Hacker News Reader

Hacker News

Comment by rnestler | Hacker News Reader

Parent Full thread

rnestler

I'm not sure if this is a joke or a legitimate concern about Threema. Care to elaborate?

View on HN

from Threema own homepage:

"100% Swiss Made"

"Threema is a true Swiss company hosting its own servers in Switzerland."

After Omnisec AG and Crypto AG, how is anyone falling for that cliché again...

In contrast to Omnisec and Crypto AG with their security by obscurity, the Threema apps are fully open source with reproducible builds: https://threema.ch/en/open-source/

1. Only the client apps are open source, not the server side.

2. https://en.wikipedia.org/wiki/Underhanded_C_Contest

So software coming out of Switzerland should be written off completely?

Good question. I don't know. Personally, a company that (1) works on secure encryption and (2) advertises "100% pure Swiss" is a negative signal.

Proton mail does that, not so sure about the negative signal but there is some merit of using a Swiss company as a honeypot.

No, it should be treated as software coming from any other country.

At this point it’s just silly to brand your security product as Swiss made in hopes of looking more legit. In a sense I see it negative, just like some companies brand their products with buzzwords such as AI and blockchain for no good reason other then to look cool. Makes me suspicious.

I think to the swiss market, branding it as 100% swiss is both reasonable, and a positive point. So, not silly.

And for the international market, probably "swiss" is mostly to be understood as "not american/russian/chinese"

> 1. Only the client apps are open source, not the server side.

This shouldn't matter since you can't check what they are running anyways.

> 2. https://en.wikipedia.org/wiki/Underhanded_C_Contest

This is true for any software. What is the point here?

My point is that selling encryption software as "secure" is a difficult position, since nobody can really guarantee the security, even with open source code.

Therefore the decision to choose a particular "secure" software relies 50% on sound cryptographic practices, and 50% on reputation. Yes, reputation.

Just like I wouldn't use a NSA "secure random" algorithm [1], or a product that advertises 32768 bit key encryption, I wouldn't use a product that advertises "100% pure Swiss security" on its home page. It's a negative reputation signal.

[1] https://en.wikipedia.org/wiki/Dual_EC_DRBG

Fair enough, but it looks like you are misquoting them. They never say anything about "100% pure Swiss security".

Their messaging seems to revolve much more around an anti Silicon Valley proposition where you could substitute Swiss for European.

Is Switzerland actually known to screw these kinds of things up more than other countries?

This looks more like it is supposed to mean not Silicon Valley, which is on point with the rest of their marketing and what is written about them.

> Threema, die «Antithese des Silicon Valley-Modells»

https://www.srf.ch/news/wirtschaft/whatsapp-alternative-thre...

Reminds me of protonmail too huh

Reply on news.ycombinator.com