3 ms·

We're going to need verifiable sources for claims like that.

by nnnnni 12y ago

deleted 12y ago
[deleted]
- ChrisAntaki 12y ago
  Subtle marketing.
- deleted 12y ago
  [deleted]
- deleted 12y ago
  [deleted]
- deleted 12y ago
  [deleted]
- deleted 12y ago
  [deleted]
- superuser2 12y ago
  >sitting on a bunch of exploits This is an important point. We waste a lot of breath accusing people of having deliberately planted backdoors, and moving to alternatives that we think are too trustworthy to have backdoors in them. Whether or not the programmers behave ethically, they're still going to make mistakes and write vulnerable code like everyone else, and you'd better believe the security services (and their contractors) are looking for them.
- Bud 12y ago
  Apparently they're not that secretive, since you know about their internal tech, and you didn't work there and didn't even have an interview. Pardon me for saying so, but your original comment and your responses to various requests for substantiation don't pass the bullshit test. I'm not saying you are wrong, but I am saying you haven't remotely proven your claims to this audience.
  - mikevm 12y ago
    Ok, then don't believe me. I'm just going to move on now.
    - deleted 12y ago
      [deleted]
      - deleted 12y ago
        [deleted]
rsync 12y ago
"We're going to need verifiable sources for claims like that." This entire parent+thread argument back and forth is completely absurd. It doesn't matter whether he has sources. It doesn't matter whether that firm does or does not exist. It doesn't matter what you think of their tech or his explanation or who is who or what is what. Your phone has two[1] completely independent, full-featured computers inside of it, totally distinct from the actual computer that is your phone (that you use) that are completely out of your control, and depending on the model, have up to DMA control over your device. Whisper systems does not solve this. SecurePhoneBlahBlah does not solve this. Moxie Marlinspike does not solve this. If you have a smartphone, you are owned at a deeper level than you've ever been owned before and there is nothing you can do about it other than removing your SIM card. Game over. [1] The baseband processor and the SIM chip itself.
- foobarqux 12y ago
  Hardening the device itself is necessary but encrypted comms are just as important and arguably more pressing and easier to do. One thing at a time.
- scintill76 12y ago
  Keep in mind that even without a SIM, the GSM radio is still active[1]. From my GSM-layman perspective, it sounds safer than being in a "trusted" pairing with the network, yet since it's all closed source, you have to wonder if there are magic packets that can own your device just as badly as if you have a SIM in. [1] https://security.stackexchange.com/questions/30876/can-android-phone-running-without-sim-card-be-tracked-localized-by-police https://security.stackexchange.com/questions/30876/can-andro...
- rdtsc 12y ago
  Great point -- that is 101 of any serious security equipment validation. It is not that this software package/app or that card and so on are certified. The whole package from ground up (hardware components down to analog bits, EM emission... up to top level application get certified as secure) has to be. I can't buy some mathematically proven secure software, install it on a Chinese tablet and claim it is secure and expect it to get approved. This is a funny market as some domestic analog components are hard to find today. Micron, I think, makes some but heck most are sourced from China. This makes 'secure' hardware ridiculously expensive. As in $50k+ for switches and routers and there is a whole market specializing in it. Now, one can look at it another way -- some security is better than no security. I can see the argument on both sides. At least if NSA can record my phone calls maybe the local cops can't and so on...

We're going to need verifiable sources for claims like that.

by nnnnni 12y ago

We're going to need verifiable sources for claims like that.

deleted 12y ago

[deleted]

ChrisAntaki 12y ago
Subtle marketing.
deleted 12y ago
[deleted]
deleted 12y ago
[deleted]
deleted 12y ago
[deleted]
deleted 12y ago
[deleted]
superuser2 12y ago
>sitting on a bunch of exploits This is an important point. We waste a lot of breath accusing people of having deliberately planted backdoors, and moving to alternatives that we think are too trustworthy to have backdoors in them. Whether or not the programmers behave ethically, they're still going to make mistakes and write vulnerable code like everyone else, and you'd better believe the security services (and their contractors) are looking for them.
Bud 12y ago
Apparently they're not that secretive, since you know about their internal tech, and you didn't work there and didn't even have an interview. Pardon me for saying so, but your original comment and your responses to various requests for substantiation don't pass the bullshit test. I'm not saying you are wrong, but I am saying you haven't remotely proven your claims to this audience.
- mikevm 12y ago
  Ok, then don't believe me. I'm just going to move on now.
  - deleted 12y ago
    [deleted]
    - deleted 12y ago
      [deleted]

rsync 12y ago

"We're going to need verifiable sources for claims like that." This entire parent+thread argument back and forth is completely absurd. It doesn't matter whether he has sources. It doesn't matter whether that firm does or does not exist. It doesn't matter what you think of their tech or his explanation or who is who or what is what. Your phone has two[1] completely independent, full-featured computers inside of it, totally distinct from the actual computer that is your phone (that you use) that are completely out of your control, and depending on the model, have up to DMA control over your device. Whisper systems does not solve this. SecurePhoneBlahBlah does not solve this. Moxie Marlinspike does not solve this. If you have a smartphone, you are owned at a deeper level than you've ever been owned before and there is nothing you can do about it other than removing your SIM card. Game over. [1] The baseband processor and the SIM chip itself.

foobarqux 12y ago
Hardening the device itself is necessary but encrypted comms are just as important and arguably more pressing and easier to do. One thing at a time.
scintill76 12y ago
Keep in mind that even without a SIM, the GSM radio is still active[1]. From my GSM-layman perspective, it sounds safer than being in a "trusted" pairing with the network, yet since it's all closed source, you have to wonder if there are magic packets that can own your device just as badly as if you have a SIM in. [1] https://security.stackexchange.com/questions/30876/can-android-phone-running-without-sim-card-be-tracked-localized-by-police https://security.stackexchange.com/questions/30876/can-andro...
rdtsc 12y ago
Great point -- that is 101 of any serious security equipment validation. It is not that this software package/app or that card and so on are certified. The whole package from ground up (hardware components down to analog bits, EM emission... up to top level application get certified as secure) has to be. I can't buy some mathematically proven secure software, install it on a Chinese tablet and claim it is secure and expect it to get approved. This is a funny market as some domestic analog components are hard to find today. Micron, I think, makes some but heck most are sourced from China. This makes 'secure' hardware ridiculously expensive. As in $50k+ for switches and routers and there is a whole market specializing in it. Now, one can look at it another way -- some security is better than no security. I can see the argument on both sides. At least if NSA can record my phone calls maybe the local cops can't and so on...