The Fight Over the EFF's Secure Messaging Scoreboard 63
blottsie writes The Electronic Frontier Foundation (EFF)'s new Secure Messaging Scorecard is designed to answer one important question: Which apps and tools actually keep your messages secure and safe from prying eyes? The results have been mixed. In the midst of many positive reactions from technology companies and users, the scorecard stoked a wave of criticism from several prominent figures in the security industry, who deemed the effort inaccurate, misleading, and vague."
Don't buy American. (Score:2, Insightful)
Re: (Score:3)
That means we can't trust any versions of Windows, OS X, iOS, Android. We also can't trust Firefox, Chrome, Safari, Internet Explorer.
So what's left? No smartphone and Linux with Opera on your computer?
Re: (Score:1)
Don't forget that linus torvalds is held captive in the US and Opera is basically a reskinned Chrome.
Re: (Score:3, Funny)
Linux is American - it is owned by Red Hat.
Re: (Score:1)
Sorry but that is wrong. Linux is a kernel. Red Hat, Ubuntu, etc are distributions wrapped around that kernel.
Re: (Score:2)
Re: (Score:2)
Yes
Re: (Score:2)
People can now think about their computing needs understanding what gov and mil extras they are paying over generations of hardware and software upgrades.
Re: (Score:3)
"How I do my computing"
https://stallman.org/stallman-... [stallman.org] has some ideas on that.
Re: (Score:2)
Re:Don't buy American. (Score:4, Insightful)
Re: (Score:2)
If a person wants a CPU, motherboard and OS at some point they are going to have to buy a product.
So people have the option to go out and test and read up on other CPU products. If they like what they find, support and even buy that product.
Real customers do that have option. Ask questions, shop around, test, buy, think, publish.
Buying again and again from the brands that have fooled consumers for years with ta
Re: (Score:2)
You are naive and the parent poster was spot on - there is no way for anyone outside of a chip fab company has any ability to check the physical layout of cpu microcode, cache and other subsystems.
Your only potentially secure alternative is to use an FPGA to implement a cpu design of your own design. Good luck getting anything near the performance of a current day cpu. Note, I said your own design. Sure, there are prepackaged CPUs for Altera, etc on FPGAs but you again are in a position of having to veri
Re: (Score:2)
Feeding the troll but what the heck....
From early 2012 [eetimes.com]
Re: (Score:2)
So thats an easy list to start with
Re: (Score:2)
Re: (Score:3)
This is why security sensitive functions need to be system code, not application code. System code, and hopefully coders, tend to get more scrutiny, have higher standards of quality, and have a
Re: (Score:1)
Sure things, read all the source code you want, but do you trust your compiler?
Re: (Score:1)
Android and iOS are not the only smartphone OS's.
Re: (Score:2)
Right, I forgot about WinCE, I mean WinMo, I mean WinRT, I mean “just-Windows, but it’s different and doesn’t run the same apps”. That’s a much more trust-worthy option than Android or iOS. Or were you talking about WebOS (US-made, essentially defunct) or Blackberry (long standing tradition of rolling over for oppressive governments to prop up their bottom line).
Anything else?
Re: (Score:1)
I use Sailfish and Maemo.
(Ok, Maemo is kinda dead at the moment, but might get a bit more life when the neo900 is finished).
Re: (Score:2)
http://jolla.com/ [jolla.com]
Re: (Score:2)
this. and you're saying it, as if it weren't true.
Re: (Score:2)
That means we can't trust any versions of Windows, OS X, iOS, Android. We also can't trust Firefox, Chrome, Safari, Internet Explorer.
So what's left? No smartphone and Linux with Opera on your computer?
Don't forget, nearly all BIOS/EFI/UEFI software is produced in the USA too.
Actual link to the EFF 'scorecard' (Score:5, Informative)
The actual 'scorecard' can be found here [eff.org]. No need to go to extremes and RTFA.
[Snarky comment about sloppy /. submissions.]
Re: (Score:2)
Not to mention this is practically a dupe [slashdot.org] of an earlier story that actually has the link to the scorecard.
Re: (Score:1)
I'm glad you said this. It prompted me to ask myself, "What publication is this submission linking to? Why would a submitter be so sloppy?" So I looked up this "blottsie" submitter, and noticed that its submissions for the past few months all point to the dailydot.com site.
