5 ms·

How can closed source software ever prove that the communication on the wire is actually secure? I guess since gmail is JS on the client side, some smart progr

How can closed source software ever prove that the communication on the wire is actually secure? I guess since gmail is JS on the client side, some smart programmer can unpack the code and show that the crypto is sound. But until then it's only claims

throwaway0x7E6 4y ago
an audit like that doesn't even matter when the client is hosted remotely
- Closi 4y ago
  It's not, the client is local.
- EnigmaCurry 4y ago
  I don't think it can be done today, with the remote domain (gmail.com) controlling all the JS on the page. But maybe future hardened browsers could attach a textinput box directly to a sandboxed service worker not communicable with the rest of the JS code? The worker could be updated at a different cadence than the rest of the client, and be audited separately, and with the script contents hashed? We rely on browser sandboxing of different domains today, why not extend it to different parts of the same page? Its probably a hard problem still.
progbits 4y ago
Closed source or not, the trust comes from provider serving you the same payload. Even if it was open source it could be changed. So if you care about that you can't trust any webmail. Instead use Thunderbird/mutt/whatever and GPG/PGP, like you could for the last 20+ years.
- upofadown 4y ago
  You could at least use a browser plugin like Mailvelope...
brookst 4y ago
Open source has the same problem. You can review source, great, but you can’t prove it’s the same source that’s executing. From evil compilers to source/binary modification in flight to supply chain attacks, it is probably impossible to prove secure operation of open (or closed) source. All we have are mitigations and risk reduction. If the bar is provably perfect security, nothing can meet it.
- fsflover 4y ago
  You can verify that the executable came from the same sources: https://reproducible-builds.org/ https://reproducible-builds.org/.
  - okdood64 4y ago
    How do I obtain the all the executables in the chain?
  - brookst 4y ago
    How do you know the tools you use to verify weren’t modified in memory? Seriously. It is not possible to prove 100% security. Between human, electrical, hardware, firmware, and software vulnerabilities, there is always a gap.
    - fsflover 4y ago
      Nothing is ever 100%, but some things are good enough. By the way, I am using Qubes OS for reasonable security.
      - brookst 4y ago
        You’ve absolutely illustrated my two points: 1) nothing is ever 100%, and 2) everyone thinks their personal choices are the ideal; anything less secure is playing with fire, anything more secure is unnecessary overkill.
        4y ago

throwaway0x7E6 4y ago

an audit like that doesn't even matter when the client is hosted remotely

Closi 4y ago
It's not, the client is local.
EnigmaCurry 4y ago
I don't think it can be done today, with the remote domain (gmail.com) controlling all the JS on the page. But maybe future hardened browsers could attach a textinput box directly to a sandboxed service worker not communicable with the rest of the JS code? The worker could be updated at a different cadence than the rest of the client, and be audited separately, and with the script contents hashed? We rely on browser sandboxing of different domains today, why not extend it to different parts of the same page? Its probably a hard problem still.

progbits 4y ago

Closed source or not, the trust comes from provider serving you the same payload. Even if it was open source it could be changed. So if you care about that you can't trust any webmail. Instead use Thunderbird/mutt/whatever and GPG/PGP, like you could for the last 20+ years.

upofadown 4y ago
You could at least use a browser plugin like Mailvelope...

brookst 4y ago

Open source has the same problem. You can review source, great, but you can’t prove it’s the same source that’s executing. From evil compilers to source/binary modification in flight to supply chain attacks, it is probably impossible to prove secure operation of open (or closed) source. All we have are mitigations and risk reduction. If the bar is provably perfect security, nothing can meet it.

fsflover 4y ago
You can verify that the executable came from the same sources: https://reproducible-builds.org/ https://reproducible-builds.org/.
- okdood64 4y ago
  How do I obtain the all the executables in the chain?
- brookst 4y ago
  How do you know the tools you use to verify weren’t modified in memory? Seriously. It is not possible to prove 100% security. Between human, electrical, hardware, firmware, and software vulnerabilities, there is always a gap.
  - fsflover 4y ago
    Nothing is ever 100%, but some things are good enough. By the way, I am using Qubes OS for reasonable security.
    - brookst 4y ago
      You’ve absolutely illustrated my two points: 1) nothing is ever 100%, and 2) everyone thinks their personal choices are the ideal; anything less secure is playing with fire, anything more secure is unnecessary overkill.
      - 4y ago