On: The New TextSecure: Privacy Beyond SMS

[privong]

I'm pretty sure Whisper Systems never get any private keys, because the private keys are only stored on the end user devices.

[jpollock → privong]

Legal intercept legislation would likely require them to patch customer systems to allow the reporting of the key.

[anaphor → jpollock]

If you're really paranoid then you should build the code yourself from github, not just install the version on the play store.

[bduerst → anaphor]

In a compiler that was compiled by someone else. /tinfoil hat

[TacticalCoder → bduerst]

That's why in the future we'll be using compilers which are open-source and using deterministic builds and double-compilation (or "n-compilation") : )

[sneak → TacticalCoder]

I recently discovered that there are no basic deterministic OS image builds (like a bootable .iso) with just a toolchain and wget and gpg and a shell.

I was surprised; seems like a good basic target.

[LeonidasXIV → sneak]

Debian has an ongoing project for this, https://wiki.debian.org/ReproducibleBuilds driven by Lunar from the Tor project.

[albeertoni → jpollock]

Intercept legislation that applies to makers of non-interconnected (i.e., doesn't touch the PSTN) chat functions is extremely unlikely. I'm guessing whisper falls into that category.

I use Silent Circle myself, but I assume on Whisper you can't just type in a normal mobile number and have the chat message go to the right person. If you can, then those chats at least are subject to intercept, and maybe the other chats (whisper-whisper chats) are too. I don't remember how all those rules shake out/how courts have decided.

[pbhjpbhj → jpollock]

Wouldn't the relevant TLA just tell Google to enable the backdoor and then sniff the necessary keys from the device ...

[privong → pbhjpbhj]

Upon compiling TextSecure from source and installing it on my phone (I don't have the play store), I've discovered it requires the Play Store to do the "iMessage" style messaging over data. I guess the encryption is still done on-phone before being sent through whatever data API, but I still wonder if that (the play store being installed) might enable key-sniffing? Perhaps that's somewhat negated by users having a strong passphrase though?