• 0 Posts
  • 18 Comments
Joined 1 year ago
cake
Cake day: July 1st, 2023

help-circle


  • Sure it does, but that doesn’t make it bad.

    Open source code is not the only solution to secure communication.

    You can be extremely secure on closed source tools as well.

    If they found specific issues with Signal aside from not being allowed to freely inspect their code base, I suspect we would be hearing about it. Instead I don’t see specific security failings just hat it didn’t make the measure for their security software audit.

    As an example of something that is closed source and trusted:

    The software used to load data and debug the F-35 fighter jet.

    Pretty big problem for 16 countries if that isn’t secure… closed source. So much s you can’t even run tests against the device for loading data to the jet live. It’s a problem to sort out, but it’s an example of where highly important communication protocols are not open source and trusted by the governments of many countries.

    If their particular standard here was open source, ok, but they didn’t do anything to assure the version they inspected would be the only version used. In fact every release from that basement pair of programmers could inadvertently have a flaw in it, which this committee would not be reviewing in the code base for its members of parliament.














  • sudoshakes@reddthat.comtoPrivacy@lemmy.mlThe UK essentially breaks encryption
    link
    fedilink
    arrow-up
    30
    arrow-down
    2
    ·
    edit-2
    9 months ago

    His point, which seems pedantic, but isn’t, is to illustrate the specific attack vector.

    Breaking encryption would mean that the cryptographic process is something that an attacker can directly exploit. This is as close to impossible as it gets in that line of work.

    While you can compromise the effectiveness of encryption by subverting it using other attack vectors like man in the middle or phishing or the good old fashioned physical device access, these don’t break the algorithm used in a way that it makes it vulnerable to decrypting other data.

    None of those mean an algorithm used like say the ole Two fish encryption is “broken”.

    Blowfish Triple DES Twofish RC4 Etc. All are fine and not currently broken. All however cannot protect your data if some other attack vector companies you or your site’s security.