Re: [tlug] RMS is at it again...again

[Edward Middleton <emiddleton@example.com>]

Curt Sampson wrote:
> On 2008-10-03 13:39 +0900 (Fri), Edward Middleton wrote:
>
>   
>> Curt Sampson wrote:
>>
>>     
>>> Well, I know that for my more critical data that either they're not
>>> modifying it, or my crypto is much weaker than I'd thought. I also
>>> strongly suspect that they're not reading it (or my crypto is, etc.),
>>> though I have less confidence in that.
>>>       
>> Well as Stephen J. Turnbull pointed out at past Nomi.  Do you check the
>> source of every piece of source before you compile and run it.  Do you
>> check it sufficiently to insure a sophisticated organization with plenty
>> of resources couldn't insert a Trojan without you finding it.
>>     
>
> Nope. Nor do I check the the masks and fabricate my own chips.
>
> However, the question is rather pointless, because the answer is
> *always* "no." Not even the NSA has crypto so good that someone with
> sufficient resources couldn't defeat it. As with Churchill, we've
> already established that it's not a question of can or can't, it's a
> question merely of cost.
>
> Anybody who implies that you're not secure if you don't carefully check
> the source code of your security-related software does not understand
> security. In fact, anybody who divides the world into "secure" and "not
> secure," rather than a continuum, does not understand security. (Note,
> though, that mere use of these terms does not necessarially mean that
> the user is not using these as broad, relative points on a continuum in
> the context of a particular discussion.)
>   

So the question is where does the data we put on SNS services and Google
Mail fit on the security continuum.  The two main security issues I see
with such services is the potential for the vendor to

1. locking you out of your data.
2. giving access to malicious third parties information gained from
aggregating your data.
3. modify your data to misrepresent the situation.

1. can be easily mitigated by duplicating you data.  I don't know that
there is anything that can effectively combat 3.,  which basically leaves 2.

Edward