2 ms·

I'd take away "security is complicated and multi-faceted", not "fake". It's not a black and white of "an app is truly secure" or "an app is truly insecure", bu

I'd take away "security is complicated and multi-faceted", not "fake". It's not a black and white of "an app is truly secure" or "an app is truly insecure", but rather a continuum from "secure enough in practice for this threat model and purpose" to "an insecure mess". Like, plenty of websites and apps have launched, existed for years, and then shutdown without a single security incident. In those cases, surely the app was secure, right? At least secure enough? Signal so far has been "secure enough in practice" for most people, while iMessage has in practice been "secure enough if you're a normal person, but with serious security issues for anyone who might be subject to serious targeted attacks" Say more about what you mean by "no app is truly secure"? Especially in the context of signal?

zwnow 2y ago
Im just saying that all it takes is one employee to click onto the wrong URL to breach your apps security. I am not talking about the app itself. You can have all the security implemented the world has to offer and yet you cant get rid of human errors.
- TheDong 2y ago
  I'm totally not understanding what you're saying then. > Im just saying that all it takes is one employee to click onto the wrong URL to breach your apps security Pretend I'm a signal employee. What link can I click that breaches the app's security? They don't store unencrypted data, pushing source code changes requires review, releases are signed and a single employee can't compromise the release process, so I'm missing how one employee being compromised could lead to the signal app breaching signal's security. Also, in practice, how often are apps compromised from a phishing attack? I don't even really see news reports on that, so I'm curious if you're operating off like a specific case or something.
  - zwnow 2y ago
    Some malicious mail that grants remote access to the employees device? Its not that hard to understand.
    - dboreham 2y ago
      Actually it is hard to understand because that employee's device isn't an attack vector.
      - zwnow 2y ago
        It absolutely is. Every connection to your app also is a attack vector.

zwnow 2y ago

Im just saying that all it takes is one employee to click onto the wrong URL to breach your apps security. I am not talking about the app itself. You can have all the security implemented the world has to offer and yet you cant get rid of human errors.

TheDong 2y ago
I'm totally not understanding what you're saying then. > Im just saying that all it takes is one employee to click onto the wrong URL to breach your apps security Pretend I'm a signal employee. What link can I click that breaches the app's security? They don't store unencrypted data, pushing source code changes requires review, releases are signed and a single employee can't compromise the release process, so I'm missing how one employee being compromised could lead to the signal app breaching signal's security. Also, in practice, how often are apps compromised from a phishing attack? I don't even really see news reports on that, so I'm curious if you're operating off like a specific case or something.
- zwnow 2y ago
  Some malicious mail that grants remote access to the employees device? Its not that hard to understand.
  - dboreham 2y ago
    Actually it is hard to understand because that employee's device isn't an attack vector.
    - zwnow 2y ago
      It absolutely is. Every connection to your app also is a attack vector.