Skiff – Privacy-first end-to-end encrypted email

Re:Skiff – Privacy-first end-to-end encrypted email by tptacek on Wednesday August 23, 2023 @04:31PM (#37241562)

You haven't published the reports, scope, and full findings. We don't even know what Trail was testing. I don't think the security audit stuff matters at all, and Trail is a fine firm, but you can't use the mere existence of a pentest project this way.

[ Parent | on HN ]

Re:Skiff – Privacy-first end-to-end encrypted email by amilich on Wednesday August 23, 2023 @07:21PM (#37243223)

Any security engineer would have a heart attack if any employee, friend, or colleague said "security audit stuff [doesn't] matter." I wouldn't use software that doesn't undergo security audits.

Also, pentest ≠ audit. Completely different!

[ Parent | on HN ]

Re:Skiff – Privacy-first end-to-end encrypted email by tptacek on Thursday August 24, 2023 @01:42AM (#37245420)

I am a security engineer. You can go reach out to whoever managed your assessment at Trail and ask them about me by name if you like. What you're saying doesn't make sense. Maybe you could make it make sense! But you'd need to start by disclosing what the actual project scopes for each of these projects was.

[ Parent | on HN ]