3 ms·
This seems like a extreme argument. If the app is not phoning home with the cleartext, this seems okay. You need some software to retrieve/read text anyway,
by fooker 7y ago
This seems like a extreme argument.
If the app is not phoning home with the cleartext, this seems okay.
You need some software to retrieve/read text anyway, so this becomes an exercise about trusting trust, etc.
- TimTheTinker 7y ago> This seems like a extreme argument. Not at all. Good security often involves some black-and-white thinking, which not everyone is accustomed to. If Facebook controls the endpoint, then they have the power to access the plaintext, full stop. Using their product (hopefully) implies a choice to trust them not to abuse such access.
- gimmeThaBeet 7y ago> Using their product (hopefully) implies a choice to trust them not to abuse such access. Which is what...they said?
- ip26 7y agoAlthough I argue the black-and-white "everyone is a potential adversary" thinking is misguided. Your threat model determines requisite security measures, and you usually have to trust someone. (Although Facebook should probably not be that someone)
- fooker 7y agoOk, what about the closed source hardware in the phones? Would you argue against all encryption because clearly the CPU maker has a similar access to all decrypted content?
- lmm 7y agoI'd argue for not trusting a cryptosystem that requires you to use a particular vendor's CPUs. Open standards and independent implementations at every level should be table stakes.
- marta_morena 7y agoAn extreme argument? If you don't care about security, perhaps you are right. In any other case, using a closed source endpoint from the company that promises you "encryption" is completely crazy. They "only" have the ability to decrypt all your messages, remove encryption altogether without notice, targeting ads based on your conversation history, and installing targeted decryption backdoors. Yeah not big deal at all, seems like something really trustworthy. It's still better than nothing, although in the hands of Facebook it might actually be worse than nothing.
- roywiggins 7y agoThe fear is that Facebook could push updates to targets that the US government is interested in and initiate a phone home. The update mechanism is the "front door" that could be used to implant a backdoor.