Re:A Formal Security Analysis of the Signal Messaging Protocol
by Strom on Tuesday November 08, 2016 @10:57AM
(#12901222)
Do you personally review every bit of code that runs on your device? No? Then you're trusting someone else who claims it's secure. No different than trusting Apple/Google.
[ Parent
| on HN ]
Re:A Formal Security Analysis of the Signal Messaging Protocol
by lrk_sirius on Tuesday November 08, 2016 @11:50PM
(#12906127)
> No different than trusting Apple/Google.
It is different. I expect Apple and Google to insert backdoors deliberately into their operating systems for three letter agencies (it's easy to do it when you've got either a proprietary OS like iOS or a "technically open but practically closed" OS like Android). They've probably done it before and are part of the PRISM program either way.
However, I don't expect the FSF or Linus Torvalds to do it. They haven't done it yet and they probably won't do it.
Re:A Formal Security Analysis of the Signal Messaging Protocol
by Strom on Wednesday November 09, 2016 @03:42AM
(#12907963)
It's subjective opinion to trust Linus/FSF more. On top of that Linus doesn't review every piece of code that you run. Some random people vet plenty of code that the distro contains. In addition, I would say it's easier for the NSA to make subtle changes to open source software to sneak in heartbleed-style vulnerabilities under the guise of new unrelated features/bugfixes.