Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Open source makes it is easier for security experts to review the code and determine whether it meets its security claims. If it is closed source, then there is no guarantee that the code the experts review is the same code that is used by the service. And also it is at the company's discretion whether to allow a security audit or not, and then which auditors to allow or exclude.

But if the whole of the client software is open source, then it also eliminates the need to trust binaries provided by the vendor (which can be MITM) because you can build the software yourself or use a version audited by an entity that you do trust.



That, also the fact that if they have it in their privacy policy and website, then we can call them out on it when they insert a backdoor or remove the encryption. We can't say the same about Whatsapp and its end-to-end encryption, because they never even publicly admitted to using it. How can we ever hold Whatsapp responsible for not using end-to-end encryption then?

We can do that with Protonmail.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: