Secure Messaging Scorecard

https://www.eff.org/secure-messaging-scorecard

by sinak • 12 years ago

175 57 12 years ago

eff.org

t3ra• 12 years ago

I wonder why they didn't include telegram?

diafygi• 12 years ago

It's there if you select "All Tools" instead of "Featured Tools" in the dropdown.

chmars• 12 years ago

Thanks!

(Why isn't Telegram featured?)

justcommenting2• 12 years ago

Google Hangouts, iMessage, fb Chat "Audited"? Wish they could point readers to those audits..

Skype "encrypted so the provider can't read it" even though MS is a known NSA PRISM partner? Recent disclosures quite strongly suggest otherwise.

Also weird that they didn't sort these options by ranking. it took me a while to realize that they weren't displaying everything ranked by default (or the "winners"). to see that, choose 'all tools' from the drop-down.

JshWright• 12 years ago

Yeah, there are several apps that check every box, but aren't displayed in the 'featured' list.

AlyssaRowan2• 12 years ago

Confirm: Skype doesn't deserve that second checkbox. It is now centralised, is a specific real-time PRISM source, including full chat logs, and does indeed read the messages going through it.

Try posting a URL on there and watching an anti-malware scanner ping it sometime. I don't know if they're still doing that, but they definitely were.

MichaelGG4• 12 years ago

It deserves it as much as iMessage, doesn't it?

Mandatum5• 12 years ago

CryptoCat, the very same client that had an abysmal MitM attack exposed in which the author said "don't worry, it's on a prototype debug version" when infact it was on the deployed real-world version?

Yeah, nah.

https://news.ycombinator.com/item?id=7518761

EDIT: I get that they're choosing more "user-friendly" and "freely available" applications for featured, however this is really only going to get seen by people who don't mind a bit of fiddling around. ChatSecure + Orbot I see as the most reliable on there, yes you'd stick out like a sore thumb (why are you using Tor?) however privacy-wise, you'll be just fine.

dffx• 12 years ago

To be fair to the article (if not to Cryptocat), the EFF page doesn't give an analysis of the quality of the encryption. The code has been audited, but it doesn't mean the results were satisfactory.

That said, the fact that the page gives bright green happy checkmarks across the board for Cryptocat does become misleading for people who may not know a ton about it.

MichaelGG4• 12 years ago

So it's like a Mitch Hedburg joke? "Yeah this program has been audited by the world's best cryptographers. They said not to use it. " The EFF is doing everyone a disservice by taking such a stance.

tptacek4• 12 years ago

What's more, Cryptocat is prominently featured with a perfect score ("score" being their word) above the fold, with TextSecure at the bottom of the list. Alphabetization would be a credible explanation for this if EFF hadn't already made the editorial decision to hide many many more applications behind a "show all applications" dropdown.

crazypyro• 12 years ago

I think they may have changed this, as it now defaults to showing all applications and then featured applications is select-able. It's also alphabetized. I doubt there was some nefarious reasoning, but I could be wrong.

pde36• 12 years ago

For the record, we aren't endorsing CryptoCat or any of the other tools that got 7/7: ChatSecure, TextSecure, Signal/RedPhone, SilentText, SilentPhone, or the ones that are close like Pidgin+OTR, Subrosa, Surespot, Telegram, Threema or iMessage.

Getting those scores is a sign that those projects are taking the right approach. Lots of codebases have horrific bugs, including OpenSSL, older versions of the SSL and TLS protocol itself. We believe that focusing the community on the task of moving the best projects forward is more constructive than

Testing the tools that are scoring highest for usability, and doing deeper examinations of their designs and codebases, is going to be a future component of this campaign.

Mandatum5• 12 years ago

That sounds like a good start - but I still think the way you're presenting this data is somewhat misleading. I agree that many codebases have horrific bugs, and ultimately exploits will eventually come to light in existing applications.. However instead of listing many different available applications, why not just list what works for "right now"?

For instance: "Encrypted so the provider can’t read it?" on Skype's messaging just isn't true. If a subpoena was issued to Microsoft for conversation data, it'd be available.

I think it'd be better to stand up what does things right, and for everything else say why you're not listing them as effective. Approach is all well and good, but to an anonymous journalist/source being pursued a groups - approach over execution could be the difference between freedom and imprisonment (or worse).

MichaelGG4• 12 years ago

You may not intend to endorse CryptoCat, but it sure looks like it.

