Veratyr wrote: post #13
freshhawk wrote: post #7

Earlier quoted context omitted.

Does it? I know it has that meaning on the evening news, but even on network television it means something like "the secret internet where crazy stuff is". I mostly hear it used to mean what it is supposed to mean, but that is rarely from non-technical people.

The problem is that as long as the name has that association at all, it's going to be a way to attack Briar. Darknet now: Anonymous place drugs sometimes happen Darknet if it becomes bigger: That place where terrorists and criminals hide, the FBI and NSA say it's a risk to national security and we have to stop it at all costs! What do you mean it's just a secure messaging app? I'm not a terrorist, I don't need anythi…

You could also see it the other way around, your application is not secure enough if terrorists, dissidents, drug dealers, whistleblowers and child pornographers don't feel confident to use it.

Look at Tor.

Re: Darknet Messenger Briar Releases Beta, Passes Security Audit

#19

Post by tptacek »

burkaman wrote: post #12
baby wrote: post #4

"passes security audit". Is security audit an exam? What does passing mean?

Yes, a security audit is an examination of an application and the processes around it. In this case passing means the application "is able to offer a good level of privacy and security. In other words, the Briar secure messenger can be recommended for use."

All it means to "pass" an audit is that at the conclusion of the audit there were no outstanding vulnerabilities that the "auditor" had found.

"Audits" and "passing" make some sense for network security, where you can run a checklist of best practices and known vulnerabilities. But you can't really "audit" source code in the same sense, any more than you can contract someone to spend 2 weeks finding all the sev:hi crashers or data loss bugs in your database.

It would be good if organizations could stop pretending that "passing" a software security assessment was meaningful.

What you really want to know is how many person/days Cure53 spent on Briar, who Cure53 had staffing the engagement, what the scope of the engagement was (what components were off limits), and whether they found anything that was subsequently fixed (it's an industry secret that one of the reasons you do an audit is so you don't have to publish the "real" findings).

From the report, it looks like they spent 13 calendar days testing (it's not clear how many person/days were spent), of which only 3 were dedicated to cryptography, and the audit was constrained to the Android clientside code.

For perspective: the "industry standard" software pentest of a reasonably complicated web application is 2 people, 2 weeks.

Re: Darknet Messenger Briar Releases Beta, Passes Security Audit

#20

Post by Veratyr »

the8472 wrote: post #17
Veratyr wrote: post #13

Earlier quoted context omitted.

The problem is that as long as the name has that association at all, it's going to be a way to attack Briar. Darknet now: Anonymous place drugs sometimes happen Darknet if it becomes bigger: That place where terrorists and criminals hide, the FBI and NSA say it's a risk to national security and we have to stop it at all costs! What do you mean it's just a secure messaging app? I'm not a terrorist, I don't need anythi…

You could also see it the other way around, your application is not secure enough if terrorists, dissidents, drug dealers, whistleblowers and child pornographers don't feel confident to use it. Look at Tor.

You could but I doubt the general public and policy makers are going to see it this way. They're still looking for a backdoor that only the "good guys" can access.
Post reply on HN