4 ms·

It's not possible for a web application to be secure against the host of the web application. If the host renders the HTML, then they need to access the user's

It's not possible for a web application to be secure against the host of the web application. If the host renders the HTML, then they need to access the user's data. If the host serves the Javascript, then they have the opportunity to acceess the user's data. If the user doesn't manage their own private keys, then the host manages them and can compromise them. Arguing that {Google,Yahoo,Facebook,LinkedIn} should implement secure communication is equivalent to arguing that they should shut down their existing products in favor of secure client-side implementations. The moment they do this, the resulting product gap will be filled by some other company and nothing will have changed. The corollary is that any web-based service that claims to offer secure communication is almost certainly not doing anything of the sort, and should be treated with great suspicion.

Zigurd 13y ago
Most of these companies provide some client-side software. Google provides a whole OS, it's middleware layer, and many apps published open source. The Android SDK runs on all three major PC OSs, as does Google Earth. Chrome runs on all the major PC OSs, and has an open source "sister" project Chromium. Web software is convenient, for sure, but it isn't so difficult to run ad-supported services with client-side software.
- jmillikin 13y ago
  Lets consider Gmail as an example. It's trivially easy to configure a local Gmail client. Install Thunderbird, type in your username and password, and you're good to go. The result is a Gmail experience with an excellent UI, no ads, and the user is running only open-source software. Installing the Enigmail extension, GPG, and generating a GPG key provides a secured communication channel. The user need only tick a checkbox to send emails that are impervious to known interception methods. Thus it's already possible to use Gmail for secure communications. No changes on Google's part are required to enable secure emails in Gmail. So what are you actually asking for? It sounds like what you're saying is that Google ought to shut down the Gmail web UI because you don't think hosted services are sufficiently secure. But the thing is, almost nobody (excluding HN) actually cares. If Gmail moved to a secure model tomorrow, it would be effectively the same as shutting down the service because the userbase would migrate to Yahoo or Hotmail overnight. What benefit has the new "secure" Gmail then achieved?
  - Zigurd 13y ago
    Using Thunderbird is not a solution. If Google or any of the other services had their own client that properly integrated with back-end services like key exchange, key signing, etc. you would not have to understand and implement identity verification yourself. You are setting up some straw men for demolition. As Skype showed, before it was nerfed, there is no need for a client interface, especially a mobile client interface not to support security that is so easy that it is equivalent to an unsecured product.
    - jmillikin 13y ago
      > If Google or any of the other services had their own > client that properly integrated with back-end services > like key exchange, key signing, etc. you would not have > to understand and implement identity verification yourself. If key exchange and verification were handled by a third-party service, then a compromise of that service would threaten the security of all communications. To be secure, key exchange and verification must be handled offline at the level of individual users. Pre-acquisition Skype was not a secure communications system, any more than iMessage or Hangouts are today. If you believe it was, then you have not spent sufficient time considering how to compromise such a system.
      - Zigurd 13y ago
        Apart from meeting in person and exchanging keys, what other way do people have of finding someone else's public key? Securing that is what key signing and web-of-trust are for. Also, Skype in unlike iMessage or Hangouts in that messages traversed nodes that could capture and attack traffic. Skype had security requirements these other services did not have. A modern, verifiable service could be built that, to end users, resembled Skype in simplicity. Or, for that matter, Hangouts could open source their client and enable verifiable security that, to the end-user, would be no more complicated than using Hangouts is currently.

Zigurd 13y ago

Most of these companies provide some client-side software. Google provides a whole OS, it's middleware layer, and many apps published open source. The Android SDK runs on all three major PC OSs, as does Google Earth. Chrome runs on all the major PC OSs, and has an open source "sister" project Chromium. Web software is convenient, for sure, but it isn't so difficult to run ad-supported services with client-side software.

jmillikin 13y ago
Lets consider Gmail as an example. It's trivially easy to configure a local Gmail client. Install Thunderbird, type in your username and password, and you're good to go. The result is a Gmail experience with an excellent UI, no ads, and the user is running only open-source software. Installing the Enigmail extension, GPG, and generating a GPG key provides a secured communication channel. The user need only tick a checkbox to send emails that are impervious to known interception methods. Thus it's already possible to use Gmail for secure communications. No changes on Google's part are required to enable secure emails in Gmail. So what are you actually asking for? It sounds like what you're saying is that Google ought to shut down the Gmail web UI because you don't think hosted services are sufficiently secure. But the thing is, almost nobody (excluding HN) actually cares. If Gmail moved to a secure model tomorrow, it would be effectively the same as shutting down the service because the userbase would migrate to Yahoo or Hotmail overnight. What benefit has the new "secure" Gmail then achieved?
- Zigurd 13y ago
  Using Thunderbird is not a solution. If Google or any of the other services had their own client that properly integrated with back-end services like key exchange, key signing, etc. you would not have to understand and implement identity verification yourself. You are setting up some straw men for demolition. As Skype showed, before it was nerfed, there is no need for a client interface, especially a mobile client interface not to support security that is so easy that it is equivalent to an unsecured product.
  - jmillikin 13y ago
    > If Google or any of the other services had their own > client that properly integrated with back-end services > like key exchange, key signing, etc. you would not have > to understand and implement identity verification yourself. If key exchange and verification were handled by a third-party service, then a compromise of that service would threaten the security of all communications. To be secure, key exchange and verification must be handled offline at the level of individual users. Pre-acquisition Skype was not a secure communications system, any more than iMessage or Hangouts are today. If you believe it was, then you have not spent sufficient time considering how to compromise such a system.
    - Zigurd 13y ago
      Apart from meeting in person and exchanging keys, what other way do people have of finding someone else's public key? Securing that is what key signing and web-of-trust are for. Also, Skype in unlike iMessage or Hangouts in that messages traversed nodes that could capture and attack traffic. Skype had security requirements these other services did not have. A modern, verifiable service could be built that, to end users, resembled Skype in simplicity. Or, for that matter, Hangouts could open source their client and enable verifiable security that, to the end-user, would be no more complicated than using Hangouts is currently.