Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask a hacker: Top four anti-surveillance apps

zdnet.com

Post reply on HN
Print view View original

41–45 of 45 posts

Re: Ask a hacker: Top four anti-surveillance apps

#41

Post by jhh »

tripzilch wrote: post #27
jhh wrote: post #22

Earlier quoted context omitted.

A secure text messaging app I like and use is Threema ( http://threema.ch/en/index.html ). All servers are allegedly located in switzerland. The app uses public-private-key end-to-end encryption. You can exchange keys locally via QR code and it is available for both Android and iOS. You can still sync your phonebook in whatsapp style. It's a good compromise between being secure and being pragmatic to me. However, it'…

> it's not open source, so you still have to trust the app (and the OS) not to send out your private key. Or that it actually implements encryption correctly . Closed source is really not an option. Let's get it right this time.

They kind of have a solution for that http://threema.ch/validation

Re: Ask a hacker: Top four anti-surveillance apps

#42

Post by JshWright »

howeyc wrote: post #16
buro9 wrote: post #5

https://silentcircle.com should have a mention too.

Claims that keys are stored locally and not sent to their network. Applications not open source, no way for anybody anywhere to verify such claims. These are for paranoids, paranoids may not be able to read the source code and verify such things, but the fact the at least someone can certainly helps.

https://github.com/SilentCircle

Re: Ask a hacker: Top four anti-surveillance apps

#43

Post by JshWright »

kmfrk wrote: post #18
jiggy2011 wrote: post #9

No iOS suggestions?

Wickr, Onion Browser, Cloak. https://www.mywickr.com https://mike.tig.as/onionbrowser https://www.getcloak.com Silent Circle as well, closed source or not, given that one of the founders is Phil Zimmerman.

https://github.com/SilentCircle

Re: Ask a hacker: Top four anti-surveillance apps

#44

Post by dm2 »

drcube wrote: post #30
Spearchucker wrote: post #15

Earlier quoted context omitted.

This suggestion comes up a lot, and yet isn't practical. I can read and write code, like many, but haven't the time or inclination (and arguably skill) to "verify it is secure". I can however watch what an app sends over the wire, which applies as much to proprietary as it does to open source software. How do you go about verifying an arbitrary app is secure?

You can trust that there are a lot more developer eyes on open source software than proprietary software. You personally may not be able to verify every piece of software you have, but if you run free/open software, you know it's theoretically possible to discover vulnerabilities, and that you'll find out eventually if those security holes are found. In the worst case, you can hire a security professional to personal…

You really trust a custom compiled version of Android from "1337haxor2" which has auto-update capabilities built in?

The easier way would be to monitor network traffic. If random encrypted information is uploaded, then block it, whether or not you have an "open source" rom.

Better yet, just get a Nexus device without the carrier apps pre-installed. Stock Android does not have a "upload all data to the NSA" feature built in, it would be easily discovered and would be the biggest news story of the decade.

Unless you are the NSA, then I wouldn't advise using a custom version of Android, you'd likely be much less secure than with a stock (and up to date) version.

Re: Ask a hacker: Top four anti-surveillance apps

#45

Post by ge0rg »

moxie wrote: post #34
a3_nm wrote: post #2

Sadly, TextSecure and RedPhone are distributed on the Google Play platform, so, if you don't want to tie a Google account to your phone or use Android without the proprietary Google applications, you're out of luck. (They are not included in the free and open source f-droid repository due to disagreements with the author.)

We don't distribute our apps on f-droid because we feel it's insecure, and because it doesn't provide the features we need to develop stable and secure software. However, we are willing to distribute our apps outside of the Play Store, but we need the following things first: * A built in crash reporting solution with a web interface that allows us to visualize crashes and sort by app version, device type, etc. This i…

Speaking as a developer who's app is both on Google Play and on f-droid, I somehow share your feeling about f-droid being "insecure"(x), but consider all of the other points very thin.

Crash reports and statistics are great, except if you explicitly want to NOT spy on your users.

Auto-updates are ok, but forced auto-updates take the user's autonomy away, and are only one step short of forced remote uninstalls (which are already documented with Google Play, so far only for malware).

A proper build system is great indeed, but has nothing to do with the distribution medium.

(x) f-droid security: by having f-droid build all the apps from source by default, and signing them with their own keys, two problems appear:

a) you can not switch easily between f-droid builds and maintainer builds

b) you as the user need to trust both the author and f-droid to not be evil, instead of just the author.

Post reply on HN