Comment by jcoffland | Hacker News Reader

Comment by jcoffland | Hacker News Reader

"In many cases these tools are able to circumvent security measures like encryption."

To me this quote from the article, with out any qualification is just fear mongering. People need to know that strong crypto, when implemented correctly does work.

I recently tried to get a number of my friends to install Signal on their phones. I was quite surprised that most of them, even the technically minded ones, refused to install it. Their reasons ranged from not trusting the software to worrying that using it would draw government attention. And this in California.

Encrypted SMS, email and phone calls should have been standard tech from the beginning. Everyone should use crypto in their day-to-day lives, not because they have something to hide, but so that free speech and privacy are protected.

What good is strong crypto if your endpoint is compromised? If I can take screenshots and keystroke logs of you in Signal, all the crypto in the world won't help. That's the kind of spyware this article is talking about - full endpoint compromise.

Of course, but just because my car could get stolen in my garage does not mean I'm not going to lock it when I go downtown. Strong crypto can protect your data while it's in transit and people should use it, try to break it and make it better.

"Their reasons ranged from not trusting the software to worrying that using it would draw government attention. And this in California."

Yes, surprising that they are not skeptical enough of secure messaging on a rooted, owned platform that contains at least two full-blown computers (SIM card and baseband) that they have no control over or access to.

Your carrier/manufacturer owns you. Depending on the SoC/platform, they may have DMA access to your application processor.

The only question is, how much do they own you, and using which vector. There is no escaping this until we can manage an open baseband and SIM platform.

Strong crypto doesn't help at all if you have the sort of spyware discussed in the article installed on your computer. It knows everything you do.

>People need to know that strong crypto, when implemented correctly does work.

*Assuming the end points have 0 vulnerabilities, which is the elephant in the room.

Reply on news.ycombinator.com