4 ms·
Can we trust Wickr? I have used it for some communications I would not like to get to wrong hands (but the consequences of getting lost are not too harsh), yet
by exDM69 10y ago
Can we trust Wickr? I have used it for some communications I would not like to get to wrong hands (but the consequences of getting lost are not too harsh), yet I have roughly zero confidence that the messages aren't stored and that they are delivered end-to-end secure.
It's not open source (?) so it can't be audited. The server infrastructure may be wiretapped and/or backdoored by law enforcement together with a gag order. It's headquartered in the US, which I don't trust. They claim to be end-to-end encrypted but how can I tell, let alone the general public who aren't familiar with crypto.
I've used Wickr because the other parties I was communicating with were using it. But since I wasn't trusting the other party (cryptography can only assure trust, not create it) so I might have been using smoke signals instead.
For my use, it still does beat text messages because at worst it's security by obscurity and my local (non-US) law enforcement can't easily get their hands on the data.
- jgrahamc 10y agoI never stated I trusted Wickr to not be backdoored. Just that it would be better than a text message.
- exDM69 10y agoThat depends on the adversary. For something I don't want to get into the hands of local law enforcement (outside US), Wickr might be better than text messages. But I trust my network provider more when it comes to keeping the data safe, if I don't mind that local LEO agencies can readily access it. They are under strong legal and contractual obligations not to disclose the information to third parties and have better funding than Wickr. Wickr probably does a pretty good job, but they might be backdoored (ie. keep plaintext of communications and/or metadata) and might get hacked and leak the data and release it in the internet.