Re:CryptoCat iOS Application Penetration Test [pdf]
by kaeporan on Wednesday April 02, 2014 @05:32PM
(#7519204)
Thanks for linking to the blog post. This audit concerns a pre-release version of Cryptocat for iPhone. Many of the bugs were due to debugging code and were fixed before release.
[ Parent
| on HN ]
Re:CryptoCat iOS Application Penetration Test [pdf]
by tptacek on Wednesday April 02, 2014 @07:13PM
(#7519721)
Which of the bugs were due to debugging code?
Re:CryptoCat iOS Application Penetration Test [pdf]
by daira on Thursday April 03, 2014 @12:16AM
(#7520913)
Findings iSEC-RFACC0114-1 and iSEC-RFACC0114-3. (2 out of the 17 vulnerabilities found by iSec, of varying severity.)
Re:CryptoCat iOS Application Penetration Test [pdf]
by sneak on Wednesday April 02, 2014 @09:07PM
(#7520204)
Why use donated money to pay for an audit of software that has known bugs and isn't ready yet? That's wasteful. The point of an audit is to find bugs you don't already know about.
Re:CryptoCat iOS Application Penetration Test [pdf]
by ibmthrowaway218 on Thursday April 03, 2014 @04:53AM
(#7521657)
It can be a useful technique for testing the quality of the audit.
At a previous company we had to have words with a company that performed a software audit as they failed to find two issues we'd planted to test them. (Of course, they did find several things we didn't know about.)