News for hackers. Stuff that matters.
Re:CryptoCat iOS Application Penetration Test [pdf] by daira on Thursday April 03, 2014 @12:29AM (#7520960)
Actually I strongly suggest reading these in conjunction with iSec's issues 12 through 16, because each team spotted some details that the other missed.
Re:CryptoCat iOS Application Penetration Test [pdf] by tptacek on Thursday April 03, 2014 @07:48AM (#7522166)
Are you sure that's not because the different teams had different scopes? The iSEC audit was specifically tied to the iOS application.
Re:CryptoCat iOS Application Penetration Test [pdf] by daira on Friday April 04, 2014 @05:36PM (#7534551)
The scopes had a great deal of overlap; although we (Least Authority) didn't consider the iOS client at all, the rest of iSec's audit has essentially the same scope as ours. The point I was trying to highlight is how easy it is to miss things, and therefore that having independent concurrent audits is actually a really good idea. It would probably be even better if the teams worked mostly independently but were able to exchange draft versions of their reports (before the mitigations necessary for a public release).