News for hackers. Stuff that matters.
Re:Crowd steps up to fund 'NSA-proof' app by DanBC on Friday July 12, 2013 @04:17AM (#6031521)
> In addition to this, I don't think there's anything wrong with people developing chat or encryption front-ends as long as they use established encryption programs to do their actual encryption. That should be the message that is given to people, not that they shouldn't bother using encryption in their products at all, because they're idiots and will get it wrong. Many will get it wrong, but some won't. I wouldn't trust this particular program (no source for a start), but other new entrants might be trustworthy. I don't think there are enough apps in this space now, the more the merrier, and if some of them are broken, that doesn't make it any harder to evaluate a good one if you are an expert in the field, and it will still make things more difficult for security agencies.

I mostly agree. I'm not so keen on the idea of some broken programs being around. Look at the number of people who install spyware browser toolbars or purple monkeys or etc.

But if people are going to do anything creating front ends for existing software, or creating much better easier documentation for existing software would be good.

> So I think that security is a graded scale, not binary,

This is sort of true. People need to risk assess. If they just want to protect their angsty poetry they don't need to do as much work as they would if they were protecting a stash of images of child sexual abuse.

> That should be the message that is given to people, not that they shouldn't bother using encryption in their products at all, because they're idiots and will get it wrong.

The message isn't "avoid all crypto all the time", but "don't kludge together some crypto project and push it into production".

Re:Crowd steps up to fund 'NSA-proof' app by grey-area on Friday July 12, 2013 @11:10AM (#6032976)
The message isn't "avoid all crypto all the time", but "don't kludge together some crypto project and push it into production".

I think we can all agree on that, however because all the big companies who hire experts and provide cryptography services, like Microsoft, Blackberry, Apple and Google, seem willing to give back doors to intelligence services in many countries and undermine the point of using cryptography, there are not many open choices left. I wouldn't really trust a project like the one linked, and see why people have reservations about it. Which projects would you recommend, as I'm genuinely interested? I use GPG for my own limited use, but would love to see a project for end to end encryption for email for example which also handles plain emails. The trick is in getting other people to use it, and that's all in the interface I think, not the cryptography.

I do think (as a sometime user of cryptography for mundane uses) it's worth having other options, and that will mean quite a few partially broken offerings as it's apparently a very subtle and complex topic and very easy to get wrong - I don't see any way round that if use becomes widespread - even the users will undermine it by mistake by not protecting keys etc. However without widespread adoption and easier interfaces for open cryptography, we won't have any choices but very secure encryption which is pre-signed with an NSA_KEY or otherwise backdoored for the NSA's convenience.