4 ms·

I'm not sure if this is a joke or a legitimate concern about Threema. Care to elaborate?

giuolioN 5y ago
from Threema own homepage: "100% Swiss Made" "Threema is a true Swiss company hosting its own servers in Switzerland." After Omnisec AG and Crypto AG, how is anyone falling for that cliché again...
- dbrgn 5y ago
  In contrast to Omnisec and Crypto AG with their security by obscurity, the Threema apps are fully open source with reproducible builds: https://threema.ch/en/open-source/ https://threema.ch/en/open-source/
  - giuolioN 5y ago
    1. Only the client apps are open source, not the server side. 2. https://en.wikipedia.org/wiki/Underhanded_C_Contest https://en.wikipedia.org/wiki/Underhanded_C_Contest
    - gruez 5y ago
      So software coming out of Switzerland should be written off completely?
      - giuolioN 5y ago
        Good question. I don't know. Personally, a company that (1) works on secure encryption and (2) advertises "100% pure Swiss" is a negative signal.
        type0 5y ago
        Proton mail does that, not so sure about the negative signal but there is some merit of using a Swiss company as a honeypot.
      - polack 5y ago
        No, it should be treated as software coming from any other country. At this point it’s just silly to brand your security product as Swiss made in hopes of looking more legit. In a sense I see it negative, just like some companies brand their products with buzzwords such as AI and blockchain for no good reason other then to look cool. Makes me suspicious.
        cedex12 5y ago
        I think to the swiss market, branding it as 100% swiss is both reasonable, and a positive point. So, not silly. And for the international market, probably "swiss" is mostly to be understood as "not american/russian/chinese"
    - soziawa 5y ago
      > 1. Only the client apps are open source, not the server side. This shouldn't matter since you can't check what they are running anyways. > 2. https://en.wikipedia.org/wiki/Underhanded_C_Contest https://en.wikipedia.org/wiki/Underhanded_C_Contest This is true for any software. What is the point here?
      - giuolioN 5y ago
        My point is that selling encryption software as "secure" is a difficult position, since nobody can really guarantee the security, even with open source code. Therefore the decision to choose a particular "secure" software relies 50% on sound cryptographic practices, and 50% on reputation. Yes, reputation. Just like I wouldn't use a NSA "secure random" algorithm [1], or a product that advertises 32768 bit key encryption, I wouldn't use a product that advertises "100% pure Swiss security" on its home page. It's a negative reputation signal. [1] https://en.wikipedia.org/wiki/Dual_EC_DRBG https://en.wikipedia.org/wiki/Dual_EC_DRBG
        soziawa 5y ago
        Fair enough, but it looks like you are misquoting them. They never say anything about "100% pure Swiss security". Their messaging seems to revolve much more around an anti Silicon Valley proposition where you could substitute Swiss for European. Is Switzerland actually known to screw these kinds of things up more than other countries?
- soziawa 5y ago
  This looks more like it is supposed to mean not Silicon Valley, which is on point with the rest of their marketing and what is written about them. > Threema, die «Antithese des Silicon Valley-Modells» https://www.srf.ch/news/wirtschaft/whatsapp-alternative-threema-die-antithese-des-silicon-valley-modells https://www.srf.ch/news/wirtschaft/whatsapp-alternative-thre...
- aero-glide2 5y ago
  Reminds me of protonmail too huh

from Threema own homepage: "100% Swiss Made" "Threema is a true Swiss company hosting its own servers in Switzerland." After Omnisec AG and Crypto AG, how is anyone falling for that cliché again...

dbrgn 5y ago
In contrast to Omnisec and Crypto AG with their security by obscurity, the Threema apps are fully open source with reproducible builds: https://threema.ch/en/open-source/ https://threema.ch/en/open-source/
- giuolioN 5y ago
  1. Only the client apps are open source, not the server side. 2. https://en.wikipedia.org/wiki/Underhanded_C_Contest https://en.wikipedia.org/wiki/Underhanded_C_Contest
  - gruez 5y ago
    So software coming out of Switzerland should be written off completely?
    - giuolioN 5y ago
      Good question. I don't know. Personally, a company that (1) works on secure encryption and (2) advertises "100% pure Swiss" is a negative signal.
      - type0 5y ago
        Proton mail does that, not so sure about the negative signal but there is some merit of using a Swiss company as a honeypot.
    - polack 5y ago
      No, it should be treated as software coming from any other country. At this point it’s just silly to brand your security product as Swiss made in hopes of looking more legit. In a sense I see it negative, just like some companies brand their products with buzzwords such as AI and blockchain for no good reason other then to look cool. Makes me suspicious.
      - cedex12 5y ago
        I think to the swiss market, branding it as 100% swiss is both reasonable, and a positive point. So, not silly. And for the international market, probably "swiss" is mostly to be understood as "not american/russian/chinese"
  - soziawa 5y ago
    > 1. Only the client apps are open source, not the server side. This shouldn't matter since you can't check what they are running anyways. > 2. https://en.wikipedia.org/wiki/Underhanded_C_Contest https://en.wikipedia.org/wiki/Underhanded_C_Contest This is true for any software. What is the point here?
    - giuolioN 5y ago
      My point is that selling encryption software as "secure" is a difficult position, since nobody can really guarantee the security, even with open source code. Therefore the decision to choose a particular "secure" software relies 50% on sound cryptographic practices, and 50% on reputation. Yes, reputation. Just like I wouldn't use a NSA "secure random" algorithm [1], or a product that advertises 32768 bit key encryption, I wouldn't use a product that advertises "100% pure Swiss security" on its home page. It's a negative reputation signal. [1] https://en.wikipedia.org/wiki/Dual_EC_DRBG https://en.wikipedia.org/wiki/Dual_EC_DRBG
      - soziawa 5y ago
        Fair enough, but it looks like you are misquoting them. They never say anything about "100% pure Swiss security". Their messaging seems to revolve much more around an anti Silicon Valley proposition where you could substitute Swiss for European. Is Switzerland actually known to screw these kinds of things up more than other countries?
soziawa 5y ago
This looks more like it is supposed to mean not Silicon Valley, which is on point with the rest of their marketing and what is written about them. > Threema, die «Antithese des Silicon Valley-Modells» https://www.srf.ch/news/wirtschaft/whatsapp-alternative-threema-die-antithese-des-silicon-valley-modells https://www.srf.ch/news/wirtschaft/whatsapp-alternative-thre...
aero-glide2 5y ago
Reminds me of protonmail too huh