Schneier on Security

Dirk Praet • October 15, 2013 5:39 PM

This doesn’t sound very reassuring:

“We gratefully acknowledge support given to this project. This research was supported by CyLab at Carnegie Mellon under grants DAAD19-02-1-0389 and W911NF-09-1-0273, from the Army Research Office, and by support from NSF under award CCF 0424422, and CNS-1050224, and by gifts from Google.”

Granted, they’re not alone in that field. Tor is there too. And I suppose the NSF is the US National Science Foundation, not the Swedish National Socialist Front.

Then again from the FAQ page:

Which Agencies or other third-parties have access to my information in SafeSlinger?
“There are no backdoors in our system. SafeSlinger does not provide backdoors to access any of your data, messages or contacts.”

Putting up our tin foil hat, we also need to ask the question “does it provide backdoors to access your key(s)”, which is prominently missing from the statement. That’s what you get when becoming used to word games by corporations, governments and spy agencies. But in the end, that’s not even the main problem: although every new secure messaging app is more than welcome – especially if it survives some serious testing, analysis and auditing -, the main problem with any US based product or service is that it suffers from IbL: Insecure by Law. (or ObL: overruled by law ; pun intended)

The moment the provider/vendor receives an NSL to put in a backdoor, it’s pretty much game over for everyone. In the current state of affairs, one prominent user under scrutiny can be all it takes, and the moment the app gains enough traction among the general public, it’s probably just a matter of time before they are inducted in to the PRISM family. So until the source code is released (promised for end 2013), audited and the binaries made available in Google Play and App Store reverse engineered and found to be OK, there is no reason to trust any claim about SafeSlinger security whatsoever.

The same goes for any other app making claims to be “NSA proof”, by the way. I know that’s a hard verdict for a project that’s probably being done with the best of intentions, but this is unfortunately the reality of today. And for the usual suspect(s) countering that other nations are probably doing the same thing: maybe, perhaps, depending on where it comes from, who can tell ? But at least for the US we know for sure. Thanks to the NSA and Ed Snowden.

Dirk Praet • October 17, 2013 6:55 PM

@ Skeptical

If you’re not a “US Person”, the limits on what surveillance intelligence agencies may conduct aren’t likely to be any better in your country of residence. And the risk of the US government using acquired information for commercial espionage or harassment of dissidents is less than or equal to that of any other government. Frankly, all off the top of my head, I’d generally recommend the US over any other jurisdiction.

Says who ? Are you somehow an expert on or have any specific knowledge of the differences in privacy laws between, say, the US and the EU ? My take is that you are just making assumptions based on what you believe is true. I see nothing but confirmation bias in your statements that are absent of any documented facts or references, which I consider a prerequisite in any intellectual discussion.

I live in a country that is deeply divided along linguistic lines, to the point that we have strict laws as to what language can be used in certain administrative and political contexts. A couple of years ago there was a serious row over French being spoken in a small town city council where according to statutes only Dutch was allowed. There was a strong and passionate defense by one of the French speakers argumenting that “French was the most beautiful language in the world”. One of his Flemish colleagues at that point rather sarcastically pointed out that it was also the only language he knew.