3 ms·

I have immense respect for the author, and I know these are just notes, but the tone of technologists who talk about Snowden is very annoying. We know certain

I have immense respect for the author, and I know these are just notes, but the tone of technologists who talk about Snowden is very annoying. We know certain technologies like Tor and OTR are safe because of the weight of scientific research that support them, and the immense effort of the developers. Not because someone said so at an event. Statements like "gpg ciphertexts with RSA 1024 were returned as fails" are totally meaningless. I wish people had more confidence in good old science (like Anderson's works) than glamorous events like this. You should all check out Security Engineering by the same author, it's free! www.cl.cam.ac.uk/~rja14/book.html

throwaway10499 11y ago
Tor has been the subject of a decade of extensive research by the computer security community. OTR on the other hand, is showing its age, and I don't know any cryptography experts who are entirely comfortable with its design or the choice of crypto algorithms and key sizes that it uses. OTR and Tor aren't even in the same league.
vilhelm_s 11y ago
I mean, that scientific research includes a bunch of timing attacks which shows that if someone can manipulate both the entry and exit points (like the NSA can), they can deanonymize TOR users. The TOR team specifically state that a "global" adversary (like the NSA) is beyond the scope of threats they are trying to protect against. There is no theoretical guarantee that the NSA cannot break TOR, the question is whether they have actually got the engineering in place to do so. And the Snowden leaks showed they didn't, at least not in 2013, although they were working on it.