4 ms·

> I think the endorsements should acknowledge that one can't necessarily trust the rest of the smartphone software and hardware. Welp, guess I should just send

> I think the endorsements should acknowledge that one can't necessarily trust the rest of the smartphone software and hardware. Welp, guess I should just send my messages in the clear then rather than make them work for them

neilv 7y ago
Recommending a solution for a critical need without communicating the limitations doesn't seem like good engineering practice.
- dontbenebby 7y ago
  > Recommending a solution for a critical need without communicating the limitations doesn't seem like good engineering practice. Good security advice is about harm reduction. Security advice is not "bad" because it does not achieve perfect security. Using Signal instead of an app the government can access through subpoenas (Facebook Messenger), that is closed source (iMessage) or transmits in the clear (traditional SMS) is good advice because it reduces harm and reduces risk.
  - neilv 7y ago
    We can't know all threat models and options of everyone who is the audience of such broadcast endorsements, such that we can engage in noble lies and confidently call it "harm reduction". (Simple scenario: journalist was told by experts that such-and-such is secure, without qualification, so journalist uses it in some ways that they would not, had they been given a more accurate characterization.)
    - dontbenebby 7y ago
      How is saying "I endorse using Signal" a lie? Seems like that's a statement of opinion.
      - neilv 7y ago
        You can see my first comment in this thread, which you took exception to. This is a very important topic, and I'm not debating recreationally. There is a long and ongoing history of security advocates overstating security, to people who really need it, and that's the sort of thing that can get people killed, positive movements ended, etc. Anyone advocating right now should be aware of that, and not keep making the same mistakes.
        dontbenebby 7y ago
        > There is a long and ongoing history of security advocates overstating security I'm not sure I follow your logic. Maybe you can help me out a bit? There are four quotes on the linked page. Which one do you feel overstated the security of Signal, and why?

neilv 7y ago

Recommending a solution for a critical need without communicating the limitations doesn't seem like good engineering practice.

dontbenebby 7y ago
> Recommending a solution for a critical need without communicating the limitations doesn't seem like good engineering practice. Good security advice is about harm reduction. Security advice is not "bad" because it does not achieve perfect security. Using Signal instead of an app the government can access through subpoenas (Facebook Messenger), that is closed source (iMessage) or transmits in the clear (traditional SMS) is good advice because it reduces harm and reduces risk.
- neilv 7y ago
  We can't know all threat models and options of everyone who is the audience of such broadcast endorsements, such that we can engage in noble lies and confidently call it "harm reduction". (Simple scenario: journalist was told by experts that such-and-such is secure, without qualification, so journalist uses it in some ways that they would not, had they been given a more accurate characterization.)
  - dontbenebby 7y ago
    How is saying "I endorse using Signal" a lie? Seems like that's a statement of opinion.
    - neilv 7y ago
      You can see my first comment in this thread, which you took exception to. This is a very important topic, and I'm not debating recreationally. There is a long and ongoing history of security advocates overstating security, to people who really need it, and that's the sort of thing that can get people killed, positive movements ended, etc. Anyone advocating right now should be aware of that, and not keep making the same mistakes.
      - dontbenebby 7y ago
        > There is a long and ongoing history of security advocates overstating security I'm not sure I follow your logic. Maybe you can help me out a bit? There are four quotes on the linked page. Which one do you feel overstated the security of Signal, and why?