Slashdot Mirror
The Fight Over the EFF's Secure Messaging Scoreboard
blottsie writes The Electronic Frontier Foundation (EFF)'s new Secure Messaging Scorecard is designed to answer one important question: Which apps and tools actually keep your messages secure and safe from prying eyes? The results have been mixed. In the midst of many positive reactions from technology companies and users, the scorecard stoked a wave of criticism from several prominent figures in the security industry, who deemed the effort inaccurate, misleading, and vague."
The simple answer: If it's from the USA, it can't be trusted.
The actual 'scorecard' can be found here. No need to go to extremes and RTFA.
[Snarky comment about sloppy /. submissions.]
From the article:
"The EFF scorecard gives Skype two check marks for being encrypted in transit and encrypted so the provider can’t read it."
and then:
“There are always going to be difficult cases when you’re evaluating complex software,” EFF’s Eckersley said. “There are clear indications that the NSA intercepted Skype conversations. However, we don’t know if that was a break in the cryptography itself that would allow anyone to intercept, or if it was a compelled man-in-the-middle attack where Skype was made by authorities to give out fake keys to targets.”
This is indeed strange. It seems bazaar to give a product a check mark if the EFF don't actually know. Surely benefit of the doubt shouldn't apply in such cases. In any case why not have a question mark indicator for such cases. This might also encourage companies to provide better disclosure.
..who has a track record in this area.
On the other, we have @ioerror, The malware monster!, and @tqbf who are all well known security experts and...wait..who?
Good to see samzenpus is still the master duper.
I use smile.amazon.com, which automatically takes 0.5% of the purchase price and donates it to the organization of your choice at no extra cost. You can set it up to donate to the EFF. Just make sure you always go to smile, or else the donations don't occur.
Supporting the EFF seems to be the easiest way to support our right to privacy online.
Use Pidgin with the OTR plugin for easy chat encryption.
The scorecard gives negative marks for both PGP for Mac and PGP for Windows, for both "Are past comms secure if your keys are stolen?" and "Has the code been audited?" Both negative marks are quite wrong!!
Using the OpenPGP definition, decryption requires both a private key and a passphrase. If the private key is compromised but the passphrase remains safe, a file or message encrypted via OpenPGP cannot be decrypted. This depends, of course, on a lengthy passphrase that exists only in the user's head. My passphrase is over 20 characters long and contains upper-case and lower-case letters, spaces, and punctuation.
Older versions of PGP (a commercial implementation of OpenPGP) have indeed been audited. The source codes were made public. They were thoroughly examined by outsiders. And they were compiled and compared with the distributed binary code. I do not know if this is true of the latest versions, but the older versions contained no security vulnerabilities and still work quite well.
Is the code is not open to independent review (as few of them are), is there any reason to trust the other listings? After all, we're trusting that when the maker says the software does not send messages in a way were they can intercept them, it's true, but we don't really know that to be the case.
If it is on the internet, it is not secure.
Nuff said folks.
There are 600 million WeChat users but it is not listed?
Smells of slashdot advertising, USA centric drivvel