31–40 of 50 posts
I ran this through the SSLlabs SSL Test and it came back with an F. Perhaps an oversight on their end?
A system bragging about security leaving a known, patched hole like this open isn't a great sign.
First impression: - There is no demo, i can only guess that this is a "browser-based skype". I hate when i can't try it but it's free. - Open-source, but no git repo? Btw I had the same idea before (I posted it to an Idea Sunday thread) but I dropped the idea because i realized that no one needs this level of security, NSA is not interested in your chat with family and friends...
"There is no demo" -- just make an account quickly and try it out. I did this and it was easy. "Open-source, but no git repo" -- Open-source does not always entail git or Github. "I dropped the idea because i realized that no one needs this level of security, NSA is not interested in your chat with family and friends..." -- I'm glad you dropped the idea because someone who doesn't understand why privacy is important…
Earlier quoted context omitted.
This is not a "good" article. It's very hand wavey with lots of fud. For example, he talks about the chicken and egg problem of delivering javascript over an insecure connection and then solves it later with SSL/TLS (but he doesn't acknowledge that this is a valid solution). Furthermore, we're all harping on javascript when you can't download PuTTY over an SSL connection. He talks about browser cache but says that ja…
I think that I disagree, but I am not experienced enough to know what I don't know. Judging from your response, you know way more than me, so if it's okay with you, I will tell you why I disagree. Then, it would make my day (and help me a tremendous amount) if you would tell me why I am wrong. a) The chicken and egg problem of delivering javascript: I am far from being good at this stuff, but I am confident that, giv…
This is indeed the point made by Matasano, but I don't think it's valid. Sometimes you want to segment the trust, or maybe your software provider doesn't even want to be in the data storage game. So I might trust one entity to provide me with software to manage my inbox, particularly if I can inspect that software at will, and have seen it pass through a security review, however I might not want to trust them with actually storing the contents of my inbox. In that case, it's nice to be able to encrypt the inbox (and the index, to allow for nice searching) in my browser, and then actually store them on a commodity storage provider (s3 or dropbox). And yes, I'd use modern web standards to give the user control over when a new version was downloaded too.
So, I need to get the software over SSL, and be able to verify within reason that it does what it is supposed to, and then use that trusted software to work with data which I can store on untrusted services.
Earlier quoted context omitted.
But those sigs are also coming over a non-ssl connection:-p Honestly, whenever you download anything, evne over SSL, you're essentially trusting that the remote computer is not only who you think the computer is, but the person you expect to be controlling it is the only person controlling it. Out-of-band communication built out-of in-person trust are really the only way around that (i.e. trusting someone who trusts…
You only need to trust their signature to really be sure. That's why the Web of Trust aspect of PGP/GPG is so important. It's probably more valuable than the ability to encrypt a few emails.
http://noncombatant.org/2014/03/03/downloading-software-safe... http://noncombatant.org/2014/03/05/followup-to-downloading-s...
Earlier quoted context omitted.
I know it can be open source without git, but GitHub gives a lot of benefits. Also as I understood, you don't have Facebook, Twitter, Skype, Googe, Outlook, YouTube, and even HN account because NSA could one day transform everything against you?!
Possible scenario: you are chatting with a friend about how you bought bitcoin at 300 and sold at 500, making 6000USD on the trade. Your money is in an offshore exchange. Next year, you receive a bill from the IRS wanting their cut of the $6000. How did they know? You never pulled out your money. Well, the NSA gave them a tip. Now imagine you're running for public office and your opponents will pay top dollar for dir…
Perhaps, a better scenario is that you are chatting with a fellow entrepreneur about bitcoin, a short while later they are charged by the IRS for tax evasion. Meanwhile, your conversation with them on the subject is discovered through the NSA machinery and is used to kick off an investigation against you.
I wish I had a better example, as that would serve us well to educate folks on the value of privacy. I'm writing in part that someone has a better example to share.
Earlier quoted context omitted.
I think that I disagree, but I am not experienced enough to know what I don't know. Judging from your response, you know way more than me, so if it's okay with you, I will tell you why I disagree. Then, it would make my day (and help me a tremendous amount) if you would tell me why I am wrong. a) The chicken and egg problem of delivering javascript: I am far from being good at this stuff, but I am confident that, giv…
> if you have already gone that far, what would you gain by implementing browser based crypto when you have already solved the problem? This is indeed the point made by Matasano, but I don't think it's valid. Sometimes you want to segment the trust, or maybe your software provider doesn't even want to be in the data storage game. So I might trust one entity to provide me with software to manage my inbox, particularly…
Earlier quoted context omitted.
This is not a "good" article. It's very hand wavey with lots of fud. For example, he talks about the chicken and egg problem of delivering javascript over an insecure connection and then solves it later with SSL/TLS (but he doesn't acknowledge that this is a valid solution). Furthermore, we're all harping on javascript when you can't download PuTTY over an SSL connection. He talks about browser cache but says that ja…
I don't much like this article either, despite being its author, but I don't see how you've managed to refute its applicability to the application being discussed on the thread. The mutual exclusion referenced up thread is real.
This is offered with respect and not a desire to nitpick. I hope it doesn't come across as annoying :)
Earlier quoted context omitted.
subrosa can choose at any time to send you javascript which will send your password back to them. You have no way of checking for this (well, except reading all the javascript, every time you log in)
Except it's a GPL'd web application, so you're free to run your own server.
If you don't run your own server, the site's claim that "nobody, not even us, can read or listen into your conversations" doesn't apply to you.
There's nobody to whom both claims apply at the same time!
Earlier quoted context omitted.
Possible scenario: you are chatting with a friend about how you bought bitcoin at 300 and sold at 500, making 6000USD on the trade. Your money is in an offshore exchange. Next year, you receive a bill from the IRS wanting their cut of the $6000. How did they know? You never pulled out your money. Well, the NSA gave them a tip. Now imagine you're running for public office and your opponents will pay top dollar for dir…
I like your example, but it is also why a lot of folks don't care so much about privacy. Ie. in the scenario there was an illegal hiding of revenue from the IRS. The privacy infringement simply corrected a wrong. So, for many folks they remain unconvinced because they aren't doing anything wrong, so they feel they have nothing to hide, and don't take issue. Perhaps, a better scenario is that you are chatting with a f…
When not citing technology-focused issues, I like to use the bathroom example: "Would you use a public bathroom with glass walls?" It illustrates the difference between covering up wrongdoing and need for personal privacy, two entirely different things.
Earlier quoted context omitted.
Except it's a GPL'd web application, so you're free to run your own server.
Sure, but if you run your own server, then the site's claim that there was "no download or install needed" doesn't apply to you. If you don't run your own server, the site's claim that "nobody, not even us, can read or listen into your conversations" doesn't apply to you. There's nobody to whom both claims apply at the same time!