5 ms·

Switzerland is mostly a privacy snake oil in regards to the coercive powers of various legal authorities. Your executives, investors etc are all subject to US l

by zmanian 11y ago

Switzerland is mostly a privacy snake oil in regards to the coercive powers of various legal authorities. Your executives, investors etc are all subject to US law. Swiss law isn't going to protect users. Switzerland might be a reasonable place to stage civil disobedience from. Phil has credibility in that regard. Would love to see a statement from Silent Circle comparable to Least Authority's https://tahoe-lafs.org/pipermail/tahoe-dev/2010-October/005353.html https://tahoe-lafs.org/pipermail/tahoe-dev/2010-October/0053...

MichaelGG 11y ago
Most of Silent Circle is marketing, as far as I can tell. The ZRTP stuff is great, as voice verification is easy (spoofing it is hard). But the rest? They talk about secure PSTN, but they are just using VoIP AFAIK (even if they had TDM handoffs, a ton of traffic goes over random VoIP providers anyways.) But that aside - there is no such thing as secure PSTN (outside of things like PGPfone). What benefit is there versus using a VPN and any random VoIP provider? Maybe they keep less CDRs, and if you use no calling number, that'd be a little better, I guess. Hell, try to explain what this even means: "Our Silent Network provides the backbone to our encrypted communications service. There's no sharing of our dedicated network. We have custom-built servers, CODECs, software and hardware that ensure security integrated through design" Custom built servers? Like what, they assembled Super Micro servers or FB's server spec? Or what? 100% dedicated network? They ran fiber? Or they mean they bought some Ethernet switches instead of using AWS or some colo's switches? And new codecs? I guess it's possible but if they've outdone all the other audio codecs out there, that's worth taking about concretely. Not to mention that's a huge breakthrough, on top of the crypto work. (Or do they mean ZRTP is the custom built codec?) Seriously everyone: go to this page[1] and tell me if your BS meter doesn't redline. Custom built PBX? Does that mean FreeSWITCH or Asterisk, or something else? If it is one of the open source systems, where are the CVEs they've found and upstreamed? Custom built HD network? Wtf does that even mean? And Blackphone? Last I saw it on HN, it was a closed source system, zero mention of baseband processor security. I thought it was Android based, with a few apps thrown in but I don't recall offhand. SC has some great tech guys and the people I've met seem nice and sincere and I've no doubt they are acting in good faith. But the stuff their CEO and marketers say make it come off very scammy. 1: https://silentcircle.com/silent-network https://silentcircle.com/silent-network
- spacehome 11y ago
  > voice verification is easy Why can't anyone who hears my voice spoof it? Seems relatively insecure to broadcast my password every time I talk. I've heard in other contexts such as retinal or fingerprint scanning that biometrics are more like usernames than passwords (public and hard to change). Why shouldn't voice be the same?
  - JshWright 11y ago
    They are referring to the SAS verification, which are two words derived from the peer to peer key exchange process. If they match on both ends, you can have a very high degree of confidence that there is no man in the middle. It's not a password, it's a verification tool that can be used to double check the security of your connection once you are sure you are talking to the right person.

by zmanian 11y ago

MichaelGG 11y ago

Most of Silent Circle is marketing, as far as I can tell. The ZRTP stuff is great, as voice verification is easy (spoofing it is hard). But the rest? They talk about secure PSTN, but they are just using VoIP AFAIK (even if they had TDM handoffs, a ton of traffic goes over random VoIP providers anyways.) But that aside - there is no such thing as secure PSTN (outside of things like PGPfone). What benefit is there versus using a VPN and any random VoIP provider? Maybe they keep less CDRs, and if you use no calling number, that'd be a little better, I guess. Hell, try to explain what this even means: "Our Silent Network provides the backbone to our encrypted communications service. There's no sharing of our dedicated network. We have custom-built servers, CODECs, software and hardware that ensure security integrated through design" Custom built servers? Like what, they assembled Super Micro servers or FB's server spec? Or what? 100% dedicated network? They ran fiber? Or they mean they bought some Ethernet switches instead of using AWS or some colo's switches? And new codecs? I guess it's possible but if they've outdone all the other audio codecs out there, that's worth taking about concretely. Not to mention that's a huge breakthrough, on top of the crypto work. (Or do they mean ZRTP is the custom built codec?) Seriously everyone: go to this page[1] and tell me if your BS meter doesn't redline. Custom built PBX? Does that mean FreeSWITCH or Asterisk, or something else? If it is one of the open source systems, where are the CVEs they've found and upstreamed? Custom built HD network? Wtf does that even mean? And Blackphone? Last I saw it on HN, it was a closed source system, zero mention of baseband processor security. I thought it was Android based, with a few apps thrown in but I don't recall offhand. SC has some great tech guys and the people I've met seem nice and sincere and I've no doubt they are acting in good faith. But the stuff their CEO and marketers say make it come off very scammy. 1: https://silentcircle.com/silent-network https://silentcircle.com/silent-network

spacehome 11y ago
> voice verification is easy Why can't anyone who hears my voice spoof it? Seems relatively insecure to broadcast my password every time I talk. I've heard in other contexts such as retinal or fingerprint scanning that biometrics are more like usernames than passwords (public and hard to change). Why shouldn't voice be the same?
- JshWright 11y ago
  They are referring to the SAS verification, which are two words derived from the peer to peer key exchange process. If they match on both ends, you can have a very high degree of confidence that there is no man in the middle. It's not a password, it's a verification tool that can be used to double check the security of your connection once you are sure you are talking to the right person.