Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Coder Who Encrypted Your Texts

wsj.com

Post reply on HN
Print view View original

151–160 of 191 posts

Re: The Coder Who Encrypted Your Texts

#151

Post by lorenzhs »

Nutomic wrote: post #143
lorenzhs wrote: post #109

Earlier quoted context omitted.

that's not how the Play store (or Android) works. Moxie signs the APK, phones will only install updates that are signed with the same certificate as the version they already have. Google cannot modify apps. Edit: In contrast, the F-Droid builds were built and signed by F-Droid, so they could at any time include any code they wanted. Whom do you trust more, the developer or some alternate app store?

Google could also distribute a differently signed apk to selected users. And there's no way for users to check the signature of an apk (if they didn't have it installed before). And I certainly trust an open source project much more than a US company.

But that angle of attack only works if they target you from the moment you first install the app. It would be much easier to just push a modified Google application update to your phone if that is what they wanted.

What it boils down to is that with the Play store, you can be sure that you're not getting malicious updates from some intermediary, as each developer signs their own APKs, and Google doesn't have the keys. Whereas if f-droid is compromised, all applications they build are compromised. That's a much greater risk.

Re: The Coder Who Encrypted Your Texts

#152

Post by AdmiralAsshat »

JupiterMoon wrote: post #61
nly wrote: post #55

Didn't TextSecure stop encrypting SMS a while back? If you lose data connectivity you're sending in the clear, right?

Yes. This is really annoying it was one of the major selling points - I'd got several people to install it on this basis. They had a reason for the change but I was un-impressed The best thing that one can say is that it is well indicated by the UI whether the message will be secure. Blue for encrypted. Green for clear. I've managed to explain this to some very tech unsavy people.

Is that a setting? I use TextSecure, and when my data cuts out, it simply fails to send the message and tells me. Every message I've ever sent (that I can quickly see) has the padlock icon next to it, which I'm assuming guarantees it was encrypted.

Re: The Coder Who Encrypted Your Texts

#153

Post by jackgavigan »

sergiotapia wrote: post #39

>Unfortunately, if Mr. Marlinspike’s encryption scheme can be applied to imagery, then childporn collectors thank him too. And there we go, highest voted comment on the article: a strawman about child pornography. Think of the keeeds

FFS. Any encryption scheme can be applied to imagery. AES is approved by the NSA. Does that mean childporn collectors are thanking the NSA too?

Re: The Coder Who Encrypted Your Texts

#154

Post by JupiterMoon »

AdmiralAsshat wrote: post #152
JupiterMoon wrote: post #61

Earlier quoted context omitted.

Yes. This is really annoying it was one of the major selling points - I'd got several people to install it on this basis. They had a reason for the change but I was un-impressed The best thing that one can say is that it is well indicated by the UI whether the message will be secure. Blue for encrypted. Green for clear. I've managed to explain this to some very tech unsavy people.

Is that a setting? I use TextSecure, and when my data cuts out, it simply fails to send the message and tells me. Every message I've ever sent (that I can quickly see) has the padlock icon next to it, which I'm assuming guarantees it was encrypted.

yes

Re: The Coder Who Encrypted Your Texts

#156

Post by snikeris »

wtbob wrote: post #137
hlru wrote: post #80

Earlier quoted context omitted.

I used to be a "fan" of TextSecure, but have become disillusioned lately. The development have always been slow. Very few people use it, even among my geek friends. Convincing people to use it is hard as well. Confusion over what it does, having to give out their phone number and no desktop client doesn't help. When I'm actually in need of encryption it doesn't even work, since Google Play services are blocked in Chi…

This. I used to recommend TextSecure to all my friends, but it didn't interact well with other services, and then IIRC it stopped working with SMSes entirely.

TextSecure handles SMSes well. It doesn't support encrypted SMS anymore, but that's not a big deal.

I've been using TextSecure for awhile now even though I only communicate w/ one other person that uses it.

Re: The Coder Who Encrypted Your Texts

#157

Post by JupiterMoon »

nitrogen wrote: post #86
JupiterMoon wrote: post #82

Earlier quoted context omitted.

Many countries have laws against reverse engineering programs. Whilst I think these laws are stupid I would prefer to just use the open source program than mess around with the closed source alternative.

According to Wikipedia[0], reverse engineering is generally legal in the US: In the United States even if an artifact or process is protected by trade secrets, reverse-engineering the artifact or process is often lawful as long as it has been legitimately obtained. [0] https://en.wikipedia.org/wiki/Reverse_engineering#United_Sta...

Actually have another look at that before you break the law on this yourself.

As far as I can see that article says that reverse engineering is legal in the case that: (1) the EULA doesn't mention it (I've no idea what Whatsapp EULA says - do you?). (2) it is done for the purpose of interoperability. What is being proposed by the GP is in fact not interoperability but security testing.

As I said before I think that the laws on this are stupid. But why worry about this when there is a great FOSS program in the same space?

Re: The Coder Who Encrypted Your Texts

#158

Post by nathan_long »

Interesting quotes:

> President Barack Obama called [protected-messaging apps] “a problem.”

but

> Encrypted messaging was viewed [by the U.S. State Department] as a way for dissidents to get around repressive regimes. With help from Mr. Schuler, Radio Free Asia’s Open Technology Fund, which is funded by the government and has a relationship with the State Department, granted Mr. Marlinspike more than $1.3 million between 2013 and 2014, according to the fund’s website.

Re: The Coder Who Encrypted Your Texts

#159

Post by sj4nz »

jnbiche wrote: post #133
akkartik wrote: post #51

Earlier quoted context omitted.

Thank you for http://www.youtube.com/watch?v=unZZCykRa5w . Your notion of 'bundling' was one of my top three most mulled ideas in the past five years. Once I started looking, I see it everywhere.

For those of us who don't do YouTube, is there anywhere else we can read about Moxie's "bundling"?

Watched it last night. The very short summary is "bundling" is a kind of inside out Trojan Horse, the example Moxie used was "Google Analytics" which has some functionality that is undesirable to some users, enough so that it was blocked by some privacy extensions. Over time, Google started adding "useful" features to the GA code for websites, arguably because "you're already loading GA, why not get some utilities for your web site?" Well... this means that if you (the web dev) use the GA "utilities" on your web site, privacy extensions will break the website or have to allow GA to load. Some of those privacy extensions started to whitelist GA because of this.

Now the undesirable effects have come back and users now have to make a harder choice between a broken website or being another datapoint for someone's analytics.

The talk is not just about this, but more so about the way the world changed from attempted mandatory "controls" upon people to allowing them the "choice." The scope of "bundling" (features added to encourage use) gets larger and larger until you realize that you're living in a corporate panopticon along with everyone else. If you're not paying for it---you're the product---and bundling becomes the method used to keep you providing them with the best product.

Re: The Coder Who Encrypted Your Texts

#160

Post by pakled_engineer »

Joeboy wrote: post #120
glogla wrote: post #113

I still can't get over Moxie wanting Google and Apple and Microsoft to be gatekeepers of what you can and can't do with your device and calling sideloading "that old broken desktop security model". I admire your work Moxie, but sadly we stand on different sides of war on general purpose computing. I can't help but be saddened that "the other side" got someone so talented and dedicated.

I don't know about Apple or MS, but building TextSecure from source and installing it on an android phone is about as easy as you could reasonably expect it to be. It seems churlish to complain that there are also easier ways to install it. Edit: although, of course you have to trust Github or whoever if you install from source.

Also have to trust Google closed binary framework app isn't spying, or can't be remotely exploited to start spying, as it's a hard dependency for Textsecure/Redphone
Post reply on HN