Silent Circle's latest app democratizes encryption | Hacker News Reader

Silent Circle's latest app democratizes encryption

slate.com

53 pointsjamesbritt21 comments

I have a rule about encryption...it's gotta be Open Source, or I can't trust it. I know that can make it difficult to make a business around it (as someone that has started two Open Source based companies, I know it all too well), but it just doesn't even cross my mind to trust a closed source app with something I truly want to be private.

"The enemy knows the system"

> Janke has also committed to making the source code of the new technology available publicly “as fast as we can,” which means its security can be independently audited by researchers.

We'll just have to see if they follow up on the promise. I poked around on their website and didn't find anything.

tarsnap is a good example of a successful commercial product that makes its source code available for security review.

I work on RedPhone and TextSecure, two GPLv3 apps for mobile encrypted voice and SMS: http://www.whispersystems.org

Thank you for your continued work in this field!

Awesome! Do these work with the Google Voice and GrooVe apps?

I do not want to hijack the thread, but was so excited when I found this with my first Android phone (a Vision G2) almost three years ago. The website has changed and looks super polished, but all mention of WhisperCore (the disk encryption solution) disappeared. I know, I know, LUKS encryption on modern Android OS branch (2.3 and 4.x, IIRC), but you said you were working on it and it then seemed to disappear. What happened?

I tend to agree about source code, but in the specific case of silent circle, I trust the authors (prz, Jon Callas, and Vinnie, specifically).

I assume they'd be willing to show source for audit to anyone legitimate who would sign an NDA, at least as a major customer. That's not as good as open source, but close.

Do you run Windows, OS X, or iOS?

Linux and Android. Mostly. I have a Hackintoshed netbook, and a Windows 7 laptop that dual boots to Fedora. But, anything I care about (work, activism) happens on Linux. Windows is for games.

The sender of the file can set it on a timer so that it will automatically “burn”—deleting it from both devices after a set period of, say, seven minutes.

This one rings the snake oil alarm bells with me. I wonder if this is due to sloppy reporter research or actual advertising of the app.

At least they promise to release source code, so maybe it is not that bad after all...

It only deletes the file from the apps and server, obviously it can't delete arbitrary files you store on the phone.

Democratizing encryption ... But only if you can pay for it? And you can't see the source? Ummmmm

See also: Redphone for Android - http://www.whispersystems.org/

What does it mean to "democratise" encryption? Can people start voting on it now?

It doesn't democratize encryption unless it and its protocol free (as in speech).

Wouldn't hurt to be P2P as well.

Could some explain how are they going to protect me from mitm (especially on their own side)? Should I go through usual key exchange procedure? Could app potentially leak my keys or something?

Is the innovation here "making encryption easy to use"? Or are there genuine cryptographic advances within?

"Making encryption easy to use" (if they accomplished that) would be advance in cryptography since it would increase the sum total of data security in the world.

It would definitely be an advance in cryptography engineering, yes.

I think most of it is off the shelf stuff, but everything packaged in one app, for all types of communication (e-mail, text, video-calls, etc). They may use new stuff, too, though.

Reply on news.ycombinator.com