3 ms·

... and given that Ackerly was first in IAD working on cross-domain solutions and then SNIP, I doubt he is an expert on encryption. What do you think of Virtru

... and given that Ackerly was first in IAD working on cross-domain solutions and then SNIP, I doubt he is an expert on encryption. What do you think of Virtru? I was hoping you would comment on this article since you're an actual crypto expert. Encryption-by-plugin seems less bad than encryption-by-javascript, but their entire business model depends on us trusting Virtru for key escrow. This doesn't seem any better than trusting Apple for iMessage or Google for Gmail. Am I missing anything? Edit: I guess a malicious attacker would need to take two steps for the information. One for the encryption key hosted at Virtru, then a second step to actually capture the emailed message.

nickpsecurity 11y ago
I trust an expert in cross-domain over an expert on encryption any day. Having done cross-domain design, I know you have to look at the system holistically from the hardware up and at every interface (eg protocol). Most flaws in crypto are implementation and protocol issues. So you want someone whose regularly coding and hacking systems to build that rather than people looking at math all day. He can hire a real cryptographer to review and improve his algorithms as his business brings in revenue. Implementation and interfaces, though, are where risks are and his strength. The key escrow bothers me, too, though. It requires key escrow without a HSM (far as I know) and under U.S. jurisdiction. Plus, a high assurance system resistant to nation-states is time-consuming to put together. Their development speed, client support, and price indicate they're using a low assurance process with mainstream components. So, their escrow is at risk to both a court order and hackers. Not to mention malicious insiders. I'll pass...
kodablah 11y ago
I need more details that I can't find in their FAQ[1] and it's not all open source yet[2]. My main question is about metadata which you cannot really protect that well w/ how SMTP works. The second question would be how different this is from PGP/Mailvelope[3] and where the keys are stored for a user (i.e. the "trusting" you are talking about). 1 - https://www.virtru.com/faq/ https://www.virtru.com/faq/ 2 - https://www.virtru.com/blog/virtrus-open-source-strategy/ https://www.virtru.com/blog/virtrus-open-source-strategy/ 3 - https://www.mailvelope.com/ https://www.mailvelope.com/
- linkregister 11y ago
  Virtru escrows the keys, at least that's how I interpret this diagram: https://www.virtru.com/technology/ https://www.virtru.com/technology/

nickpsecurity 11y ago

I trust an expert in cross-domain over an expert on encryption any day. Having done cross-domain design, I know you have to look at the system holistically from the hardware up and at every interface (eg protocol). Most flaws in crypto are implementation and protocol issues. So you want someone whose regularly coding and hacking systems to build that rather than people looking at math all day. He can hire a real cryptographer to review and improve his algorithms as his business brings in revenue. Implementation and interfaces, though, are where risks are and his strength. The key escrow bothers me, too, though. It requires key escrow without a HSM (far as I know) and under U.S. jurisdiction. Plus, a high assurance system resistant to nation-states is time-consuming to put together. Their development speed, client support, and price indicate they're using a low assurance process with mainstream components. So, their escrow is at risk to both a court order and hackers. Not to mention malicious insiders. I'll pass...

kodablah 11y ago

I need more details that I can't find in their FAQ[1] and it's not all open source yet[2]. My main question is about metadata which you cannot really protect that well w/ how SMTP works. The second question would be how different this is from PGP/Mailvelope[3] and where the keys are stored for a user (i.e. the "trusting" you are talking about). 1 - https://www.virtru.com/faq/ https://www.virtru.com/faq/ 2 - https://www.virtru.com/blog/virtrus-open-source-strategy/ https://www.virtru.com/blog/virtrus-open-source-strategy/ 3 - https://www.mailvelope.com/ https://www.mailvelope.com/

linkregister 11y ago
Virtru escrows the keys, at least that's how I interpret this diagram: https://www.virtru.com/technology/ https://www.virtru.com/technology/