You should provide a simplified rating or some end user friendly explaination that is hard to ignore. It's confusing and misleading to say something is secure but there's no way to e.g. verify keys.

edwintorok• 12 years ago

Reading about the history of CryptoCat doesn't convince me that it was written by people who knew what they were doing. Look at the RSA key size chronology: 768, 512, 600, 1280, 1024, 1048, ... http://tobtu.com/decryptocat.php

api2• 12 years ago

How good these are from a security point of view seems (roughly) inversely proportional to their popularity.

ekimekim• 12 years ago

Which begs the question, in what direction is the causation? Are less secure apps more popular because they're a better user experience? Are popular apps less likely to be secure because they're owned by large companies less inclined to give up precious access to information? A bit of both? Or something else entirely? Answering this question is the first step to making truly secure communication actually USED in day to day life.

api2• 12 years ago

I think it's a question of focus. The more secure apps are a product of focus on security. The less secure ones are a product of focus on marketing and user experience.

pde36• 12 years ago

That's why we view this Scorecard as the opening in a campaign to evaluate both the usability and security of messaging tools. Traditional cipherpunk designs are unusable by humans, and a lot more work is going to be needed to build things that can have hundreds of millions of users and be secure at the same time.

andy318• 12 years ago

Thanks to the EFF for doing this!

nichochar• 12 years ago

The design of this page is so bad! ahaha

Anyway, helpful tip: you can chose "All Tools" instead of "Featured tools" on the top left of the beautiful table

lawnchair_larry• 12 years ago

This is definitely a moment of weakness for EFF's credibility. They need experts to review these before going public. Many of these are demonstrably false.

pde36• 12 years ago

We do have experts reviewing them. Which items are false?

karlhedderich2• 12 years ago

Last I knew it was strongly suspected that Skype could look at your messages. imessage doesn't pass the mud puddle test indicating apple can look at your messages. Facetime should probably considered suspect but I don't know of any articles that demonstrate how the key exchange is handled. BlackBerry also modified their messaging app to be able to give info to LE. Telegram doesn't have open source server code and uses home rolled crypto. Was telegram even properly audited?

I would also recommend categories for what metadata is exposed; if messages are encrypted at rest on your device; cross platform ubiquity.

You should include bitmessage, and i2p-bote.

I am glad that this is only the first step but I do think that you shouldn't have done it alphabetically but rather by score and usability.

patcon• 12 years ago

They really need a wiki with talk pages for each of these applications...

EDIT: As in, I'd like to know what the details on each analysis is. And I'd also like this to be more like a living document.

cauterize• 12 years ago

Was there a particular reason Tox (https://tox.im/) wasn't included?

laurenstill• 12 years ago

TigerText also seems noticeably absent.

FractalNerve• 12 years ago

I second that. First thing I looked for was how they rate tox. Hopefully it gets added :)

sabret00the2• 12 years ago

Tox doesn't even have an official release. It's still in alpha stage development.

pde36• 12 years ago

Some extra info for commenters in this thread:

This Scorecard is phase 1 of our multi-stage campaign for Secure and Usable Crypto. We believe these criteria are necessary for any strong security tool, though meeting them doesn't guarantee that a system is perfect.

Subsequent phases of the project will focus on usability (which is a huge problem for activists and journalists who try to use encryption), metadata protection, openness and federatability of protocols, and much deeper audits of the design and implementation security of the software that is scoring highest.

tptacek4• 12 years ago

Who reviewed this scorecard for technical accuracy, and who reviewed the methodology?

SCdF• 12 years ago

Wow, I didn't think the EFF were this… misguided.

2014-11-04 : Snapchat app has audits from an internal security team.

That being enough for the "yes the app is audited" tick, plus CryptoChat looking to any passer by of this site as being A-OK is really concerning.

gankgu• 12 years ago

Thanks, I want to know about wechat. http://www.wechat.com/en/. Can any one provide the secure messaging score ?

Istof• 12 years ago

Skype is definitely not safe since Microsoft purchased them and replaced the super-nodes with MS owned servers

Animats• 12 years ago

Is Skype still encrypted end-to-end? I thought that a few months ago, Microsoft started running all Skype calls through Microsoft servers, decrypted.

Spearchucker• 12 years ago

Something that worries me is that while all the attributes the scorecard uses are good, there's at least one other I care about (in addition to those listed).

Uploading my contacts.

Even TextSecure does it. I'm still looking for something that gets a deserved perfect score and doesn't go near my contacts.

lucian1900• 12 years ago

TextSecure does it in a nice way: https://whispersystems.org/blog/contact-discovery/

arca_vorago• 12 years ago

I just want to mention a highly underrated/undervalued program in this arena: Murmur/Mumble.

It's open source, easily self-hostable, and both chat and VOIP are encrypted, vis TLS and OCB-AES respectively. The downside is that it is not end-to-end, and a compromised server would compromise communications, which is why I like to self host on something I've hardened myself as opposed to buying the service from somewhere else.

Also, it can also be pushed over TOR if you want...

I highly encourage anyone who uses teamspeak, ventrillo, etc, to switch to mumble. I use it to keep up with friends and family from all over the world.

footoverhand• 12 years ago

While verifying some of the claims of the EFF's scoreboard, I discovered a website which scores programs by their policy decisions and security [1].

I also find it interesting that mumble wasn't mentioned in this secure messaging scorecard, but since this is the first step of a multi-phase project, I imagine the EFF will be updating it.

[1]. https://openintegrity.org

Secure Messaging Scorecard

Related Stories