13 ms·
Secure Messaging Scorecard
- t3ra 12y agoI wonder why they didn't include telegram?
- diafygi 12y agoIt's there if you select "All Tools" instead of "Featured Tools" in the dropdown.
- chmars 12y agoThanks! (Why isn't Telegram featured?)
- tptacek 12y agoTelegram? They buried PGP.
- Mandatum 12y agoA blog post on the protocol built by Telegram: http://unhandledexpression.com/2013/12/17/telegram-stand-back-we-know-maths/ http://unhandledexpression.com/2013/12/17/telegram-stand-bac... sigh
- swordswinger12 12y agoSide rant: I really hate that people conflate expertise in math with expertise in crypto. Dozens of completely useless cryptosystems are published every year by talented mathematicians.
- sabret00the 12y agoIt's a good question. Would be nice if the page could've details what makes the criteria for being featured.
- justcommenting 12y agoGoogle Hangouts, iMessage, fb Chat "Audited"? Wish they could point readers to those audits.. Skype "encrypted so the provider can't read it" even though MS is a known NSA PRISM partner? Recent disclosures quite strongly suggest otherwise. Also weird that they didn't sort these options by ranking. it took me a while to realize that they weren't displaying everything ranked by default (or the "winners"). to see that, choose 'all tools' from the drop-down.
- JshWright 12y agoYeah, there are several apps that check every box, but aren't displayed in the 'featured' list.
- AlyssaRowan 12y agoConfirm: Skype doesn't deserve that second checkbox. It is now centralised, is a specific real-time PRISM source, including full chat logs, and does indeed read the messages going through it. Try posting a URL on there and watching an anti-malware scanner ping it sometime. I don't know if they're still doing that, but they definitely were.
- MichaelGG 12y agoIt deserves it as much as iMessage, doesn't it?
- higherpurpose 12y agoWhich means neither deserves it.
- josho 12y ago? My understanding of iMessage is end to end encryption. Where the endpoints are the separate certificates on each of your devices.
- MichaelGG 12y ago
- Mandatum 12y agoCryptoCat, the very same client that had an abysmal MitM attack exposed in which the author said "don't worry, it's on a prototype debug version" when infact it was on the deployed real-world version? Yeah, nah. https://news.ycombinator.com/item?id=7518761 https://news.ycombinator.com/item?id=7518761 EDIT: I get that they're choosing more "user-friendly" and "freely available" applications for featured, however this is really only going to get seen by people who don't mind a bit of fiddling around. ChatSecure + Orbot I see as the most reliable on there, yes you'd stick out like a sore thumb (why are you using Tor?) however privacy-wise, you'll be just fine.
- dffx 12y agoTo be fair to the article (if not to Cryptocat), the EFF page doesn't give an analysis of the quality of the encryption. The code has been audited, but it doesn't mean the results were satisfactory. That said, the fact that the page gives bright green happy checkmarks across the board for Cryptocat does become misleading for people who may not know a ton about it.
- MichaelGG 12y agoSo it's like a Mitch Hedburg joke? "Yeah this program has been audited by the world's best cryptographers. They said not to use it. " The EFF is doing everyone a disservice by taking such a stance.
- tptacek 12y agoWhat's more, Cryptocat is prominently featured with a perfect score ("score" being their word) above the fold, with TextSecure at the bottom of the list. Alphabetization would be a credible explanation for this if EFF hadn't already made the editorial decision to hide many many more applications behind a "show all applications" dropdown.
- crazypyro 12y agoI think they may have changed this, as it now defaults to showing all applications and then featured applications is select-able. It's also alphabetized. I doubt there was some nefarious reasoning, but I could be wrong.
- api 12y agoHow good these are from a security point of view seems (roughly) inversely proportional to their popularity.
- ekimekim 12y agoWhich begs the question, in what direction is the causation? Are less secure apps more popular because they're a better user experience? Are popular apps less likely to be secure because they're owned by large companies less inclined to give up precious access to information? A bit of both? Or something else entirely? Answering this question is the first step to making truly secure communication actually USED in day to day life.
- api 12y agoI think it's a question of focus. The more secure apps are a product of focus on security. The less secure ones are a product of focus on marketing and user experience.
- pde3 12y agoThat's why we view this Scorecard as the opening in a campaign to evaluate both the usability and security of messaging tools. Traditional cipherpunk designs are unusable by humans, and a lot more work is going to be needed to build things that can have hundreds of millions of users and be secure at the same time.
- andy318 12y agoThanks to the EFF for doing this!
- nichochar 12y agoThe design of this page is so bad! ahaha Anyway, helpful tip: you can chose "All Tools" instead of "Featured tools" on the top left of the beautiful table
- lawnchair_larry 12y agoThis is definitely a moment of weakness for EFF's credibility. They need experts to review these before going public. Many of these are demonstrably false.
