4 ms·
I'm not saying this in humor, I'm genuinely curious ... how do they handle Signal's absence of FIPS validation and FedRamp certification? Signal isn't even capa
by colmmacc 2y ago
I'm not saying this in humor, I'm genuinely curious ... how do they handle Signal's absence of FIPS validation and FedRamp certification? Signal isn't even capable of being FIPS validated, the core cryptography is off NIST piste.
- dmix 2y agoThis failure should highlight the primary risk in infosec is always adherence by the human element, not whether you spent an extra $10B on a gov software contractor who checked the right checkboxes.
- jaredledvina 2y ago100% agree, as someone subjected to the trials of FedRAMP High and DoD IL-5 audits, how is Signal the go to when there's programs for getting SaaS services approved for unclassified communications already in place. Framed selfishly, why the heck are we even bothering with these frameworks if folks are just yolo'ing messages onto Signal? If we've got to suffer through FIPS-validated crypto, DISA STIGs, etc. shouldn't the messaging platform used at least meet par?
- derbOac 2y agoThere was a lot of chatter on Bluesky earlier about what devices and systems were and should have been used in this particular case, and whether or not some of the testimony given was truthful or accurate. https://www.cbsnews.com/news/nsa-signal-app-vulnerabilities-before-houthi-strike-chat/ https://www.cbsnews.com/news/nsa-signal-app-vulnerabilities-... This Intercept article I think is a little misleading as it's taking something said in testimony at face value, and not really contextualizing it well. Some of these issues are raised in the piece a bit, but to me it reads a little strangely, like a lot of context and background is missing.
- cakealert 2y agoThere are certain times where compliance is waved off for the simple reason that even the enforcers don't comply and no one wants to inconvenience themselves.