10 ms·
So in the age of Edward Snowden this is all they say about encryption... "Are Messages And Calls Encrypted? Yes. Wire uses industry-standard encryption on all
by secfirstmd 12y ago
So in the age of Edward Snowden this is all they say about encryption...
"Are Messages And Calls Encrypted?
Yes. Wire uses industry-standard encryption on all of your Wire messages and calls."
"WHAT SECURITY MEASURES DO WE TAKE TO SAFEGUARD YOUR PERSONAL INFORMATION?
We are concerned about safeguarding the confidentiality of your information. We provide physical, electronic, and procedural safeguards to protect information we process and maintain. In addition, we restrict access to personal information to Company employees who need to know this information in order to develop, operate and maintain the Service."
Come on guys...how can anything this vague be trusted?
And by European they mean Swiss, so not specifically EU.
One of the typical evasive phrases...
From the Guardian Article:
"Locating its head office in Switzerland was Wire’s first decision taken on security grounds. “If someone is interested in accessing our user data, there’s a formal and well-regulated process in Switzerland for that. They’re very mindful of privacy, and the same is true in Germany."
Swiss naturally implies safety for many people (which is deceptive...real, verifiable, audited, end to end encryption is safety), for anyone unsure about the reality of "Swiss" cooperation with NSA since the 70s, read about Crypto AG
http://mediafilter.org/caq/cryptogate/ http://mediafilter.org/caq/cryptogate/
For those wondering about "Swiss privacy laws," if you are a foreign national you are effectively fair game
http://en.wikipedia.org/wiki/Onyx_%28interception_system%29 http://en.wikipedia.org/wiki/Onyx_%28interception_system%29
http://www.iclg.co.uk/practice-areas/telecoms-media-and-internet-laws/telecoms,-media-and-internet-laws-and-regulations/switzerland http://www.iclg.co.uk/practice-areas/telecoms-media-and-inte...
- tomp 12y agoExactly. Complying with "all messages encrypted" is equivalent to simply using HTTPS (and equivalent for voice). But this doesn't make it safe against MITM attacks, side-channel attacks and government subpoenas!
- bndr 12y agoYou should consider that most other messengers offer no such promises, even vague ones.
- vog 12y agoThat doesn't make it any better. Moreover, a false sense of security does even more harm to the users. I'd prefer a honest "We are no security experts, don't use this for critical conversations!"
- henryaj 12y agoTelegram seems to put their money where their mouth is.
- philgr 12y agoI think Telegram is the best messaging app out there.
- secfirstmd 12y agoI think once Open Whisper Systems merge their products into Signal, that is going to be the best out there...Hopefully they will get the uptake they deserve.
- darklajid 12y agoMy standard gripe with OpenText (or WhatsApp etc) is the identifier. A phone number sucks. a) I hate the discoverability. Just because I install an app doesn't mean that my ex from ten years go should see that I'm online. Heck, my mom or aunt don't need to see me showing up in the address book either. b) Desktop clients. Tablets with wifi only.
- SeanDav 12y agoThere are serious concerns with Telegram encryption/privacy. See discussion: https://news.ycombinator.com/item?id=8686868 https://news.ycombinator.com/item?id=8686868 for example
- darklajid 12y agoI'm not sure. They offer these 'challenges', but other than that? For me, this comment of yours would we something I'd agree with if - Telegram would start out with a protocol that works/is 'accepted' (OTR, TextSecure) - Would make chats encrypted by default/all the time That'd be awesome. Given that they seem to know a bit about cross-platform development and design the result might be extremely interesting. Right now? I'm not convinced.
- vog 12y agoAlso, their main site doesn't work without JavaScript. Come on ... having to execute custom code in the browser just to display a "Download" button? I hope they applied more (security-related) common sense in their apps than in their website.
- ClashTheBunny 12y agoProcessing foreign data is just as dangerous as processing foreign code. Don't lull yourself into complacency just because you have NoScript when your JPEG library is probably less sandboxed and audited than your JavaScript virtual machine. The whole idea of the Von Neumann architecture is that code is data and data is code. It is advantageous when you trust everyone, but now that you can trust noöne? What to do?
- jeremyswank 12y agonoöne? really? when did 'no one' become insufficiently clear?
- justsid 12y agoProbably a typo. ‘Ö’ and ‘O’ a very close on a German keyboard.
- jeremyswank 12y agoperhaps, but in it i detect a New Yorker magazine-style use of the dieresis to separate vowels into syllables that a reader might be inclined to pronouce together as a single sound, e.g.: reëlect for re-elect.
- ClashTheBunny 12y agoThis is the correct interpretation. But it is actually slightly nuanced; I'm such a bad speller that, even as a native English speaking adult of 30 something, I had to look up no one. Wiktionary has noöne as an "alternative spelling" and I do like The New Yorker...
- jalanb 12y agoIt will be trusted completely by their target market, which thinks Snowden is like, a real hero, but that PGP is not something they'd want to catch.