This is good to know. I avoid these submission bots that only exist to try to drive traffic from slashdot to a specific clickbait sources. (Nerval's Lobster (dicebot), mdsolar (anti-nuke shill), MojoKid (hothardware), and cold fjord
Criticism seems valid (Score:2, Interesting)
From the article:
"The EFF scorecard gives Skype two check marks for being encrypted in transit and encrypted so the provider can’t read it."
and then:
“There are always going to be difficult cases when you’re evaluating complex software,” EFF’s Eckersley said. “There are clear indications that the NSA intercepted Skype conversations. However, we don’t know if that was a break in the cryptography itself that would allow anyone to intercept, or if it was a compelled man
Re: (Score:3)
Well, since everything is marked either checked or don't use, that's not unreasonable. Granted a more accurate marking would be to just not mark it those two times. Also, with the rating given nobody who is serious about security would use skype, so it's not like they're actually misleading anyone.
Re: (Score:2)
Product, brand, service or code on phone hardware for voice and video?
Communications Assistance for Law Enforcement Act is clear on the expected support needed. What needs telco products have to meet will be seen under new regulations over the next years.
https://en.wikipedia.org/wiki/... [wikipedia.org]
Re: (Score:2)
Which to bring to a fine point, there is only one somewhat successful app for securing your message and it is called legislation and just to make sure it works international treaties. The pigopolist psychopathic copyrighters have no problem getting legislation and treaties to protect their theft of the public domain and pretend they invented everything so they cab basically print money, why the hell can we not do the same to achieve the most important protection of all, legal protection for our information
Re: (Score:2)
there is only one somewhat successful app for securing your message and it is called legislation
Nope.
without legislation and treaties they will hack you hardware and pry before you can begin to secure it
A legitimate concern, but that's a technical challenge, not a game-over.
launch man in the middle attacks
That's what proper crypto is for.
hack you software via updates and corrupt compliant software licensor's
Proprietary software vendors in particular. This stuff doesn't seem to happen as much in FOSS, but yes, it is a concern.
and if all that fails, grab you off the street and enhanced interrogation the information out of you or kill you in the process via 'er' natural causes.
No, the
Re: (Score:3)
It seems bazaar
Market up to a lack of common sense.
Re: (Score:2, Funny)
>It seems bazaar
Reminds me of an Eric Raymond aticle: "The Cathedral and the Bizzare"
On the one hand is the EFF... (Score:1)
..who has a track record in this area.
On the other, we have @ioerror, The malware monster!, and @tqbf who are all well known security experts and...wait..who?
Free donations to EFF (Score:1)
I use smile.amazon.com, which automatically takes 0.5% of the purchase price and donates it to the organization of your choice at no extra cost. You can set it up to donate to the EFF. Just make sure you always go to smile, or else the donations don't occur.
Supporting the EFF seems to be the easiest way to support our right to privacy online.
Pidgin and OTR (Score:1)
OpenPGP (Score:3, Interesting)
The scorecard gives negative marks for both PGP for Mac and PGP for Windows, for both "Are past comms secure if your keys are stolen?" and "Has the code been audited?" Both negative marks are quite wrong!!
Using the OpenPGP definition, decryption requires both a private key and a passphrase. If the private key is compromised but the passphrase remains safe, a file or message encrypted via OpenPGP cannot be decrypted. This depends, of course, on a lengthy passphrase that exists only in the user's head. My passphrase is over 20 characters long and contains upper-case and lower-case letters, spaces, and punctuation.
Older versions of PGP (a commercial implementation of OpenPGP) have indeed been audited. The source codes were made public. They were thoroughly examined by outsiders. And they were compiled and compared with the distributed binary code. I do not know if this is true of the latest versions, but the older versions contained no security vulnerabilities and still work quite well.
Re: (Score:3)
I don't know about the auditing, but the negative mark for "Are past comms secure if your keys are stolen?" is quite right. They're talking about forward secrecy [wikipedia.org], and PGP doesn't implement it. The basic idea of forward secrecy is that even if all the long-term secrets (passwords, keys, etc.) involved in
Re: (Score:2)
even if all the long-term secrets (passwords, keys, etc.) involved in a conversation are stolen, the person who stole them cannot go back and decrypt the encrypted messages.
I can't wrap my head around that. The way you've described it, it isn't possible, unless the original intended recipient also can't decrypt it. There must be at least one secret somewhere that isn't compromised (the recipient's private key maybe).
:)
BTW, does your sig ever get you modded redundant?
Re:OpenPGP (Score:5, Informative)
Anyway, thanks. I learned something new, which is why I still come to
Re: (Score:2)
That's not practical in the case of sending an encrypted email/file to someone. There is no "session" to speak of. There's no two-way conversation at the start before the file/information is transmitted.
GPG/PGP is designed to defend against disclosure of data-at-rest (i.
But are the listings TRUE (Score:5, Interesting)
Is the code is not open to independent review (as few of them are), is there any reason to trust the other listings? After all, we're trusting that when the maker says the software does not send messages in a way were they can intercept them, it's true, but we don't really know that to be the case.