4 ms·

I can tell you first hand, anytime a company pays a third party to do a security assessment, the result is purely what the company wants you to see. Independent

I can tell you first hand, anytime a company pays a third party to do a security assessment, the result is purely what the company wants you to see. Independent does not mean that it wasn't influenced, just that it wasn't done by the company itself.

abecedarius 5y ago
This is false. The security company has its own reputation to mind, and its people their own conscience. (There may be cases like you're saying, but "anytime" and "purely" is completely wrong.) This is first-hand as well. But I'm not the one making a universal claim.
- fetzu 5y ago
  I think what they are trying to say is that nothing would prevent the company ordering the audit from providing the firm conducting the audit with another branch of the source code.
romanhn 5y ago
NCC Group is a legit outfit, a public company in fact, so this comment is not warranted.
- encryptluks2 5y ago
  You may not think so, but I know of equally reputable firms that have overlooked things as blatant as software that allows third parties to pipe scripts without any notification to the user. Look at the recent NPM discussion for example, and that isn't even the one I am referencing. So, yes.. they may be a "legit" outfit but that doesn't prevent them from ignoring obvious security issues.
- dancemethis 5y ago
  There is no proof what they tested was actually what's in people's phones. It's most likely a separate "cleaned-up" build/codebase for looks. And chances are against users.
  - crummy 5y ago
    If you were involved in checking their security, what would you do to verify what you're looking at is what end users are getting?
- tptacek 5y ago
  And this isn't just NCC Group; it's NCC Crypto, a particularly hardcore practice inside of NCC. Marie-Sarah Lacharité's name is on this, and she's not messing around.
sullivanmatt 5y ago
I've coordinated an NCC crypto audit, and I can assure you that is not the case.
kokx 5y ago
As a pentester at a security company doing assessments for customers, I can say that this is definitely false. We value our independence highly. It is what ultimately brings in business. It would be very bad business if one our customers gets hacked, when it was an easy vulnerability for us to find. This is the same for the NCC group here. If in a few weeks the WhatsApp e2e encryption on backups was cracked, they would look like fools. And that is not good for business.
- encryptluks2 5y ago
  It isn't merely being hacked.. if for some reason data gets exposed, it is easy to redefine the exposure point as a third party issue. For example, lets say an app allows you to install a plugin. However, the plugin API lets a third party run anything they want. I've seen firsthand how auditors will determine that it isn't the fault of the company they are auditing, irregardless that that the company provides a plugin API that allows for easy exploits because their software isn't technically the one exploiting the user.
beermonster 5y ago
Maybe you can share your experience? This doesn’t tally with my own experience and I’ve worked with many including NCC Group.
wglb 5y ago
For reputable firms, this is absolutely false. There are firms that do what you say--they write a report that says how totally wonderful it was to work with you and how wonderful it is that you quickly fixed all the informationals they found, and what a genius you were to work with them. And they happily make these reports public. Reputable firms will write savagely brutal reports when warranted.

abecedarius 5y ago

This is false. The security company has its own reputation to mind, and its people their own conscience. (There may be cases like you're saying, but "anytime" and "purely" is completely wrong.) This is first-hand as well. But I'm not the one making a universal claim.

fetzu 5y ago
I think what they are trying to say is that nothing would prevent the company ordering the audit from providing the firm conducting the audit with another branch of the source code.

romanhn 5y ago

NCC Group is a legit outfit, a public company in fact, so this comment is not warranted.

encryptluks2 5y ago
You may not think so, but I know of equally reputable firms that have overlooked things as blatant as software that allows third parties to pipe scripts without any notification to the user. Look at the recent NPM discussion for example, and that isn't even the one I am referencing. So, yes.. they may be a "legit" outfit but that doesn't prevent them from ignoring obvious security issues.
dancemethis 5y ago
There is no proof what they tested was actually what's in people's phones. It's most likely a separate "cleaned-up" build/codebase for looks. And chances are against users.
- crummy 5y ago
  If you were involved in checking their security, what would you do to verify what you're looking at is what end users are getting?
tptacek 5y ago
And this isn't just NCC Group; it's NCC Crypto, a particularly hardcore practice inside of NCC. Marie-Sarah Lacharité's name is on this, and she's not messing around.

sullivanmatt 5y ago

I've coordinated an NCC crypto audit, and I can assure you that is not the case.

kokx 5y ago

As a pentester at a security company doing assessments for customers, I can say that this is definitely false. We value our independence highly. It is what ultimately brings in business. It would be very bad business if one our customers gets hacked, when it was an easy vulnerability for us to find. This is the same for the NCC group here. If in a few weeks the WhatsApp e2e encryption on backups was cracked, they would look like fools. And that is not good for business.

encryptluks2 5y ago
It isn't merely being hacked.. if for some reason data gets exposed, it is easy to redefine the exposure point as a third party issue. For example, lets say an app allows you to install a plugin. However, the plugin API lets a third party run anything they want. I've seen firsthand how auditors will determine that it isn't the fault of the company they are auditing, irregardless that that the company provides a plugin API that allows for easy exploits because their software isn't technically the one exploiting the user.

beermonster 5y ago

Maybe you can share your experience? This doesn’t tally with my own experience and I’ve worked with many including NCC Group.

wglb 5y ago

For reputable firms, this is absolutely false. There are firms that do what you say--they write a report that says how totally wonderful it was to work with you and how wonderful it is that you quickly fixed all the informationals they found, and what a genius you were to work with them. And they happily make these reports public. Reputable firms will write savagely brutal reports when warranted.