Hacker News Reader

Comment by encryptluks2 | Hacker News Reader

I can tell you first hand, anytime a company pays a third party to do a security assessment, the result is purely what the company wants you to see. Independent does not mean that it wasn't influenced, just that it wasn't done by the company itself.

View on HN

This is false. The security company has its own reputation to mind, and its people their own conscience. (There may be cases like you're saying, but "anytime" and "purely" is completely wrong.)

This is first-hand as well. But I'm not the one making a universal claim.

I think what they are trying to say is that nothing would prevent the company ordering the audit from providing the firm conducting the audit with another branch of the source code.

NCC Group is a legit outfit, a public company in fact, so this comment is not warranted.

You may not think so, but I know of equally reputable firms that have overlooked things as blatant as software that allows third parties to pipe scripts without any notification to the user. Look at the recent NPM discussion for example, and that isn't even the one I am referencing. So, yes.. they may be a "legit" outfit but that doesn't prevent them from ignoring obvious security issues.

There is no proof what they tested was actually what's in people's phones. It's most likely a separate "cleaned-up" build/codebase for looks. And chances are against users.

If you were involved in checking their security, what would you do to verify what you're looking at is what end users are getting?

And this isn't just NCC Group; it's NCC Crypto, a particularly hardcore practice inside of NCC. Marie-Sarah Lacharité's name is on this, and she's not messing around.

I've coordinated an NCC crypto audit, and I can assure you that is not the case.

As a pentester at a security company doing assessments for customers, I can say that this is definitely false.

We value our independence highly. It is what ultimately brings in business. It would be very bad business if one our customers gets hacked, when it was an easy vulnerability for us to find.

This is the same for the NCC group here. If in a few weeks the WhatsApp e2e encryption on backups was cracked, they would look like fools. And that is not good for business.

It isn't merely being hacked.. if for some reason data gets exposed, it is easy to redefine the exposure point as a third party issue. For example, lets say an app allows you to install a plugin. However, the plugin API lets a third party run anything they want. I've seen firsthand how auditors will determine that it isn't the fault of the company they are auditing, irregardless that that the company provides a plugin API that allows for easy exploits because their software isn't technically the one exploiting the user.

For reputable firms, this is absolutely false.

There are firms that do what you say--they write a report that says how totally wonderful it was to work with you and how wonderful it is that you quickly fixed all the informationals they found, and what a genius you were to work with them. And they happily make these reports public.

Reputable firms will write savagely brutal reports when warranted.

Maybe you can share your experience?

This doesn’t tally with my own experience and I’ve worked with many including NCC Group.

Reply on news.ycombinator.com