Re:Viber adds end-to-end encryption
by tremon on Tuesday April 19, 2016 @08:33AM
(#11526460)
Even if I were to accept your logic, what's ridiculous about that?
[ Parent
| on HN ]
Open sourcing the crypto code wouldn't be ridiculous, but pointless.
What I find ridiculous though was
>venders that don't agree to an audit should be considered insecure
The same thing applies to every single part of the application, but not equally. No attacker is going to start out by trying to break the crypto, unless it's obviously broken. "Normal" bugs are far more common and often more dangerous (Thing RCE, or in the case of many modern apps: XSS)
Re:Viber adds end-to-end encryption
by CiPHPerCoder on Tuesday April 19, 2016 @10:47AM
(#11527335)
> No attacker is going to start out by trying to break the crypto, unless it's obviously broken.
Emphasis mine. I agree with ryanlol here. Why bother with active attacks when you can just steal their private key from a code execution?
Similar to this, but with the priority flipped:
https://www.bishopfox.com/blog/2016/04/if-you-cant-break-cry...