4 ms·

Legal intercept legislation would likely require them to patch customer systems to allow the reporting of the key.

anaphor 13y ago
If you're really paranoid then you should build the code yourself from github, not just install the version on the play store.
- bduerst 13y ago
  In a compiler that was compiled by someone else. /tinfoil hat
  - TacticalCoder 13y ago
    That's why in the future we'll be using compilers which are open-source and using deterministic builds and double-compilation (or "n-compilation") : )
    - sneak 13y ago
      I recently discovered that there are no basic deterministic OS image builds (like a bootable .iso) with just a toolchain and wget and gpg and a shell. I was surprised; seems like a good basic target.
      - LeonidasXIV 13y ago
        Debian has an ongoing project for this, https://wiki.debian.org/ReproducibleBuilds https://wiki.debian.org/ReproducibleBuilds driven by Lunar from the Tor project.
albeertoni 13y ago
Intercept legislation that applies to makers of non-interconnected (i.e., doesn't touch the PSTN) chat functions is extremely unlikely. I'm guessing whisper falls into that category. I use Silent Circle myself, but I assume on Whisper you can't just type in a normal mobile number and have the chat message go to the right person. If you can, then those chats at least are subject to intercept, and maybe the other chats (whisper-whisper chats) are too. I don't remember how all those rules shake out/how courts have decided.
pbhjpbhj 13y ago
Wouldn't the relevant TLA just tell Google to enable the backdoor and then sniff the necessary keys from the device ...
- privong 13y ago
  Upon compiling TextSecure from source and installing it on my phone (I don't have the play store), I've discovered it requires the Play Store to do the "iMessage" style messaging over data. I guess the encryption is still done on-phone before being sent through whatever data API, but I still wonder if that (the play store being installed) might enable key-sniffing? Perhaps that's somewhat negated by users having a strong passphrase though?

If you're really paranoid then you should build the code yourself from github, not just install the version on the play store.

bduerst 13y ago
In a compiler that was compiled by someone else. /tinfoil hat
- TacticalCoder 13y ago
  That's why in the future we'll be using compilers which are open-source and using deterministic builds and double-compilation (or "n-compilation") : )
  - sneak 13y ago
    I recently discovered that there are no basic deterministic OS image builds (like a bootable .iso) with just a toolchain and wget and gpg and a shell. I was surprised; seems like a good basic target.
    - LeonidasXIV 13y ago
      Debian has an ongoing project for this, https://wiki.debian.org/ReproducibleBuilds https://wiki.debian.org/ReproducibleBuilds driven by Lunar from the Tor project.

albeertoni 13y ago

Intercept legislation that applies to makers of non-interconnected (i.e., doesn't touch the PSTN) chat functions is extremely unlikely. I'm guessing whisper falls into that category. I use Silent Circle myself, but I assume on Whisper you can't just type in a normal mobile number and have the chat message go to the right person. If you can, then those chats at least are subject to intercept, and maybe the other chats (whisper-whisper chats) are too. I don't remember how all those rules shake out/how courts have decided.

pbhjpbhj 13y ago

Wouldn't the relevant TLA just tell Google to enable the backdoor and then sniff the necessary keys from the device ...

privong 13y ago
Upon compiling TextSecure from source and installing it on my phone (I don't have the play store), I've discovered it requires the Play Store to do the "iMessage" style messaging over data. I guess the encryption is still done on-phone before being sent through whatever data API, but I still wonder if that (the play store being installed) might enable key-sniffing? Perhaps that's somewhat negated by users having a strong passphrase though?