4 ms·

Snapchat is neither private or secure. It creates the illusion of it but its illusion is extraordinarily thin. Please don't perpetuate the myth they are priva

Snapchat is neither private or secure. It creates the illusion of it but its illusion is extraordinarily thin. Please don't perpetuate the myth they are private or secure. http://www.informationweek.com/software/social/5-ways-snapchat-violated-your-privacy-security/d/d-id/1251175 http://www.informationweek.com/software/social/5-ways-snapch... http://www.nbcnews.com/tech/security/oh-snap-snapchat-fixes-flaw-let-attackers-shut-down-phones-n26706 http://www.nbcnews.com/tech/security/oh-snap-snapchat-fixes-... http://gibsonsec.org/snapchat/fulldisclosure/ http://gibsonsec.org/snapchat/fulldisclosure/ http://money.cnn.com/2012/12/28/technology/security/snapchat-security-flaw/ http://money.cnn.com/2012/12/28/technology/security/snapchat... etc.

walterbell 12y ago
I'm well aware they are technically neither private nor secure. But for users who don't want their parents / school / employers to have an easily accessible record of their communication, Snapchat is an improvement on Facebook (see http://www.danah.org/itscomplicated/ http://www.danah.org/itscomplicated/), if one defines a security failure as "parent asks question about facebook post". User perception of relative privacy has lead Snapchat to the point of having a large user base and significant funding, i.e. it demonstrates user demand for privacy. The quality of Snapchat's product is another matter, but they now have the resources to be private and secure, if they so choose. TextSecure is doing good work in private messaging, hopefully their iOS version will raise the bar for everyone.
- opendais 12y ago
  If you define security failure as "keeping things from your parents", ya I suppose that might qualify. However, when all it takes is someone deciding they want to copy the picture and spread it...I think it results in a dangerous situation where the "customer" thinks its secure/safe but the reality is it isn't. I've seen so much damage caused by that sort of event that I take the idea that people consider such things "secure" or "private" offensive.
  - walterbell 12y ago
    It is absolutely dangerous. As is crossing the road. The security community is culpable for failing to find meaningful middle grounds that are acceptable to customers and which generate the revenue that can fund the development of strong security. As a result, non-infosec people build "good enough for naive users", get traction and fix only when forced by a breach or failure. There are two ways to find (in the Steve Blank customer discovery / product management sense) a profitable middle ground: (1) start out with a weak security posture until public breaches force improvements to a stronger "good enough" (2) start out with strong architecture and consciously weaken to find a "good enough" point that is usable by a mass audience. What alternative do Snapchat customers have today? TextSecure is subsidized by Twitter, let's hope Twitter has a long future. VC-backed Wickr is going after the financial sector. We need more security people who are not offended by scenario #2, because their distaste for the option makes them most qualified to make difficult compromises and disclose the associated risks so that customers can make informed choices.

walterbell 12y ago

I'm well aware they are technically neither private nor secure. But for users who don't want their parents / school / employers to have an easily accessible record of their communication, Snapchat is an improvement on Facebook (see http://www.danah.org/itscomplicated/ http://www.danah.org/itscomplicated/), if one defines a security failure as "parent asks question about facebook post". User perception of relative privacy has lead Snapchat to the point of having a large user base and significant funding, i.e. it demonstrates user demand for privacy. The quality of Snapchat's product is another matter, but they now have the resources to be private and secure, if they so choose. TextSecure is doing good work in private messaging, hopefully their iOS version will raise the bar for everyone.

opendais 12y ago
If you define security failure as "keeping things from your parents", ya I suppose that might qualify. However, when all it takes is someone deciding they want to copy the picture and spread it...I think it results in a dangerous situation where the "customer" thinks its secure/safe but the reality is it isn't. I've seen so much damage caused by that sort of event that I take the idea that people consider such things "secure" or "private" offensive.
- walterbell 12y ago
  It is absolutely dangerous. As is crossing the road. The security community is culpable for failing to find meaningful middle grounds that are acceptable to customers and which generate the revenue that can fund the development of strong security. As a result, non-infosec people build "good enough for naive users", get traction and fix only when forced by a breach or failure. There are two ways to find (in the Steve Blank customer discovery / product management sense) a profitable middle ground: (1) start out with a weak security posture until public breaches force improvements to a stronger "good enough" (2) start out with strong architecture and consciously weaken to find a "good enough" point that is usable by a mass audience. What alternative do Snapchat customers have today? TextSecure is subsidized by Twitter, let's hope Twitter has a long future. VC-backed Wickr is going after the financial sector. We need more security people who are not offended by scenario #2, because their distaste for the option makes them most qualified to make difficult compromises and disclose the associated risks so that customers can make informed choices.