3 ms·

>Uploading something to a server just to share it with someone standing near you is ridiculous. Not really. For one thing, it greatly simplifies security conce

>Uploading something to a server just to share it with someone standing near you is ridiculous. Not really. For one thing, it greatly simplifies security concerns for the user without compromising anything.

stcredzero 15y ago
No, there is always a compromise in security and privacy as part of the price of convenience.
- mistercow 15y ago
  There is no additional compromise. If you go opening up sockets directly between devices, you open yourself to new exploits if you don't implement that communication correctly. If you use a server in the middle, you can just use HTTP and leverage built-in, strongly vetted web browser code that was already there. And if that code has security holes, they were already available to attackers before your app came along. It's the difference in immune system exposure between a pill and a hypodermic needle.
  - stcredzero 15y ago
    There is no additional compromise. What you say is generally true for file transfer mediated by server. I am unconvinced it's specifically true for Bump. What I said still stands: security is inversely proportional to convenience. Often security is purchased up-front, paid for by inconvenience. With Bump, you "pay" via an app which uses a coincidence in time and space to "authenticate" you. Such a transaction usually works out, and is probably no riskier than giving clerk you don't know your credit card. (Another place where one gets convenience in exchange for privacy and security.) In the case of transactions with serious downsides, should they go wrong, then users should be aware where there are compromises in security. Denying the truth of this is to spread ignorance.
    - mistercow 15y ago
      Well, I have no idea if Bump uses HTTP and such to do this via vetted methods or if it is really secure in terms of opening your device up to attack vectors. I was making the general point that transferring files between proximal devices by uploading to an intermediate server isn't inherently pointless. I do not think that Bump is attempting to be secure in terms of keeping your images from being intercepted or that it is right to even describe what it does as "authentication". It would be more accurately described as "client selection". There is a niche of insecure file transfers to be filled though. For example, I sometimes send images to people via imgur, which is completely insecure, but sometimes I'm sending images and I don't care if other people can see them. That is a very different kind of security issue than one that allows an attacker to control a device, which is the sort that I meant when I said that using an intermediate server doesn't open up security holes.

stcredzero 15y ago

No, there is always a compromise in security and privacy as part of the price of convenience.

mistercow 15y ago
There is no additional compromise. If you go opening up sockets directly between devices, you open yourself to new exploits if you don't implement that communication correctly. If you use a server in the middle, you can just use HTTP and leverage built-in, strongly vetted web browser code that was already there. And if that code has security holes, they were already available to attackers before your app came along. It's the difference in immune system exposure between a pill and a hypodermic needle.
- stcredzero 15y ago
  There is no additional compromise. What you say is generally true for file transfer mediated by server. I am unconvinced it's specifically true for Bump. What I said still stands: security is inversely proportional to convenience. Often security is purchased up-front, paid for by inconvenience. With Bump, you "pay" via an app which uses a coincidence in time and space to "authenticate" you. Such a transaction usually works out, and is probably no riskier than giving clerk you don't know your credit card. (Another place where one gets convenience in exchange for privacy and security.) In the case of transactions with serious downsides, should they go wrong, then users should be aware where there are compromises in security. Denying the truth of this is to spread ignorance.
  - mistercow 15y ago
    Well, I have no idea if Bump uses HTTP and such to do this via vetted methods or if it is really secure in terms of opening your device up to attack vectors. I was making the general point that transferring files between proximal devices by uploading to an intermediate server isn't inherently pointless. I do not think that Bump is attempting to be secure in terms of keeping your images from being intercepted or that it is right to even describe what it does as "authentication". It would be more accurately described as "client selection". There is a niche of insecure file transfers to be filled though. For example, I sometimes send images to people via imgur, which is completely insecure, but sometimes I'm sending images and I don't care if other people can see them. That is a very different kind of security issue than one that allows an attacker to control a device, which is the sort that I meant when I said that using an intermediate server doesn't open up security holes.