Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask a hacker: Top four anti-surveillance apps

zdnet.com

Post reply on HN
Print view View original

31–40 of 45 posts

Re: Ask a hacker: Top four anti-surveillance apps

#31

Post by Spearchucker »

drcube wrote: post #30
Spearchucker wrote: post #15

Earlier quoted context omitted.

This suggestion comes up a lot, and yet isn't practical. I can read and write code, like many, but haven't the time or inclination (and arguably skill) to "verify it is secure". I can however watch what an app sends over the wire, which applies as much to proprietary as it does to open source software. How do you go about verifying an arbitrary app is secure?

You can trust that there are a lot more developer eyes on open source software than proprietary software. You personally may not be able to verify every piece of software you have, but if you run free/open software, you know it's theoretically possible to discover vulnerabilities, and that you'll find out eventually if those security holes are found. In the worst case, you can hire a security professional to personal…

I realise that I'm risking being contrary, but my question is serious.

How would I know that an app has had lots of developer eyes on it or not? It's crazy difficult to uncover the latest known security posture of open source software.

Finding out eventually is the exact same risk I take when I use proprietary software. It requires my trust. And it's theoretically just as possible to discover vulnerabilities in closed-source software (Windows, for example).

Re: Ask a hacker: Top four anti-surveillance apps

#32

Post by superuser2 »

a3_nm wrote: post #2

Sadly, TextSecure and RedPhone are distributed on the Google Play platform, so, if you don't want to tie a Google account to your phone or use Android without the proprietary Google applications, you're out of luck. (They are not included in the free and open source f-droid repository due to disagreements with the author.)

If they have an IMEI, camera, microphone, GPS, all the contents of your text messages, all your phone calls, all your mobile web browsing (this is the purpose of a cell carrier, no?) do you think it really matters if they have your Google account?

Re: Ask a hacker: Top four anti-surveillance apps

#33

Post by AJ007 »

Read these "Bugs, Caveats, Side Notes" published on the Onion Browser app's web site:

Major iOS SDK Limitation: Websites using HTML5 tags will leak -related DNS queries and data transfer outside of Tor. This includes YouTube, Vimeo, and any website using iOS-compatible HTML5 video. This is a behavior of the embedded QuickTime player and there is currently no known workaround. (h/t to josyw.)

iOS SDK Limitation: Javascript cannot be disabled in the `UIWebView`, so script-based detection may identify your device even if User-Agent Spoofing is enabled. iOS SDK Limitation: Related to above, the HTML5 Geolocation API cannot be disabled. The browser will ask you for permission to access your location if a website asks for it via the HTML5 Geolocation API. If you allow this, then said website will (obviously) know your actual current location.

That doesn't sound remotely safe to me.

Re: Ask a hacker: Top four anti-surveillance apps

#34

Post by moxie »

a3_nm wrote: post #2

Sadly, TextSecure and RedPhone are distributed on the Google Play platform, so, if you don't want to tie a Google account to your phone or use Android without the proprietary Google applications, you're out of luck. (They are not included in the free and open source f-droid repository due to disagreements with the author.)

We don't distribute our apps on f-droid because we feel it's insecure, and because it doesn't provide the features we need to develop stable and secure software.

However, we are willing to distribute our apps outside of the Play Store, but we need the following things first:

* A built in crash reporting solution with a web interface that allows us to visualize crashes and sort by app version, device type, etc. This is essential for producing stable software.

* A built in statistics gathering solution with a web interface that allows us to visualize aggregate numbers on device type, android version, and carriers for our users. This has been crucial in shaping support and development direction.

* A built in auto-update solution. Fully automatic upgrades won't be possible outside of Play Store, but we at least need something that will annoy the hell out of users until they upgrade. This is necessary for ensuring that new security features and bug fixes can be propagated quickly.

* A build system that allows us to easily turn these features on and off for Play and non-Play builds. Gradle should make this easier.

If you're interested in seeing Open Whisper Systems apps distributed outside of the Play Store, we'd welcome your contributions.

Re: Ask a hacker: Top four anti-surveillance apps

#35

Post by gasull »

For the desktop:

- Tor

- Bitmessage

Bitmessage is specially interesting because it's not only encrypted and private, it actually solves the problem of spam and offers 3 kinds of messaging under the same interface: email-like, broadcast messages ala Twitter and chan boards.

Re: Ask a hacker: Top four anti-surveillance apps

#37

Post by pseut »

IlPeach wrote: post #12
jiggy2011 wrote: post #9

No iOS suggestions?

have apple ever approved any app like that? just asking...

ChatSecure and IM+ both support OTR instant-messaging on the iphone, so depending on what you mean by "like that"... yes. ChatSecure is opensource too fwiw: https://github.com/chrisballinger/Off-the-Record-iOS

Re: Ask a hacker: Top four anti-surveillance apps

#38

Post by aroch »

moxie wrote: post #34
a3_nm wrote: post #2

Sadly, TextSecure and RedPhone are distributed on the Google Play platform, so, if you don't want to tie a Google account to your phone or use Android without the proprietary Google applications, you're out of luck. (They are not included in the free and open source f-droid repository due to disagreements with the author.)

We don't distribute our apps on f-droid because we feel it's insecure, and because it doesn't provide the features we need to develop stable and secure software. However, we are willing to distribute our apps outside of the Play Store, but we need the following things first: * A built in crash reporting solution with a web interface that allows us to visualize crashes and sort by app version, device type, etc. This i…

Any plans on bringing WhisperCore back for the new Nexus family? I'm somewhat sad that it appears Twitter bought you out to stop making it

Re: Ask a hacker: Top four anti-surveillance apps

#39

Post by mahyarm »

pseut wrote: post #37
IlPeach wrote: post #12

Earlier quoted context omitted.

have apple ever approved any app like that? just asking...

ChatSecure and IM+ both support OTR instant-messaging on the iphone, so depending on what you mean by "like that"... yes. ChatSecure is opensource too fwiw: https://github.com/chrisballinger/Off-the-Record-iOS

ChatSecure crashes so much it's unusable. IM+ OTR costs $6 and is closed source.

Re: Ask a hacker: Top four anti-surveillance apps

#40

Post by mahyarm »

moxie wrote: post #23
jiggy2011 wrote: post #9

No iOS suggestions?

iOS versions of RedPhone and TextSecure are currently in development.

TextSecure-iOS on github was last committed to in March 2013, has work been done elsewhere?

https://github.com/WhisperSystems/TextSecure-iOS/commits/mas...

Post reply on HN