4 ms·
Port bitmessage to Android then release it alpha and then wait 2-3 years to see if anything goes wrong. Then release it beta with gigantic warnings. I hope thi
by dobbsbob 13y ago
Port bitmessage to Android then release it alpha and then wait 2-3 years to see if anything goes wrong. Then release it beta with gigantic warnings.
I hope this isn't another Jabber/OTR implementation because those would be full of metadata the NSA wants in order to identify social networks. Once identified, and if they look interesting enough they want to listen in, they would then go to town on your device, car, or home with surveillance equip to read your screen as you type, or just sneak inside the project's servers using nginx shell exploits or linux/bsd exploits none of us know about yet to inject code into the apk for download which will still pass signature tests. http://www.pcworld.idg.com.au/article/512362/proof-of-concept_exploit_available_android_app_signature_check_vulnerability/ http://www.pcworld.idg.com.au/article/512362/proof-of-concep...
Another problem is most devices are carrier built so can't be trusted not to have a new CarrierIQ-like rootkit, and they can just send an OTA update that can basically do whatever it is they want it to do including recording the screen whenever this app get's turned on. Maybe these carriers leave their build keys lying around and the NSA gets a hold of them and sends you their own OTA update. Or maybe their agents volunteer to work on this project and sabotage it like the NIST Special Publication 800-90 that recommended an inferior deterministic random bit generator that researchers assumed were deliberately made standard so a federal skeleton key could determine the random numbers and unlock the encryption.
The best NSA proof cell accessory is thermite to melt your phone so you stop using it to communicate stuff the NSA might want to find out. If you're not a terrorist, Snowden, or Assange then you can use Gibberbot only with a .onion jabber server because of SSL problems, and even then your device is still wide open, and Tor sacrifices traffic analysis timing prevention for usability so technically still vuln to metadata analysis by gigantic spy agencies like the NSA
- conformal 13y agothere is no such thing as a secure cellphone platform, at least for us non-govt folk. expecting your comms to be secure on a cellphone because you use some app is super naive. as dobbsbob points out, your phone is likely ownable/backdoored by (1) the manufacturer, (2) the OS maker, (3) the ISP and (4) the local intelligence services. the best way to keep anything secure as it relates to your phone is to not use it. in fact, keep your phone well away from where you work and have important conversations. there is a reason certain ppl are not allowed to bring their cellphones to work: it's because they're not even remotely secure.