Re:A Formal Security Analysis of the Signal Messaging Protocol
by tptacek on Tuesday November 08, 2016 @11:36AM
(#12901610)
No, I'm not going to let you pretend that we are on opposite sides of a "centralize" versus "decentralize" argument. Find someone else to take the "Google should control the web" side, and debate with them. What you're saying here has nothing to do with what I'm saying.
[ Parent
| on HN ]
Re:A Formal Security Analysis of the Signal Messaging Protocol
by xorcist on Tuesday November 08, 2016 @04:28PM
(#12904098)
You replied to a fictitious argument. What I said is that security is not that simple, it matters on your threat model, and things like resilience and platform diversity matter too. Crypto is not the weak link for Signal (nor is it likely to be for comparable products).
What claudius said was that in essence was that a trusted application should not depend on giving remote root to Google, likely referring to not be able to compile and distribute the software in a useful way. That is worth a more meaningful answer. Distribution and the run time environment are central to any realistic threat model and reducing that to open source zealotry kind of misses the point.