Your security should never depend upon security of your source code. If you're doing things correctly, then the source code doesn't change anything about the security of the data that is encrypted.
Perhaps you mean that he chose to use 40-bit keys instead of 256-bit keys in the free version? I mean, I guess. But that's just a matter of better understanding the details. It sounds like he outlined this clearly and anyone looking for more security knew to pay for the product to get the 256-bit keys.
For sure. I don't think it's about that, though.
Even if the application in question were open source, if the project lead is willing to cooperate in any way their government asks, they could probable ensure the existence of a back door. For this reason, where possible, I would prefer to use encryption software written by people who are principled to a fault (or who at least do a good job acting as if they were).
Let's imagine Linus Torvalds or Greg Kroah-Hartman in this same situation. Linux source is available, so let's say they were asked to ensure that a certain patch to a cryptographic API was not accepted before a certain window. Maybe the crypto API maintainers were on the call as well saying that they were on board with the plan (apologies to those people, I don't know you and mean no offense). I like to think that they would:
1. Turn down the NSA.
2. Attempt to get the word out about what they had been asked.
3. Find new crypto maintainers.
And yes, it's entirely possible that this is not at all how it would go down. Maybe they would be very cooperative. I don't know any of these people personally. But what I do know is that they have not, as of yet, made a blog post about that time when the NSA did ask them to betray an unspecified user and how they did everything they asked without resistance.
I don't think I'm being idealistic here. Software and encryption are global endeavors. People who blindly believe that the enemies of their state are also their enemies, or even that obedience to local laws is a moral imperative, should not write crypto software. Or at least, I hope they make their beliefs known like this guy did so that I can avoid their software.
One should have zero impact, as I said, modern crypto algorithms do not depend on keeping the algorithm secret to maintain security. Implementation can absolutely be full of bugs that are incorrectly using crypto primitives though.
The other has a direct impact on security.
I don't think one blurs the line to the other, they're fundamentally different things.
If anything, this is further proof that you need to use crypto properly because it literally means someone with code in hands won't have any advantages in attempting to break that encryption.
To me anyway, someone willing to give source code to the NSA doesn't imply they'd be willing to do nefarious things. There's nothing inherently nefarious about giving the NSA source code.
That said, I can understand being skeptical, but people love to talk about how open source is more secure because it has eyeballs on it. But now we try to pull the "it's not secure because the source was given to the NSA"
It can't be both ways.
Providing the source of a closed source project to an adversary so that they can break your software is nefarious.
If the author's justification was...
"My crypto implementation is perfect. There are no bugs in my code, so providing source code (which the user community does not have) to an adversary does not have any effect on any user's security."
...then the author is simply incompetent, not malicious. But I am not inclined to accuse the author of such incompetence.
You might be the only person around here to ever try that argument in public.
Most people who argue that open source is equally or more secure than close source software do not argue that access to source code provides zero benefit to attackers. Instead, they argue that the benefit gained by the many additional sets of eyes belonging to researchers and other "good guys" outweighs the detrimental effect of letting the "bad guys" see as well.
The question in this instance is not whether the closed-source-superior or open-source-superior security camps is correct. The only related question is: "Does access to source code provide any benefit whatsoever to an attacker?"
I don't think I'm the "only person around here" who would argue that yes, it does. And that if you're taking the closed-source route, like this project's author, you can't provide copies of your source code to one specific attacker when they ask. If you do that, you're _definitely_ worse off (from a security perspective) than the people in the open source camp. I'm sure the closed-source-superiority people would agree.
Seems like it would similarly be unethical for a local bakery to give the NSA a discount on cheesecake.
When the NSA asks you to help them do bad things, you say no. If you feel inspired to give them a cheesecake discount because of the good things they do, that is fine.
Likelihood that the authors/owners of software are willing to cooperate, and capable of cooperating, with adversaries is an important metric for comparing options. Very high profile open source maintainers are less capable, due to the oversight of the community. Anarchist- or security-absolutist type personalities are less likely. The author and his project don't fit either bill.
I'm not arguing that this is the only metric that matters when considering one's options. But it does matter.
The legacy being things like the blacklist/whitelist discussion we had the other day about case sensitivity in crypto algorithms. We still look up algorithms by string name (instead of enum or some other mechanism) decades later.
