6 ms·

> Do not rely on Ricochet for your safety unless you have more trust in my work than it deserves This is an interesting line from the github readme. And I appl

> Do not rely on Ricochet for your safety unless you have more trust in my work than it deserves This is an interesting line from the github readme. And I applaud for being humble. This is something which seemed lacking when I read about dapps (etherium) -- people rarely talked about having low trust on contracts written by somebody else.

DyslexicAtheist 8y ago
I personally prefer as you said the humble approach - in fact seeing any security software not display a big fat warning is for me a warning. Telegram has a RCE 0day, not to mention their snake-oil cryptography track record (Diffie-Hellman backdoor). Ricochet was audited in 2016: https://twitter.com/torproject/status/699668346921332737 https://twitter.com/torproject/status/699668346921332737 And since then things have moved forward only very slowly, but I do not see this as a sign of the project being abandoned more like that there aren't enough people to maintain it. FWIW the @torproject still endorses ricochet for now: https://twitter.com/torproject/status/1073322441836036096 https://twitter.com/torproject/status/1073322441836036096
- dfabulich 8y ago
  I don't think that's the same Ricochet? @Ricochet on Twitter is associated with Ricochet dot com, "the leading place for civil discussion of the center-right and beyond." It requires paid membership. (Though perhaps @torproject meant to link to this Ricochet IM product and not @Ricochet...?)
  - DyslexicAtheist 8y ago
    oh dear :D ... well spotted! that's most certainly not an endorsement for the former and was supposed to point to the ricochet IM. (facepalm) :)
  - jstanley 8y ago
    For avoidance of doubt: it is Ricochet IM that was security audited: https://www.nccgroup.trust/us/our-research/ricochet-security-assessment-public-report/ https://www.nccgroup.trust/us/our-research/ricochet-security... But yes looks like the tweet is @ the wrong account.
- natdempk 8y ago
  > Telegram has a RCE 0day Can you provide more context about this, or somewhere I can read about this please? Very curious.
  - DyslexicAtheist 8y ago
    can't sorry, and there are no public discussions on this (for now)
    - AnaniasAnanas 8y ago
      Please consider disclosing the issue responsibly by releasing it to the public. Keeping it secret and only telling a select few gives the ability to the said few (which may include Telegram itself) to use the vulnerability maliciously. In addition even if you have disclosed the issue to the Telegram team and Telegram has fixed said vulnerability the same may not be said for any forks of it whose maintainers are not aware of the issue.
      - DyslexicAtheist 8y ago
        > and only telling a select few gives the ability If more than 1 person knows something it's no longer a secret. Likewise if 2 people know about the existence of a 0day it's no longer a 0day. ... Why should I burn a 0day? Who will pay me for it? I'm not stupid and I don't participate in the responsible disclosure circle jerk. TG is snakeoil: If you use it for anything more serious than hiding an affair from your spouse high chance you get burnt. Especially wanna be terrorists ought to stay clear. TG is one giant weird machine: You'll notice quickly if you play with it. There very likely many 0days in TG and for sure LE has access to it too. So finding something isn't even a statistical outlier. People who think that responsible disclosure must be practiced are just parroting the corporate bullshit. Bug bounties hunters are the Uber drivers of InfoSec. Poor fuckers that are pressed into a system that only benefits the corporate overlords. How about starting with responsible QA instead of moving fast & breaking things?
        dijit 8y ago

DyslexicAtheist 8y ago

I personally prefer as you said the humble approach - in fact seeing any security software not display a big fat warning is for me a warning. Telegram has a RCE 0day, not to mention their snake-oil cryptography track record (Diffie-Hellman backdoor). Ricochet was audited in 2016: https://twitter.com/torproject/status/699668346921332737 https://twitter.com/torproject/status/699668346921332737 And since then things have moved forward only very slowly, but I do not see this as a sign of the project being abandoned more like that there aren't enough people to maintain it. FWIW the @torproject still endorses ricochet for now: https://twitter.com/torproject/status/1073322441836036096 https://twitter.com/torproject/status/1073322441836036096

dfabulich 8y ago
I don't think that's the same Ricochet? @Ricochet on Twitter is associated with Ricochet dot com, "the leading place for civil discussion of the center-right and beyond." It requires paid membership. (Though perhaps @torproject meant to link to this Ricochet IM product and not @Ricochet...?)
- DyslexicAtheist 8y ago
  oh dear :D ... well spotted! that's most certainly not an endorsement for the former and was supposed to point to the ricochet IM. (facepalm) :)
- jstanley 8y ago
  For avoidance of doubt: it is Ricochet IM that was security audited: https://www.nccgroup.trust/us/our-research/ricochet-security-assessment-public-report/ https://www.nccgroup.trust/us/our-research/ricochet-security... But yes looks like the tweet is @ the wrong account.
natdempk 8y ago
> Telegram has a RCE 0day Can you provide more context about this, or somewhere I can read about this please? Very curious.
- DyslexicAtheist 8y ago
  can't sorry, and there are no public discussions on this (for now)
  - AnaniasAnanas 8y ago
    Please consider disclosing the issue responsibly by releasing it to the public. Keeping it secret and only telling a select few gives the ability to the said few (which may include Telegram itself) to use the vulnerability maliciously. In addition even if you have disclosed the issue to the Telegram team and Telegram has fixed said vulnerability the same may not be said for any forks of it whose maintainers are not aware of the issue.
    - DyslexicAtheist 8y ago
      > and only telling a select few gives the ability If more than 1 person knows something it's no longer a secret. Likewise if 2 people know about the existence of a 0day it's no longer a 0day. ... Why should I burn a 0day? Who will pay me for it? I'm not stupid and I don't participate in the responsible disclosure circle jerk. TG is snakeoil: If you use it for anything more serious than hiding an affair from your spouse high chance you get burnt. Especially wanna be terrorists ought to stay clear. TG is one giant weird machine: You'll notice quickly if you play with it. There very likely many 0days in TG and for sure LE has access to it too. So finding something isn't even a statistical outlier. People who think that responsible disclosure must be practiced are just parroting the corporate bullshit. Bug bounties hunters are the Uber drivers of InfoSec. Poor fuckers that are pressed into a system that only benefits the corporate overlords. How about starting with responsible QA instead of moving fast & breaking things?
      - dijit 8y ago