4 ms·
> NSA Revelations Cast Doubt on the Entire Tech Industry I'd say it's true for everything that's not open-source and doesn't allow for proper public key encryp
by frank_boyd 13y ago
> NSA Revelations Cast Doubt on the Entire Tech Industry
I'd say it's true for everything that's not open-source and doesn't allow for proper public key encryption. (Assuming that public key encryption is still holding up.)
- devx 13y agoExcept now we also have to be much more vigilant about open source standards, too. For example, now I worry the security model of WebRTC has been compromised by NSA, because it has the potential to offer very secure P2P conversations to the masses (at least 1 billion users - and that's before IE even adopts it in IE12, hopefully).
- frank_boyd 13y agoIf your goal is to communicate securely, it's preferable to encrypt using a native (and obviously open-source) application (and OS) and to avoid the browser, for the time being.
- pjmlp 13y agoIs to meet in person in a secure place. Whatever channel you use might be compromised, if you cannot control both ends.
- Gravityloss 13y agoIf you have an Android phone, Google tracks your location (GPS, cell towers and maps-wardriving-provided Wifi hotspots at least), so it's probably easy to see who met who. Maybe they also save seen bluetooth devices. Phones don't record conversations in the pocket by default yet, but it's not inconceivable when computing efficiency improves that recording is always on, and keyword data is saved by default. Handy if it can creates calendar markings from verbal agreements... And with Glass, video too. So meeting in person is getting less secure as well.
- frank_boyd 13y ago> And with Glass, video too. Glass adds the perversion that you don't have your say regarding surveillance of society, anymore. Your "friends" will do it for you. Only solution: Get vocal whenever you see somebody wearing Glass.
- Peaker 13y agoMost phones let you pull the battery out, still. Even when they don't, it's probably easy enough to disconnect the battery on your own.
- infocollector 13y agoDoes anyone know how to disable WebRTC in the browser ? (Apart from downgrading of course)
- TsiCClawOfLight 13y agoI assume there is a chrome Flag for it, and a config option for firefox?
- nwh 13y agoIt goes deeper than that. If I owned any server hardware, chances are it would be in a rack in a datacenter. What's to say somebody hasn't walked in, flipped a badge and taken my SSL private keys? In fact, that's quite probable.
- frank_boyd 13y agoTrue. You should host in a non-US and non-EU country (i.e. Switzerland) to be able to sleep better.
- iaskwhy 13y agoAny recommendation?
- infocollector 13y agoBeware: If you do, it is going to be even more easier to crack.
- frank_boyd 13y agoHaven't tested them yet, but they seem to be among the bigger (independent) ones: http://www.green.ch/en-us/home.aspx http://www.green.ch/en-us/home.aspx
- jaggederest 13y agoYou're thinking too small scale. Certificate Authorities are almost certainly compromised. Why bother with one at a time when you can just force the vendor to hand the keys to the castle over? Sign your own certs, MITM anyone you want.
- nwh 13y agoMITM isn't the issue, we assume for the most part that the NSA is a passive eavesdropper. Easier in that situation to sniff and decode with a stolen secret, rather than rewriting traffic on the fly.
- Tyrannosaurs 13y agoI'm thinking there are questions about even open source projects. Who is to say they've not been covertly influencing them, or even running them altogether? I'd certainly agree that open source offers the potential for independent verification of its nature, how many of these applications and libraries have been examined in detail by those who have the deep expertise to spot a subtle flaw and how many are just taken at face value? The whole thing is frankly a cluster frak.