- AhtiK 12y agoGuardian article has a bit more details regarding the privacy and encryption. http://www.theguardian.com/technology/2014/dec/03/wire-communications-skype-janus-friis-app http://www.theguardian.com/technology/2014/dec/03/wire-commu...
- lmedinas 12y agoDid they also mention their business model anywhere ? Also how the European laws protects us about anything ?
- AhtiK 12y agoQuoting http://www.theguardian.com/technology/2014/dec/03/wire-communications-skype-janus-friis-app http://www.theguardian.com/technology/2014/dec/03/wire-commu... "It’s in our terms of use: we’re not going to look at your data and cultivate it for advertising," said Christensen. "We’re not going to put advertising in the client. My head of design would kill me! It’s more about finding the right kind of opportunities that are additive to the user experience, and that they’re motivated to pay for. We’ve found what we think are a couple of good ones."
- TeMPOraL 12y ago> Also how the European laws protects us about anything ? Probably more than US laws anyway.
- throwaway90446 12y agoI assume this is a joke? The US doesn't have mandatory data retention laws.
- balabaster 12y agoThe problem with abiding by European privacy laws is that if you're not European, you don't count. So if you're not European, there may as well be no privacy at all. You're more or less on your own - just the same as with American privacy laws. If they can prove one end of the conversation is not American or not in the U.S. you're recorded... but because it's so hard to do that on the fly, you're recorded anyway and they'll figure out the legal repercussions later... by hiding it, diverting the question or flat out lying about it. It's a shame, this looks on the surface like a great product. But I agree with the point made earlier: In the age of Snowden, statements as vague as "Wire interactions are secure and we comply with European privacy laws and regulations." aren't enough for anyone to stake their security on. The fact is, when it comes to communication security, the Government has proven themselves untrustworthy too many times for us to believe them anymore. Once could be written off as a mistake, twice, perhaps oversight wasn't good enough. But three, four, five times... the fact is, Governments have torpedoed any reasonable person's ability to trust them when it comes to looking after their privacy. So saying that you "comply with privacy laws and regulations" is no comfort. In today's political climate, if you want the trust of the people, you need to go above and beyond in the name of the people.
- blueskin_ 12y agoAgree - I wonder if Adobe's block mode 3DES was 'industry standard'. Saying "we use encryption" isn't any good; this isn't 1996. People need to have the details available if they want them (a little "More Information" link going to a page showing their actual security model, list of ciphers and modes of operation, etc. would do).
- wodenokoto 12y agoDoes it really matter whether they have encryption a or b? If it is poorly implemented it is unsafe. So either you trust them to do a good job or you don't. Whether someone in marketing knows the name of your favorite encryption doesn't really change that.
- secfirstmd 12y agoAgreed, open source, audited etc is obviously better but the least they could do is tell us a little more.
- emn13 12y agoOne hint of whether that they've poorly implemented it is that they didn't care to choose a preexisting algorithm, or they chose a preexisting algorithm with known weaknesses, or that they chose an algorithm with fiddly parameters without addressing that. I'm much more likely to trust if various indicators suggest they're being sane, reasonable and knowledgeable.
- sandeepspatil 12y agoWell, they can quote the most advanced encryption algorithm, but you still can't be sure if they have really used it unless they share their code. Bottomline: You either trust them or you don't. One reason for them not sharing the details could be that they want the potential hackers to keep guessing rather than making their life easier (No encrytion is foolproof)
- _asummers 12y ago
- e_proxus 12y agoJudging from their FAQ, it seems that they encrypt voice end-to-end, but messages only between the client and the server: https://support.wire.com/hc/en-us/articles/203122500-Are-messages-and-calls-encrypted- https://support.wire.com/hc/en-us/articles/203122500-Are-mes... They have features like syncing the read status of messages, so I assume their server knows about all messages and conversations (although maybe not the contents if encrypted properly).
- FreezerburnV 12y agoUnfortunately, even if they DID specifically list out all the security measures that they used, someone would still complain because it isn't completely open source. The previous company I worked for not only had legitimate encryption for anything private we received from the user (e.g.: email passwords) so that nobody at the company could ever read them, but also had some (if I remember correctly) good documentation on the site listing out exactly what we were doing. The founder of the company even commented with the specific technical details when our product was linked to on HN, and people still weren't happy. While I sympathize with what you're saying, nothing is going to make people who actually care happy with whatever security a company puts in place. Unless that company releases their source code for everyone to see. Which I would hope most people would be reasonable enough to realize why that's usually impractical. (see the previous HN post about the guy who shut down his business and was debating open sourcing his entire codebase, and all the problems he would have had to tackle to do so)
- oddvar 12y agoThere is another option - matrix.org is a new open standard for real-time communication (with encryption) in an open, federated ecosystem. That means you can run your own server and encrypt your own data, and the encrypted data can still be sent to other servers in the federation. To your point about open source, if something like this can take off it needs to be fully open and transparent, without fees or central data ownership - which is why matrix.org is a non-profit organisation and the standard open source. (disclaimer: I'm involved with matrix.org)