Security for the people
google-opensource.blogspot.com
Security for the people
1–10 of 58 posts
Re: Security for the people
#2And don't forget the end-to-end project[1], which is the javascript crypto library by google.
The significance of these types of project extend beyond browser privacy. As crypto-currency become more prominent, we NEED better, carefully auditted javascript crypto-libraries.
Right now, all the crypto-code are home baked. e.g.: https://github.com/bitcoinjs/bitcoinjs-lib/blob/master/src/e...
While, I think they are all doing a fine job. It is not settling to think that these mission critical, crypto-code is not vetted by cryptographers.
In fact, a few months ago, there was a bug where the nonce for each signature was not set properly that basically meant you were able to work out the private key for 2 different signatures. Some users lost funds due to the bug.
These open initiatives will lay an important foundation.
Re: Security for the people
#3"We’re excited for a future where people won’t have to choose between ease and security, and where tools that allow people to secure their communications, content, and online activity are as easy as choosing to use them."
That future is now according to Apple.
In any case the real issue is protecting people from Google itself.
Re: Security for the people
#4https://simplysecure.org/ is the project that Google is supporting, which seems to be an open consultancy that works with OSS crypto/security/privacy projects to make them easier to use.
Re: Security for the people
#5And don't forget the end-to-end project[1], which is the javascript crypto library by google. The significance of these types of project extend beyond browser privacy. As crypto-currency become more prominent, we NEED better, carefully auditted javascript crypto-libraries. Right now, all the crypto-code are home baked. e.g.: https://github.com/bitcoinjs/bitcoinjs-lib/blob/master/src/e... While, I think they are all d…
I don't think that JS or any other interpreted/JIT-compiled crypto code will ever be vetted by cryptographers. Simply the fact that you can't control the memory, CPU cache and instruction scheduling means that your code is vulnerable to at least side-channel exploits.
Re: Security for the people
#6And don't forget the end-to-end project[1], which is the javascript crypto library by google. The significance of these types of project extend beyond browser privacy. As crypto-currency become more prominent, we NEED better, carefully auditted javascript crypto-libraries. Right now, all the crypto-code are home baked. e.g.: https://github.com/bitcoinjs/bitcoinjs-lib/blob/master/src/e... While, I think they are all d…
Holy crap, people are actually using javascript crypto for bitcoin‽
Re: Security for the people
#7"We’re excited for a future where people won’t have to choose between ease and security, and where tools that allow people to secure their communications, content, and online activity are as easy as choosing to use them." That future is now according to Apple. In any case the real issue is protecting people from Google itself.
Apple's devotion to privacy ends at phone unlock; the easiest attack vector to social engineer or forensically determine. Today's announcement is not much more than a PR stunt to cover their ass and distract from their own repeated failings to secure their platform or networks.
Re: Security for the people
#8Hey google, you can start by phasing out RC4 on YT.
Re: Security for the people
#9And don't forget the end-to-end project[1], which is the javascript crypto library by google. The significance of these types of project extend beyond browser privacy. As crypto-currency become more prominent, we NEED better, carefully auditted javascript crypto-libraries. Right now, all the crypto-code are home baked. e.g.: https://github.com/bitcoinjs/bitcoinjs-lib/blob/master/src/e... While, I think they are all d…
I don't think that JS or any other interpreted/JIT-compiled crypto code will ever be vetted by cryptographers. Simply the fact that you can't control the memory, CPU cache and instruction scheduling means that your code is vulnerable to at least side-channel exploits.
The Stanford Javascript Crypto Library was written / overseen by Dan Boneh who is a serious cryptographer by any definition.
Re: Security for the people
#10The toolbox logo for simply secure is killing me. Whomever made the logo has never used any hand tools. The saw is part hacksaw part panel saw.