News for hackers. Stuff that matters.

A comment on Subrosa – An encrypted communication platform. Parent comment

Re:Subrosa – An encrypted communication platform by Scaevolus on Monday June 16, 2014 @04:41PM (#7901376)
Scarily true. The amount of damage malicious actors with keys can do is greatly magnified by the auto-update mechanisms that developers love.
[ Parent | on HN ]
Re:Subrosa – An encrypted communication platform by api on Tuesday June 17, 2014 @09:03AM (#7904126)
I have an app with auto-update, and one day I realized that I had (more or less) root on hundreds of users' machines. I'm not special in this regard.

I take fairly strong precautions with my keys: offline storage, encrypted, signing on an air-gapped machine. I'd bet you money that most people aren't so careful. There are probably a lot of secret signing keys sitting in DropBox.

[ Parent | on HN ]