3 ms·

But why incentivize the weakening of secure systems? I honestly don't think that black hat hackers would find much utility in cracking an app like Signal (excep

But why incentivize the weakening of secure systems? I honestly don't think that black hat hackers would find much utility in cracking an app like Signal (except maybe for street cred). Relatively few of it's users would be "soft targets" in terms of susceptibility to phishing, social engineering, weak passwords, lack of 2FA, etc. Governments on the other hand would pay lots of money to increase their mass surveillance capabilities. Signal users are disproportionately young, sophisticated, and politically engaged. Given that Signal's budget is raised from donations and grants, and is much more fixed than an open market to undermine it, how would such a market incentivize them to increase funding on security? It's already their top priority.

jstanley 9y ago
> But why incentivize the weakening of secure systems? Are you suggesting that the developers would put in a vulnerability on purpose, in order to sell it and collect the payoff? Because, short of that, I can't see how exploit trading incentivises weakening of systems. It just incentivises people to find weaknesses.
- confounded 9y ago
  That's what first-party bug bounty programs do now. The extra thing that a free market does is incentivises people to find weaknesses and sell them so that they can be maliciously exploited. When vulnerabilities are exploited instead of patched, secure systems are by definition weaker.