3 ms·
How can you reasonably suggest trusting a mobile device if you have "real adversaries"? If you define your threat model to include any serious governmental inte
by aftbit 10y ago
How can you reasonably suggest trusting a mobile device if you have "real adversaries"? If you define your threat model to include any serious governmental interest, you cannot trust a cell phone. They have an always on network connection, remote auto-upgrade capability (at least for the baseband, if not the user software), and built-in microphone, cameras, gps, and other sensors.
- tptacek 10y agoSome of these concerns aren't valid (for instance: the baseband of your phone is less powerful, in its systems design, than is supposed by open hardware advocates), but mostly the issue is: security is about costs and prioritization, not absolutes. The systems people propose instead of Signal are likely to cough up secrets directly to adversaries; switching from Signal to something else reduces security. If you believe people with state-level adversaries should exclusively use transparent and open hardware, that's fine; you should see Moxie's comment on this thread to learn how you might go about ensuring that the tiny minority of users with that hardware have access to Signal on it.
- egh5oon 10y agoSpot on. Many companies pushing "secure" applications conveniently forget to warn users about the false sense of security. The cryptography might be flawless, but everything else...