3 ms·
No, not at all. At least in the teardowns I've seen here on HN, the companies make big mistakes, market it like they are perfect, and are arrogant regarding fix
by MichaelGG 12y ago
No, not at all. At least in the teardowns I've seen here on HN, the companies make big mistakes, market it like they are perfect, and are arrogant regarding fixing things.
If companies launched with a real crypto review, this wouldn't happen. On the flip side, most companies wouldn't launch at all because their product is simply inherently insecure. Or, it addresses a mostly useless threat model. For instance, it requires you to trust their server while claiming to be super duper secret.
Even Silent Circle, which touts some famous names, talks up their secure PSTN service which is so obviously interceptable it's bizarre to make any security claim at all.
The problem with crypto your mum can use is that key management is a pain in the ass. And if users don't verify and maintain their own keys, most systems are useless against strong threats. zRTP is the closest thing to great, because there's a simple in-but-out-of-band key verification system built in.
And if you day your mum doesn't need that much security, she just doesn't wanna be in a dragnet or have her ISP read her email, then choosing, say, Gmail, and emailing other users with TLS-enabled SMTP servers gets her pretty damn far (if SMTP actually verified certs). But that's not a very sexy product, is it? (Despite being what many corporations do -- configure explicit SMTP-TLS policies.)