3 ms·

I'll cite moxie: > If we were going to rank our priorities, they would be in this order: > 1) Make mass surveillance impossible. > 2) Stop targeted attacks a

by exo762 11y ago

I'll cite moxie: > If we were going to rank our priorities, they would be in this order: > 1) Make mass surveillance impossible. > 2) Stop targeted attacks against crypto nerds. As long as US Army is not using metadata to shoot people with hellfire missiles on American soil, Signal is good enough for general population. If you want perfect protocol - work on Vuvuzela. But good luck porting traffic analysis resistant solution to mobile phones with their limited battery capacity.

akerro 11y ago
>As long as US Army is not using metadata to shoot people with hellfire missiles on American soil Not American soil... but... NSA 'drone strikes based on mobile phone data' http://www.independent.co.uk/news/world/politics/nsa-drone-strikes-based-on-mobile-phone-data-9119735.html http://www.independent.co.uk/news/world/politics/nsa-drone-s...
glogla 11y ago
> on American soil, Signal is good enough for general population. What do you know, general population of the world does not live on American soil. I can't trust Moxie after he called Google, Microsoft and Apple having absolute control over people's good thing, and called people having control over their own devices "going back to the old broken desktop security model". Can you trust someone like that? It all makes me think that Signal is some kind of honeypot.
- exo762 11y ago
  Propose alternatives. For general population. Go. ... Now, when you've suddenly realized that people: 1) will not stop using mobile phones 2) mobile phones are tracking devices 3) preventing mobiles from tracking you is well beyond skills of both average tech person and average joe 4) average person is not capable of keeping malware away from their machine What do you propose? Can you do better than moxie? Or will you continue to spread FUD about best available tech?
- simoncion 11y ago
  > I can't trust Moxie after he called Google, Microsoft and Apple having absolute control over people's good thing, and called people having control over their own devices "going back to the old broken desktop security model". When speaking about non-technical, generally-clueless-about-computers people? This is ABSOLUTELY the correct attitude to have. Being able to trick someone into installing softare that reports back everything you do on your computer by getting the user to Punch The Monkey is a BUG, not a feature. The screaming hellpit that is the state of PC security is very bad for the average computer user. For technical users, systems (like Secure Boot, along with a chain of bootloader/kernel/userspace software verifiers [0]) that let you -say- securely attest that you trust an alternative source of software are really good, when implemented properly. They help prevent drive-by malware installation, as well as let you know when your machine has been tampered with. This is a GOOD property to have. What about users who want to run their homebrew software (or even start to learn how to code), but don't want to be bothered with code signing key enrollment? On the one hand, I guess -in this world- they're left out in the cold, if they're not doing something in the browser. On the other hand, any programmer is going to quickly face challenges far greater than any non-pathologically-bad key enrollment mechanisms... if the would-be non-web-programmer never gets over this hurdle, it's very likely (in its absence) he would have been stopped by any of the other couple-hundred difficult things along the way. [0] It's late, so some of these verifiers (particularly the userspace one) might not exist in any mainstream distro.

by exo762 11y ago

akerro 11y ago

>As long as US Army is not using metadata to shoot people with hellfire missiles on American soil Not American soil... but... NSA 'drone strikes based on mobile phone data' http://www.independent.co.uk/news/world/politics/nsa-drone-strikes-based-on-mobile-phone-data-9119735.html http://www.independent.co.uk/news/world/politics/nsa-drone-s...

glogla 11y ago

> on American soil, Signal is good enough for general population. What do you know, general population of the world does not live on American soil. I can't trust Moxie after he called Google, Microsoft and Apple having absolute control over people's good thing, and called people having control over their own devices "going back to the old broken desktop security model". Can you trust someone like that? It all makes me think that Signal is some kind of honeypot.

exo762 11y ago
Propose alternatives. For general population. Go. ... Now, when you've suddenly realized that people: 1) will not stop using mobile phones 2) mobile phones are tracking devices 3) preventing mobiles from tracking you is well beyond skills of both average tech person and average joe 4) average person is not capable of keeping malware away from their machine What do you propose? Can you do better than moxie? Or will you continue to spread FUD about best available tech?
simoncion 11y ago
> I can't trust Moxie after he called Google, Microsoft and Apple having absolute control over people's good thing, and called people having control over their own devices "going back to the old broken desktop security model". When speaking about non-technical, generally-clueless-about-computers people? This is ABSOLUTELY the correct attitude to have. Being able to trick someone into installing softare that reports back everything you do on your computer by getting the user to Punch The Monkey is a BUG, not a feature. The screaming hellpit that is the state of PC security is very bad for the average computer user. For technical users, systems (like Secure Boot, along with a chain of bootloader/kernel/userspace software verifiers [0]) that let you -say- securely attest that you trust an alternative source of software are really good, when implemented properly. They help prevent drive-by malware installation, as well as let you know when your machine has been tampered with. This is a GOOD property to have. What about users who want to run their homebrew software (or even start to learn how to code), but don't want to be bothered with code signing key enrollment? On the one hand, I guess -in this world- they're left out in the cold, if they're not doing something in the browser. On the other hand, any programmer is going to quickly face challenges far greater than any non-pathologically-bad key enrollment mechanisms... if the would-be non-web-programmer never gets over this hurdle, it's very likely (in its absence) he would have been stopped by any of the other couple-hundred difficult things along the way. [0] It's late, so some of these verifiers (particularly the userspace one) might not exist in any mainstream distro.