4 ms·
It's sad but events like this one make me turn away from Internet. I started using Signal because I don't want people seeing the messages I post. But in the en
by huuu 11y ago
It's sad but events like this one make me turn away from Internet.
I started using Signal because I don't want people seeing the messages I post. But in the end it's only trust that makes me think Signal is safe to use.
A lot of people also trusted Juniper. But that trust is gone. And not only for Juniper. What about other brands? We don't know.
- mjs 11y agoYou're still secure if you use https. If neither your computer nor the host you're connecting to has been tampered with, then you're safe irrespective of what's happening between.
- nickodell 11y agoWell, what if the host you're connecting to is a Juniper firewall?
- toyg 11y agoYeah, because illegitimate / spoofed certificates will never happen...
- andreyf 11y agoI think we're well on our way to a point where certificates can be mostly trusted. Of course certs can be stolen, but I would bet that "spoofed" certificates will soon be an occurrence of the past.
- Ao7bei3s 11y agoWith certificate transparency, at least we'll know about it - afterwards, at least.
- marcosdumay 11y agoWell, afterwards, if the attack stops (software does not need to stop) in a timeframe short enough for your computer to no clear its history.
- hcf 11y agoMany https sites use RC4, I wouldn't be so sure.
- netheril96 11y agoThen use a browser that rejects RC4 (like latest Chrome).
- deleted 11y ago[deleted]
- Robin_Message 11y agoThe private key is used to negotiate a session key, which is then used as the symmetric key for RC4 or whatever stream or block cipher you are using. Those session keys are ephemeral and per-session, so leaking them is only a problem for those sessions. (Also, since it's a stream cipher, it can't use the same key ever again, else you can xor those ciphertexts to get 2 xored plaintexts, which are much easier to crack.)
- jlgaddis 11y agoI get where you're coming from and I want to agree with you but... While that used to be true, based upon recent history we, unfortunately, can't blindly trust HTTPS to always be "secure" 100% of the time anymore -- whether due to things like Heartbleed, fake certs signed by a root CA, protocol attacks, or some other vulnerability that hasn't even been discovered yet.
- Taek 11y agoSignal is open source. But you have to trust the OS it runs on...
- tux1968 11y agoAnd the hardware the OS runs on... Intel and others are now embedding "management" features at a very low level.
- junto 11y agoAnd even if you trust the OS, you have no idea what is going on on the phone's baseband processor: https://en.m.wikipedia.org/wiki/Baseband_processor https://en.m.wikipedia.org/wiki/Baseband_processor One has to assume that all are back-doored. Mobile phones are inherently not trustable. Same goes for all major firewall vendors. If you going to hack one of them as a nation state, then you're going to do all of them.
- garrettgrimsley 11y agoThere is at least one project that seeks to mitigate the threat posed by baseband processors having DMA, Neo900: http://neo900.org/faq#privacy http://neo900.org/faq#privacy
- hdmoore 11y agoEven if you trust the OS and the baseband, you have to trust that the federated server for Signal (OpenWhisper, Cyanogen, etc) isn't storing contact discovery requests.
- lovemenot 11y agoIt's sad but comments like this made me turn away from language as a reliable means of communication. I used to believe anything I'd read. But, having become aware of trolls and worse, those days are gone. Not only English, but Japanese and who knows which other languages are untrustworthy.
- huuu 11y agoI'm not sure what you are trying to communicate. Trust is something delicate which works best by using face to face communication. So it's ok not to trust everything you read. But this story is about private communication not being as private as thought.