5 ms·
From the article these attacks allow for: * deanonymizing users * building social graphs of users’ interactions, both in real time and after the fact * decry
by slg 6y ago
From the article these attacks allow for:
* deanonymizing users
* building social graphs of users’ interactions, both in real time and after the fact
* decrypting and reading direct messages
* impersonating users to anyone else on the network
* completely shutting down the network
* performing active man-in-the-middle attacks, which allow an adversary not only to read messages, but to tamper with them as well
This app basically allows for the exact opposite of what people are expecting from the app. Doesn't that qualify as some sort of fraud or false advertising? If not, I wonder if we need further regulation to protect the public from developers that are either incompetent or straight malicious.
- vkou 6y agoYou can always ask for a refund of the zero dollar purchase price. :/
- slg 6y agoDo you think a company has zero obligations to its users if those users are not paying for the service? Most of us have never directly paid Google for anything. I think we would still have justification in being upset if there was a central Google flaw that allowed users to view our search or Gmail histories.
- rootsudo 6y agoYou assume the company is not doing this on purpose, or without intent. -- There were general flaws w/ Google & gMail to allow governments to snoop in on unencrypted communication. There probably still is.
- vkou 6y agoEthical obligation? Sure. Ethics don't put bread on the table, though. Practical obligation? You get what you pay for.
- nordsieck 6y ago> Doesn't that qualify as some sort of fraud or false advertising? Fraud typically requires some sort of mens rea. It sounds to me like Bridgefy is just really bad as making secure applications. > If not, I wonder if we need further regulation to protect the public from developers that are either incompetent or straight malicious. There is a long history of people trying to create liability for software bugs. It was a bad idea then and it's still a bad idea today.
- faeyanpiraat 6y agoWhy? If a bridge is built wrong and kills people when it collapses, someone must be at fault. What’s the difference if it happens with a virtual “thing”?
- tremon 6y agoWhat’s the difference if it happens with a virtual “thing”? Certification. Engineering is a protected profession, which means there are preconditions to working in that field and real consequences for failure. Software "engineering" has none of the preconditions.
- squiggleblaz 6y agoYou're explaining why there _is_ a difference, but not why their _should be_ a difference. 1. "It is a bad idea to make software developers liable for bugs". 2. "Why? We make engineers liable for physical malfunctions, why not make software engineers liable for software malfunctions?" 3. "Because they are uncertified" It fails to address the actual point. Is it better that software developers are uncertified? Why not introduce standards? I guess it's easier to transport software, even running software, across borders today. But even there, one could say, "If Google relocates to Canada, then stuff them - we will drop their packets at the border till they comply with domestic law." This would be a disruption of the free market, but we already admit that a free market shouldn't exist in house construction. Why should a free market exist in message distribution? The question is always, why is software on this side of the border, and bridges on that side? (My guess is that it's because few people die when your email is mishandled, but many people could die if bridges fell out of the sky whenever they got bored.)