431–437 of 437 posts
Color me still-unconvinced. This retort does not address the fundamental point made in the Guardian piece: > “[Some] might say that this vulnerability could only be abused to snoop on ‘single’ targeted messages, not entire conversations. This is not true if you consider that the WhatsApp server can just forward messages without sending the ‘message was received by recipient’ notification (or the double tick), which u…
Earlier quoted context omitted.
Your argument is the same one as "nuclear submarines are impossible to build because I just thought about it for five minutes and can't build one". But Electric Boat Corporation from Groton, Connecticut delivers them regularly, on time and under budget (!). Googling around will tell you that these things exist and people do build them.
No, that's not at all my argument. I didn't ask me to show me a completed nuclear submarine. I asked you to show me a Whatsapp reverse engineer.
Consider all the people who study closed source browsers (MSIE) and plugins (Flash) to write malware. Consider all the people who reverse engineer malware to write protections or ransomware decryptors.
The people who can do such work don't work exclusively for the NSA and Google, and you can probably hire them for $1000 a day. but none of them will do tricks for you for free just to prove that they exist. They're too busy making money.
I saw some of the work described in this [1] excellent paper on reverse engineering NSA's crypto backdoor in Juniper equipment being done live on twitter. People exchanging small pieces of code, piecing together all the changes that were made in order to allow passively decrypting VPN traffic.
Earlier quoted context omitted.
This shit is really easy to armchair quarterback over the Internet where nobody wins and the points don't matter, but the reality is that figuring out how to design crypto applications in a way that keeps users secure without users disabling or ignoring sometimes-important security problems is a very hard problem . In fact, it may very well be the current hardest practical problem in information security. So yeah, it…
And we're not moxie's investor meeting or senate hearing comittee. This is a layman discussion thread that he decided to join and answer questions in. (Big respect to him for doing that) So I believe even "stupid" questions should be allowed if they increase understanding or bring up new points. Furthermore, this is an argument via authority[1]. Of course there are experts, but even an expert should explain and discu…
And Moxie has explained his rationale in this thread. Argument to authority isn't always wrong — particularly in the case where the other side has no data or theory to back up their claims. For instance, I personally only know little about the actual mechanisms behind anthropogenic climate change. What I do supports the notion. But I'd be lying if I didn't acknowledge that the most compelling argument is the absolute agreement by 99.9%+ of the actual experts in the matter.
Likewise, in the absence of any obviously compelling evidence validating GP's approach, combined with Moxie's explanation above and my own experience as a security engineer, I'm going to go with the guy with literally decades of both theoretical an operational experience here.
Earlier quoted context omitted.
Name calling results in reassigning fear. People are afraid of the unknown and so try to box it up in something digestible they can fear less. We tend to blame others because it's easy and cheap to do so. If you are wrong, that means I'm right and so then I wasn't wrong about it and don't have to think about it anymore. And you are wrong, so why would I think about it again? I think it's interesting the entities are…
> We know Musk I know this isn't your point, but we don't know Musk; we know his (intentionally, carefully curated) public image
Earlier quoted context omitted.
Source code can be verified. Binaries distributed via app stores may or may not have behavior different from the published code.
> Source code can be verified But how often is that really done? And to be honest, it can be quite hard to spot critical bugs or backdoors, just look at http://www.underhanded-c.org/
The bitcoin development community solved the problem of mapping source code to a binary build. Check sums or signatures of binaries is not sufficient. Open source is meaningless if you cannot verify the source maps to the build and you're running critical software with irreversible consequences. E.g. a bitcoin transaction or a dissident being imprisoned from state surveillance eaves dropping on communications.
Earlier quoted context omitted.
> less well-known programs that are much harder to reverse have been productively > It's just not capital-H Hard to do it in closed-source software, so this open vs. closed debate about backdoors is usually a red herring. No, you are oversimplifying the problem a lot. In an Open Source project it is possible to create transparency in the development process by every commit public and allowing 3rd parties to mirror th…
Nope. Professional security people have been using binary diffing tools to solve this problem since the early 2000s.
Nope to what? Are you saying that binary diffing is possible or that the amount of effort required is (remotely) comparable with analyzing source code?
I would like to see evidence supporting the latter statement, if this is what you are saying.