3 ms·

If a communication device is favoured by criminals, I kinda want in. I mean, we're talking people who have very good reasons to avoid detection, right? Maybe th

If a communication device is favoured by criminals, I kinda want in. I mean, we're talking people who have very good reasons to avoid detection, right? Maybe there's something good in those phones? (Not that I would trust the criminal's supply chain, mind you.)

costco 4y ago
You would think so but most of them have terrible security: https://threatpost.com/europol-arrests-cracked-sky-ecc/164744/ https://threatpost.com/europol-arrests-cracked-sky-ecc/16474... https://www.wired.com/story/encrochat-phone-police-hacking-encryption-drugs/ https://www.wired.com/story/encrochat-phone-police-hacking-e... https://arstechnica.com/information-technology/2018/11/police-decrypt-258000-messages-after-breaking-pricey-ironchat-crypto-app/ https://arstechnica.com/information-technology/2018/11/polic... https://www.engadget.com/fbi-encrypted-chat-app-anom-criminals-102001487.html https://www.engadget.com/fbi-encrypted-chat-app-anom-crimina...
- loup-vaillant 4y ago
  Well I tried… Thanks for the links.
TeMPOraL 4y ago
> If a communication device is favoured by criminals, I kinda want in. (...) (Not that I would trust the criminal's supply chain, mind you.) Here's an extra challenge: how do you know that a given device is "favoured by criminals"? Where did you acquire that knowledge, and how sure are you of it? If it's just from randos on the Internet, even if you aggregated opinions of many such randos, it's likely the result is still wrong. Or worse, a honeypot. On the other hand, if you honestly have it on good authority from actual users with skin in the game... then you're probably already in - on the crime part. EDIT: And, on the off chance the actual preference of experienced criminals becomes public knowledge, guess which tool the law enforcement will focus on breaking and circumventing? This kind of security has an anti-inductive quality similar to that of the stock market: if you learn some information that could let you beat the market, most likely the information is either wrong, or has already been exploited to the point of diminishing returns.
- loup-vaillant 4y ago
  You make good points, I think I agree with them. I started this tongue in cheek, but if I'm being serious here, my actual method is building genuine expertise in infosec and cryptography, to the point where I can make my own stuff. Which I did: https://monocypher.org https://monocypher.org I was dissatisfied with the state of the art, which did not seem to provide the simple solutions I thought the world deserves. (My subject at the time was file encryption.) Even cryptographic libraries left something to be desired, including libsodium itself, despite the ton of respect I have for this library. So I experimented with my own thing, and ended up finding a sweet spot between portability, performance, and simplicity. A surprising benefit was the embedded market: Monocypher can go where libsodium doesn't, and is to this day one of the fastest cryptographic libraries on micro-controllers. Long story short, I don't have to rely on some reputation game to evaluate the security of something. I have the expertise to look at it more directly, and if need be do much of it myself. I have, and will, but I do hope the world doesn't turn so badly that my own expertise becomes more reliable than good external sources.

costco 4y ago

You would think so but most of them have terrible security: https://threatpost.com/europol-arrests-cracked-sky-ecc/164744/ https://threatpost.com/europol-arrests-cracked-sky-ecc/16474... https://www.wired.com/story/encrochat-phone-police-hacking-encryption-drugs/ https://www.wired.com/story/encrochat-phone-police-hacking-e... https://arstechnica.com/information-technology/2018/11/police-decrypt-258000-messages-after-breaking-pricey-ironchat-crypto-app/ https://arstechnica.com/information-technology/2018/11/polic... https://www.engadget.com/fbi-encrypted-chat-app-anom-criminals-102001487.html https://www.engadget.com/fbi-encrypted-chat-app-anom-crimina...

loup-vaillant 4y ago
Well I tried… Thanks for the links.

TeMPOraL 4y ago

> If a communication device is favoured by criminals, I kinda want in. (...) (Not that I would trust the criminal's supply chain, mind you.) Here's an extra challenge: how do you know that a given device is "favoured by criminals"? Where did you acquire that knowledge, and how sure are you of it? If it's just from randos on the Internet, even if you aggregated opinions of many such randos, it's likely the result is still wrong. Or worse, a honeypot. On the other hand, if you honestly have it on good authority from actual users with skin in the game... then you're probably already in - on the crime part. EDIT: And, on the off chance the actual preference of experienced criminals becomes public knowledge, guess which tool the law enforcement will focus on breaking and circumventing? This kind of security has an anti-inductive quality similar to that of the stock market: if you learn some information that could let you beat the market, most likely the information is either wrong, or has already been exploited to the point of diminishing returns.

loup-vaillant 4y ago
You make good points, I think I agree with them. I started this tongue in cheek, but if I'm being serious here, my actual method is building genuine expertise in infosec and cryptography, to the point where I can make my own stuff. Which I did: https://monocypher.org https://monocypher.org I was dissatisfied with the state of the art, which did not seem to provide the simple solutions I thought the world deserves. (My subject at the time was file encryption.) Even cryptographic libraries left something to be desired, including libsodium itself, despite the ton of respect I have for this library. So I experimented with my own thing, and ended up finding a sweet spot between portability, performance, and simplicity. A surprising benefit was the embedded market: Monocypher can go where libsodium doesn't, and is to this day one of the fastest cryptographic libraries on micro-controllers. Long story short, I don't have to rely on some reputation game to evaluate the security of something. I have the expertise to look at it more directly, and if need be do much of it myself. I have, and will, but I do hope the world doesn't turn so badly that my own expertise becomes more reliable than good external sources.