3 ms·

https://www.eff.org/secure-messaging-scorecard https://www.eff.org/secure-messaging-scorecard

by noja 11y ago

tptacek 11y ago
This thing is not good, and I strongly recommend against making decisions based on it.
- Throwaway23412 11y ago
  Elaborate please? (I'm not as well versed in security as I would like.)
  - tprynn 11y ago
    Here's a quote from a post I enjoyed (https://www.elttam.com.au/blog/a-review-of-the-eff-secure-messaging-scorecard-pt1/ https://www.elttam.com.au/blog/a-review-of-the-eff-secure-me...): > This type of score card drastically simplifies the problem domain, and leads one to question what the tradeoffs are when installing an application from the list. While the advocacy of privacy based communication is something we love to see reach a mainstream audience, we believe the scorecard misses many considerations and metrics that are critical to the discussion. To quote myself: > The EFF score card is an embarrassment which is essentially equivalent to one of those "comparison table of our competitors" on a SaaS website. That's a good analogy for it, because it uses the same questionable metrics and even more questionable ranking system that one of those tables would use. The score card gives Signal the same ranking as Cryptocat - that's an instant negative result for its usefulness.
  - Mandatum 11y ago
    See this thread: https://news.ycombinator.com/item?id=8557654 https://news.ycombinator.com/item?id=8557654
- nickpsecurity 11y ago
  I agree. I particularly like your emphasis in last discussion on fact that they "buried PGP." PGP and then GPG have a long history of working against most powerful of the nation-state hackers. The Snowden leaks feature NSA smashing almost everything except for a rare few you can count on one hand IIRC. One of those is GPG. "NSA-proof in 2013" should get put next to its name on top of list, bolded, highlighted, etc. Curious, what do you think of the worth of a LibreSSL-style effort to clean up GPG's proven code and build better interfaces for integrating it into other apps? Of course, to be done in parallel with development of things like Signal that will get more adoption.

https://www.eff.org/secure-messaging-scorecard https://www.eff.org/secure-messaging-scorecard

by noja 11y ago

https://www.eff.org/secure-messaging-scorecard https://www.eff.org/secure-messaging-scorecard

tptacek 11y ago

This thing is not good, and I strongly recommend against making decisions based on it.

Throwaway23412 11y ago
Elaborate please? (I'm not as well versed in security as I would like.)
- tprynn 11y ago
  Here's a quote from a post I enjoyed (https://www.elttam.com.au/blog/a-review-of-the-eff-secure-messaging-scorecard-pt1/ https://www.elttam.com.au/blog/a-review-of-the-eff-secure-me...): > This type of score card drastically simplifies the problem domain, and leads one to question what the tradeoffs are when installing an application from the list. While the advocacy of privacy based communication is something we love to see reach a mainstream audience, we believe the scorecard misses many considerations and metrics that are critical to the discussion. To quote myself: > The EFF score card is an embarrassment which is essentially equivalent to one of those "comparison table of our competitors" on a SaaS website. That's a good analogy for it, because it uses the same questionable metrics and even more questionable ranking system that one of those tables would use. The score card gives Signal the same ranking as Cryptocat - that's an instant negative result for its usefulness.
- Mandatum 11y ago
  See this thread: https://news.ycombinator.com/item?id=8557654 https://news.ycombinator.com/item?id=8557654
nickpsecurity 11y ago
I agree. I particularly like your emphasis in last discussion on fact that they "buried PGP." PGP and then GPG have a long history of working against most powerful of the nation-state hackers. The Snowden leaks feature NSA smashing almost everything except for a rare few you can count on one hand IIRC. One of those is GPG. "NSA-proof in 2013" should get put next to its name on top of list, bolded, highlighted, etc. Curious, what do you think of the worth of a LibreSSL-style effort to clean up GPG's proven code and build better interfaces for integrating it into other apps? Of course, to be done in parallel with development of things like Signal that will get more adoption.