4 ms·

Hi Thomas, OTF provides a form projects like ours can fill to commission this type of audit. So basically, we asked OTF to commission it for us and they accept

Hi Thomas, OTF provides a form projects like ours can fill to commission this type of audit. So basically, we asked OTF to commission it for us and they accepted. TextSecure, a great encryption app that I've seen you recommend, also approached OTF and obtained an audit from iSEC via this same process. However, TextSecure decided not to publish their audit results. You can read about OTF's reaction to these audits here: https://www.opentechfund.org/article/bringing-openness-security https://www.opentechfund.org/article/bringing-openness-secur...

tptacek 13y ago
I feel very comfortable recommending TextSecure. TextSecure might be the only secure messaging app I feel that way about. For whatever it's worth: I have no commercial relationship with the TextSecure team, have never worked with them, have never been paid to audit their code, and am only faintly acquainted with Moxie (I've talked to him in person to know that he's extremely pleasant and surprisingly soft spoken, but not more than that). Trevor Perrin, who worked with the TextSecure project to help design their cryptography, is someone I know a little bit better; it would be safe to say that Trevor Perrin is the only reason I know anything about cryptography, and, given a few bar napkins, I can outline a pretty convincing story that he is the root of basically every TLS vulnerability discovered after Marsh Ray found the resumption bug. TextSecure is a great project, and if anyone was debating between it and some other cryptographic messaging application, I hope I've made that decision a little easier.
- kaeporan 13y ago
  I agree! TextSecure is an excellent project. We're actually very lucky to be able to bring in Trevor Perrin this month to contribute to Cryptocat.
- marshray 13y ago
  It's really great seeing Trevor contributing on the IETF [TLS] working group mailing list.
moxie 13y ago
To clarify, these audits aren't a choice, they are a contractual obligation as part of receiving grant funding from OTF. Projects are allowed some flexibility in terms of when they schedule it, but it has to be done. I think it's a great idea. Also, during the period of time when TextSecure received audits from firms as part of an OTF grant, publishing the results was not an option that was contractually available to us. It's not something we "decided."
- kaeporan 13y ago
  Since I am familiar with the process, I know for a fact that OTF asks every project whether they'd like to publish their audits, including TextSecure. That being said, what is stopping you from publishing the audits today?
  - tptacek 13y ago
    They do that now. Dan's OTF post suggests that it wasn't always that straightforward, because the auditors had a proprietary interest in their reports.
    - kaeporan 13y ago
      Hmm. Cryptocat was actually the first ever OTF project. I believe they've always asked for the publication of audits. What I'm curious about is, why don't other projects such as TextSecure publish their audits as well? I'd certainly appreciate Moxie answering this question. The OTF blog post certainly makes good points for this to happen. I also personally believe that this reticence to publish audits is damaging to the opportunity for the honest evaluation of encryption software and the establishment of a realistic perception of encryption software. It also misleads users.
      - fit2rule 13y ago
        >What I'm curious about is, why don't other projects such as TextSecure publish their audits as well? Its embarrassing, duh.

tptacek 13y ago

I feel very comfortable recommending TextSecure. TextSecure might be the only secure messaging app I feel that way about. For whatever it's worth: I have no commercial relationship with the TextSecure team, have never worked with them, have never been paid to audit their code, and am only faintly acquainted with Moxie (I've talked to him in person to know that he's extremely pleasant and surprisingly soft spoken, but not more than that). Trevor Perrin, who worked with the TextSecure project to help design their cryptography, is someone I know a little bit better; it would be safe to say that Trevor Perrin is the only reason I know anything about cryptography, and, given a few bar napkins, I can outline a pretty convincing story that he is the root of basically every TLS vulnerability discovered after Marsh Ray found the resumption bug. TextSecure is a great project, and if anyone was debating between it and some other cryptographic messaging application, I hope I've made that decision a little easier.

kaeporan 13y ago
I agree! TextSecure is an excellent project. We're actually very lucky to be able to bring in Trevor Perrin this month to contribute to Cryptocat.
marshray 13y ago
It's really great seeing Trevor contributing on the IETF [TLS] working group mailing list.

moxie 13y ago

To clarify, these audits aren't a choice, they are a contractual obligation as part of receiving grant funding from OTF. Projects are allowed some flexibility in terms of when they schedule it, but it has to be done. I think it's a great idea. Also, during the period of time when TextSecure received audits from firms as part of an OTF grant, publishing the results was not an option that was contractually available to us. It's not something we "decided."

kaeporan 13y ago
Since I am familiar with the process, I know for a fact that OTF asks every project whether they'd like to publish their audits, including TextSecure. That being said, what is stopping you from publishing the audits today?
- tptacek 13y ago
  They do that now. Dan's OTF post suggests that it wasn't always that straightforward, because the auditors had a proprietary interest in their reports.
  - kaeporan 13y ago
    Hmm. Cryptocat was actually the first ever OTF project. I believe they've always asked for the publication of audits. What I'm curious about is, why don't other projects such as TextSecure publish their audits as well? I'd certainly appreciate Moxie answering this question. The OTF blog post certainly makes good points for this to happen. I also personally believe that this reticence to publish audits is damaging to the opportunity for the honest evaluation of encryption software and the establishment of a realistic perception of encryption software. It also misleads users.
    - fit2rule 13y ago
      >What I'm curious about is, why don't other projects such as TextSecure publish their audits as well? Its embarrassing, duh.