Comment by nickpsecurity | Hacker News Reader

Comment by nickpsecurity | Hacker News Reader

Parent Full thread

Mostly likely it's the kind of intuitive guess-work common for those those who've been reviewing black-boxes for years. You get what technical detail you can [which may be lies]. Past that, the competence, attitude, and priorities of the organization will tell you more about the estimated quality/security of their product than anything else. He apparently saw these were good at BestCrypt. So, if you can't use open-source, then he says use this company that seems more qualified and with better intentions than others (esp Microsoft!).

So, he prefers we have or use open-source crypto where we can but recognizes many won't be able to. He gives them the best option he's seen in proprietary sphere for modern Windows boxes. Incidentally, that's the best that can be done outside of reverse engineering. That's how thin our trust baseline is in commercial crypto. It's why I pushed for a paid, open-source model with independent review below:

https://www.schneier.com/blog/archives/2014/05/friday_squid_...

What "guesswork"? What "black box"? Microsoft's code is the most comprehensively reverse-engineered in the world.

Somehow, between the beginning of the Linux era and, say, 2005 or so, people forgot how to efficiently comprehend large assembly programs. But it's not 2005 anymore; it's fully ten years later. Virtually every software security team in the world has multiple people on staff who know what basic blocks and control flow graphs are. There are credible open-source competitors to IDA, and arguably the best disassembler currently available costs something like $80 and backs assembly out to C.

Closed source software imposes meaningful, significant costs. It's reasonable to prefer open-source code, or even to require it. But we cannot reasonably make the excuse that closed-source code is a "black box" anymore.

That's all so irrelevant to our discussion I wonder why you bring it up. The point is that a black box takes the kind of effort you describe to review: "meaningful, significant costs" most can't or won't invest using specialist skills or tools most don't have. Are you telling me you fully reverse engineer all the state and code paths in every proprietary offering you consider along with a robust evaluation against known vulnerabilities? Or do you look at their stated claims, prior/current credibility, and perform some basic evaluation? Most of us do the latter for economic reasons and that leaves proprietary software as a black box.

As for Microsoft, there's all kinds of people reverse engineering their code with most doing it to write exploits. So far, nobody has shared a link to a bug-for-bug compatible source equivalent for Bitlocker to analyze for cryptography issues. I'd just be taking someone else's word that (a) they R.E.'d it enough to see all potential subversions, (b) they had the skill to spot clever subversions with little context, and (c) they weren't lying to me. Please link to papers showing such a full deconstruction of the Bitlocker code with a hash that we can use to confirm it's the same on our machines. It will boost everyone's confidence in the product. Otherwise, you're talking like it's been rigorously R.E.'d and reviewed while providing zero citations to back that. Meanwhile, the Internet is full of citations on Microsoft's security failures and deceptions. Status quo stands until you deliver proof otherwise.

This is a bit tangential, but which are the credible open-source competitors to IDA and the arguably best currently-available assembler you're referring to?

He's talking about HopperApp.

Reply on news.ycombinator.com