4 ms·

Your messages are only as secure as the least careful person you correspond with.

by cwyers 7y ago

inetknght 7y ago
That will always be the case though
thaumasiotes 7y ago
But that's true no matter what methods you use. When you send a message, you don't enjoy any security at all from the recipient. If they decide to leak your messages, your messages will leak. If the way they decide to do it is by being incompetent, your messages will still leak. Look at the HackerOne reward policy for Snapchat: https://hackerone.com/snapchat https://hackerone.com/snapchat Among many less notable findings that aren't considered security issues, you can see that "screenshot detection avoidance" is a non-qualifying "bug". It's not really a bug. It doesn't qualify for a reward because your messages cannot be secured against people who are supposed to read them. Security against the recipient is (or was; I don't know the current marketing) a major marketing point for Snapchat, but it's never been something they actually offer. How is "your messages are only as secure as the least careful person you correspond with" more of an argument against PGP than it is against Signal?
- soraminazuki 7y ago
  The parent is focusing on carefulness, and not malicious intent. If being careful requires you to be knowledgeable in computer security or cryptography, we're never going to have a secure communication system because people aren't going to spend years learning those things to simply talk to people. Secure defaults matter, and not being able to configure and use GPG correctly is hardly "incompetence."
  - cwyers 7y ago
    Exactly this. tptacek's article talks about issues like someone replying (with the messages quoted) in cleartext by mistake, or leaking their keys. In a messenger like Signal, there's no easy way to accidentally reply in cleartext, and key management is handled for you so it's not possible to accidentally send the private key instead of the public key. It's not enough for _you_ to never do those things, you have to trust your correspondent to be capable to do those things without error (which is different than trusting them to not intentionally disclose).
iRobbery 7y ago
Exactly, and therefore i think the whole 'stop using encrypted email' is a rant that could apply to anything. Basically comes down to, you don't want people to know something, do not write it down.... not in email, not in pgp encrypted email, not in whatsapp, not even native American smoke signals....

Your messages are only as secure as the least careful person you correspond with.

by cwyers 7y ago

Your messages are only as secure as the least careful person you correspond with.

inetknght 7y ago

That will always be the case though

thaumasiotes 7y ago

But that's true no matter what methods you use. When you send a message, you don't enjoy any security at all from the recipient. If they decide to leak your messages, your messages will leak. If the way they decide to do it is by being incompetent, your messages will still leak. Look at the HackerOne reward policy for Snapchat: https://hackerone.com/snapchat https://hackerone.com/snapchat Among many less notable findings that aren't considered security issues, you can see that "screenshot detection avoidance" is a non-qualifying "bug". It's not really a bug. It doesn't qualify for a reward because your messages cannot be secured against people who are supposed to read them. Security against the recipient is (or was; I don't know the current marketing) a major marketing point for Snapchat, but it's never been something they actually offer. How is "your messages are only as secure as the least careful person you correspond with" more of an argument against PGP than it is against Signal?

soraminazuki 7y ago
The parent is focusing on carefulness, and not malicious intent. If being careful requires you to be knowledgeable in computer security or cryptography, we're never going to have a secure communication system because people aren't going to spend years learning those things to simply talk to people. Secure defaults matter, and not being able to configure and use GPG correctly is hardly "incompetence."
- cwyers 7y ago
  Exactly this. tptacek's article talks about issues like someone replying (with the messages quoted) in cleartext by mistake, or leaking their keys. In a messenger like Signal, there's no easy way to accidentally reply in cleartext, and key management is handled for you so it's not possible to accidentally send the private key instead of the public key. It's not enough for _you_ to never do those things, you have to trust your correspondent to be capable to do those things without error (which is different than trusting them to not intentionally disclose).

iRobbery 7y ago

Exactly, and therefore i think the whole 'stop using encrypted email' is a rant that could apply to anything. Basically comes down to, you don't want people to know something, do not write it down.... not in email, not in pgp encrypted email, not in whatsapp, not even native American smoke signals....