Subrosa – An encrypted communication platform

Re:Subrosa – An encrypted communication platform by ctz on Monday June 16, 2014 @03:19PM (#7900929)

"Nobody, not even us, can read or listen into your conversations."

This cannot possibly be true, given they are the root of trust for establishing the recipient's authentic public key.

Also, minified javascript really does not count as a source code release.

[ Parent | on HN ]

Re:Subrosa – An encrypted communication platform by jtheory on Monday June 16, 2014 @05:04PM (#7901474)

Quite right. If they were compelled -- e.g., "insert this backdoor or we'll imprison you" -- they might trivially serve up a tweaked version of their JavaScript to the one user the NSA was interested in.

And it wouldn't take a complicated tweak at all to sneak the real password (or some sufficient version of it) back to the server, after which point certainly "even us" can read & listen in to all of that user's conversations.

[ Parent | on HN ]

Re:Subrosa – An encrypted communication platform by danielweber on Tuesday June 17, 2014 @08:16AM (#7903909)

(Comment moved to today's topic.)

[ Parent | on HN ]