- pde3 12y agoWe do have experts reviewing them. Which items are false?
- karlhedderich 12y agoLast I knew it was strongly suspected that Skype could look at your messages. imessage doesn't pass the mud puddle test indicating apple can look at your messages. Facetime should probably considered suspect but I don't know of any articles that demonstrate how the key exchange is handled. BlackBerry also modified their messaging app to be able to give info to LE. Telegram doesn't have open source server code and uses home rolled crypto. Was telegram even properly audited? I would also recommend categories for what metadata is exposed; if messages are encrypted at rest on your device; cross platform ubiquity. You should include bitmessage, and i2p-bote. I am glad that this is only the first step but I do think that you shouldn't have done it alphabetically but rather by score and usability.
- pde3 12y agoIt wasn't clear to us whether the NSA intercepts Skype by breaking the crypto, or by compelling injection of false public keys in order to perform a man in the middle attack. In the latter case it's the third checkmark (lack of ability to verify keys) that's their users' undoing. We're talking to Microsoft about that at the moment, and may revise that entry. There's a weird case around iMessage and any tool that is provided by an OS vendor. I think we need to add a note about this, but in those cases that company could inject malware or a backdoor either in the messaging system or somewhere else in the OS. Since we're trying to tackle one hard problem at a time (secure messaging but not secure operating systems and software distribution) there should be an extra caveat about offerings from OS vendors. The only tool that gives strong metadata protection right now is Pond, and we aren't listing unusable tools that aren't out of beta yet. We considered but haven't yet included bitmessage for the same reason.
- patcon 12y agoThey really need a wiki with talk pages for each of these applications... EDIT: As in, I'd like to know what the details on each analysis is. And I'd also like this to be more like a living document.
- cauterize 12y agoWas there a particular reason Tox (https://tox.im/ https://tox.im/) wasn't included?
- laurenstill 12y agoTigerText also seems noticeably absent.
- FractalNerve 12y agoI second that. First thing I looked for was how they rate tox. Hopefully it gets added :)
- sabret00the 12y agoTox doesn't even have an official release. It's still in alpha stage development.
- pde3 12y agoSome extra info for commenters in this thread: This Scorecard is phase 1 of our multi-stage campaign for Secure and Usable Crypto. We believe these criteria are necessary for any strong security tool, though meeting them doesn't guarantee that a system is perfect. Subsequent phases of the project will focus on usability (which is a huge problem for activists and journalists who try to use encryption), metadata protection, openness and federatability of protocols, and much deeper audits of the design and implementation security of the software that is scoring highest.
- tptacek 12y agoWho reviewed this scorecard for technical accuracy, and who reviewed the methodology?
- andy 12y agoIf any engineers would like to work for Wickr, send me a Wickr at andyt
- SCdF 12y agoWow, I didn't think the EFF were this… misguided. > 2014-11-04 : Snapchat app has audits from an internal security team. That being enough for the "yes the app is audited" tick, plus CryptoChat looking to any passer by of this site as being A-OK is really concerning.
- gankgu 12y agoThanks, I want to know about wechat. http://www.wechat.com/en/ http://www.wechat.com/en/. Can any one provide the secure messaging score ?
- Istof 12y agoSkype is definitely not safe since Microsoft purchased them and replaced the super-nodes with MS owned servers
- Animats 12y agoIs Skype still encrypted end-to-end? I thought that a few months ago, Microsoft started running all Skype calls through Microsoft servers, decrypted.
- Spearchucker 12y agoSomething that worries me is that while all the attributes the scorecard uses are good, there's at least one other I care about (in addition to those listed). Uploading my contacts. Even TextSecure does it. I'm still looking for something that gets a deserved perfect score and doesn't go near my contacts.
- lucian1900 12y agoTextSecure does it in a nice way: https://whispersystems.org/blog/contact-discovery/ https://whispersystems.org/blog/contact-discovery/
- arca_vorago 12y agoI just want to mention a highly underrated/undervalued program in this arena: Murmur/Mumble. It's open source, easily self-hostable, and both chat and VOIP are encrypted, vis TLS and OCB-AES respectively. The downside is that it is not end-to-end, and a compromised server would compromise communications, which is why I like to self host on something I've hardened myself as opposed to buying the service from somewhere else. Also, it can also be pushed over TOR if you want... I highly encourage anyone who uses teamspeak, ventrillo, etc, to switch to mumble. I use it to keep up with friends and family from all over the world.
- footoverhand 12y agoWhile verifying some of the claims of the EFF's scoreboard, I discovered a website which scores programs by their policy decisions and security [1]. I also find it interesting that mumble wasn't mentioned in this secure messaging scorecard, but since this is the first step of a multi-phase project, I imagine the EFF will be updating it. [1]. https://openintegrity.org https://openintegrity.org