This notion is unacceptable, and the Cryptocat Project is moving forward on proposing solutions for Lebanese people on how to protect themselves against this sort of seizure, should it happen. We’d like to talk about today’s news in Lebanon concerning the Lebanese Internal Security Forces demanding access to Facebook passwords from the Minister of Telecommunications. It's particularly frustrating because people risk death or torture or long term imprisonment in some parts of the world, and they need strong crypto. People shouldn't have been waiting for something like DecryptoCat before they stopped using CryptoCat. Except the badguys are not going to enter your competition the badguys either already know how to break the crypto or they use all the publicly available entries as help. They even took the ultimate snakeoil step of running a competition to crack their software. They ignored the advice from many people. It's fine to release your code snippets as "proof of concept" or "demonstrations" so long as you give warnings that these are not to be used in real life.Ĭryptocat did not give those warnings. This is especially dangerous for crypto because these people might not understand the bugs they've created. They read a book or two, they read some source code, and then they implement their own version. See, for example, the random number generator bug in Debian. Smart people and many eyes make mistakes with crypto. With cryptographic software a small, subtle, hard to find bug could render the product pointless could make the cryptography trivially easy to crack. See any bug tracker for bugs which have been left for years. Most of those bugs can be left without too much impact on the users.
0 kommentar(er)
