Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Security for the people

google-opensource.blogspot.com

Post reply on HN
Print view View original

21–30 of 58 posts

Re: Security for the people

#21

Post by hack_edu »

gress wrote: post #13
hack_edu wrote: post #7

Earlier quoted context omitted.

Apple's devotion to privacy ends at phone unlock; the easiest attack vector to social engineer or forensically determine. Today's announcement is not much more than a PR stunt to cover their ass and distract from their own repeated failings to secure their platform or networks.

"Apple's devotion to privacy ends at phone unlock." If you had read either the privacy policy or security architecture, you would know that you have made a false statement here. I think it's you who is trying to distract us from the fact that Google itself uses your private data for its own business purposes, and has a vested interest in not protecting you from itself.

I find it adorable how people buy into the rhetoric and trust that Apple doesn't leverage and track your data. They are a hardware and content company, and they absolutely leverage all the data they can in order to better market you the content they think you might want. Its not just business, its personal. Even with the lions' share of their money coming from hardware sales, so what? Without deep, targeted tracking and mining of user data for market research their entire mobile platform would implode along with the business models of their content partners and app makers.

Meanwhile, I show nor imply any support for Google on the subject. They are no better, perhaps worse.

Re: Security for the people

#22

Post by hahainternet »

dfc wrote: post #10

The toolbox logo for simply secure is killing me. Whomever made the logo has never used any hand tools. The saw is part hacksaw part panel saw.

It's a back saw. Sure it has a weird handle and low tpi, but every woodworker knows what a back saw is.

Re: Security for the people

#25

Post by bradleyjg »

tomp wrote: post #15
bradleyjg wrote: post #9

Earlier quoted context omitted.

The Stanford Javascript Crypto Library was written / overseen by Dan Boneh who is a serious cryptographer by any definition. http://bitwiseshiftleft.github.io/sjcl/

> We believe that SJCL provides the best security which is practically available in Javascript. (Unforunately, this is not as great as in desktop applications because it is not feasible to completely protect against code injection, malicious servers and side-channel attacks.)

And? It's vetted by a cryptographer who noted the caveats that apply. Do you take 'vetted' to mean 'unreservedly recommend'?

Re: Security for the people

#26

Post by [deleted] »

sauere wrote: post #11

I see the motivation behind it and appreciate the cause, however it is not just about the tools. Yes we need better tools but that alone wont help. 1-Click solutions often promise a lot but only end up giving a false sense of security. I belive that a certain amount of understanding of the underlying, general technology will always be required - both for users and developers. Encrypting your e-mail does not help you…

[deleted]

Re: Security for the people

#27

Post by nikcub »

richardwhiuk wrote: post #14
stevekl wrote: post #2

And don't forget the end-to-end project[1], which is the javascript crypto library by google. The significance of these types of project extend beyond browser privacy. As crypto-currency become more prominent, we NEED better, carefully auditted javascript crypto-libraries. Right now, all the crypto-code are home baked. e.g.: https://github.com/bitcoinjs/bitcoinjs-lib/blob/master/src/e... While, I think they are all d…

Obligatory link to "Javascript Cryptography considered harmful" which neatly summarizes the pitfalls here: http://matasano.com/articles/javascript-cryptography/

Browser extensions are cryptographically signed and verified, while web application javascript is not.

The problem isn't with javascript, it is with delivering javascript in a web-based application (amongst other concerns).

Most of the other concerns about web delivered javascript also don't apply to extension security. Example: a web application can't interfere with the execution of extension code since extensions reside within their own context and cross-origin rules apply (there are special API's accessibly only from the extension to call into the web javascript).

End-to-end from Google is a browser extension, and it is signed by the developers and then verified on install. It is more secure than a traditional desktop software installation.

Re: Security for the people

#28

Post by laydros »

This sounds smart. And I'm pretty pragmatic. I don't think Google and Apple and Microsoft are really trying to ruin my privacy.

But something about this makes me uncomfortable. The fact that when this appeared on the front page of HN it was with posts from Google and Dropbox about how they support this.

Google that Assange is releasing a book about, and Dropbox that went a day where it didn't matter what password you entered and has former Secretary Rice on their board.

I have a feeling this organization might help keep things like the recent celebrity iCloud break happening, but as someone else said, real security is not easy. And false security is worse than no security.

Re: Security for the people

#30

Post by peterwwillis »

A PR announcement of an initiative to form a coalition to investigate making it easier to use security tools that most people don't care about. How thoughtful of you, Google. This wouldn't be an attempt at improving the public's negative view of you with regard to privacy issues, now would it?

Funny how Google doesn't offer a messaging service that's secured to a physical device the way Apple does, and these projects when combined would result in something like that.

Post reply on HN