It's probably an #IFDEF or an if (registered) somewhere in the source code.
Nonetheless, I agree with you. The writer appears emotionally swayed and flattered by the request, like a protagonist in a WWII-era young-adult novel ("Your country needs you!"), and is eager to satisfy the ask immediately without the slightest bit of skepticism or diligence. That's not the kind of temperament one would want an encryption software dev to have.
I mean, if the cops turned up at your door with a search warrant, you'd let them in, right?
To me, this is a bit of a no-brainer. A government agency wants my help to do something. Do I trust them? Do I help them? Well... yes. They're the government. Incompetent sometimes, irrelevant a lot of the time, inefficient, sure. But ultimately there to provide a service for me as a citizen. If they need my help, then I should probably help them.
I understand that Americans don't trust their government like this. I'm not sure why not.
https://en.m.wikipedia.org/wiki/PRISM_(surveillance_program)
Those two spring to mind immediately, and I'm not American, I'm Australian.
Personally, I don't understand why anyone trusts their Government more than the bare minimum required to support the rule of law.
If they just wanted to search _my_ stuff, sure. But if the only reason that I'm even capable of assisting the government in spying on somebody is that they are my customer, neighbor, friend, or user then I will not offer that assistance. That would be evil. Don't be evil.
If we give up faith in those things then we will succumb to a lawless, might-makes-right society. What makes you think you know better than the duly elected and appointed representatives of the people? Ok, fine. Tell it to a judge. But if you lose, then comply.
TL;DR: I don’t like “the man” either, but in the end, the man is us. We thwart him at our peril.
No, it often is. I don't think I need to cite examples.
I'm not advocating for anarchy, and I haven't given up faith in the justice system as a whole. However, there are still many things that I will not do, despite being legally compelled. Leveraging my relationships, professional or personal, to help an agency with a dirty track record spy on people is among those things.
Statements like this...
> Tell it to a judge. But if you lose, then comply.
...are extremely problematic. You can argue that most of the time, in a social order that you believe to be a net positive, you should comply rather than rebel. But phrasing it as an absolute perpetuates any existing authority, no matter how corrupt, forever. If you are sufficiently confident that the right thing to do, taking into account all the disruption it may cause, is not to comply, then you are still morally obligated not to comply.
What is right and what is legal do not always agree. And yes, that is still true even in a society that theoretically allows for change "through the proper channels". Even in the US, many of the most important changes to the law have been made by breaking it. Again, I don't feel the need to cite examples, since we have entire days of the year to celebrate most of them.
The great thing about technology is that it doesn't have to put up with things like useless warrants. Using encryption is the equivalent to have a reinforced door protecting you from people who want to do harm to you that ignores all warrants and cannot be broken or talked down. Thank god for encryption that works, it literally saves lives from the current crops of tyrannical governments worldwide.
Of course I'll say yes, and I hope it's true. Thankfully, I probably won't ever have to find out. But if it does come to that, and I choose wrong, I know I won't write a blog post about it.
Check out what the fbi was doing to people a few years back hacking into victim's networks.
The idea that there's an intentional backdoor through security for some institution that may or may not be acting in your best interest is enough for me to not want to use it.
Just about everyone has something to hide, but what they're hiding and the reasons they're hiding it may only be used as leverage against them and have nothing that's a threat to anyone else. My encrypted data has some old tax returns and past medical records--nothing too exciting or compromising, but neither are things I want random people having access to should my copy of the data be compromised.
There are plenty of valid reasons not to want a government agency to be able to pry into every aspect of it's citizens lives. I'd say most people hiding things do it for a lot of social/cultural purposes that aren't too significant at least not in terms of national security.
Take most peoples' browser history--few people want others crawling through searches that might make them feel stupid or insecure for whatever reason. Perhaps they looked at someone's public profile they're interested in dating and don't want to be labeled a 'creep' or perhaps they've been making great use of the free PornHub Premium access lately. People have rights to secure/hide those things and they're no real threat to national security.
You seem to have answered the question, “Why is privacy good?” Your answer, at least to me, seems valid, but if you are answering other questions, I would ask, “Can you imagine situations in which individual liberties are trumped by physical safety of a large number of folks?” How have you reacted to CoVID-19 restrictions? Are those two things really so different?
ftfy