[Cryptography] The Trust Problem

[tpb-crypto at laposte.net]

> Message du 20/05/14 20:13
> De : "Tom Ritter" 
> [...]
> On 20 May 2014 10:50, Jerry Leichter  wrote:
> > So I ran across the Mustbin iOS app (http://mustbin.com). Cool, simple idea: Take pictures of important documents, the contents of your wallet, etc.; organize them in "bins"; upload and sync to all your devices. The data is encrypted with "military grade security" (they actually specify RSA - no key length mentioned - and AES-256); they don't have access to your decryption keys. "Our technology has been reviewed and verified by one of the best firms in the security analysis business." (This is mainly from a blog entry: http://mustbin.com/blog/read/mustbin-security-military-grade-certified.)
> >
> > So ... should I believe their stuff is secure? Let's suppose they really are good guys doing their best to provide a secure service: What could they do to help me trust them with such sensitive information?
> >
> > With security, we're now at a level well beyond technical questions about algorithms and key lengths. What should you demand to be convinced that you can use some software safely? What should someone offering secure software put out there that would help you reach a decision?
> >
> > The facile answer is "only use OSS" - like OpenSSL, home of Heartbleed. :-( (Actually, Mustbin uses OpenSSL - they have another blog entry about what affect Heartbleed had on them.)
> >
> > Openness is certainly *part of* the answer. I'd find Mustbin's comments much more convincing it they named that "best firm" *and published their report* so I could judge what was actually examined. But it's not the whole story.
> >
> > Apple's recent white paper on iOS security http://images.apple.com/ipad/business/docs/iOS_Security_Feb14.pdf may not be perfect - what is? - but it's certainly way beyond what you get with most products, which basically say "We're experts, trust us."
> >

You can always get a bogus update to grab your key, even if you run open source. I wonder if the Debian team didn't receive an NSL demanding they give the private key they use to sign updates.

And I fear that is precisely the big revelation Greenwald is talking about so much.

It is a long time already the Chinese says our open source as a whole is compromised ... make your bets.