Skip to main content
Information Security

You are not logged in. Your edit will be placed in a queue until it is peer reviewed.

We welcome edits that make the post easier to understand and more valuable for readers. Because community members review edits, please try to make the post substantially better than how you found it, for example, by fixing grammar or adding additional resources and hyperlinks.

4
  • Thank you for your very informative answer. I certainly agree with a lot of points. Though when it comes to IT, surely it is a bit different than when going to a car mechanic or a doctor. While you cannot remove trust from the equation altogether you can certainly minimize it by ensuring proper setup (in terms of app architecture and your own device and practices). Commented Oct 16, 2015 at 8:38
  • For example, you don't really have to trust or not trust RSA, as long as you know that it's there (and properly implemented), key length is long enough, and quantum computing has not yet arrived - i.e. you know it's sound and not merely hope that it is! So why can't this be extended to the whole app usage case? Granted with proper practices on your behalf like choosing good passwords, with only giving the apps permissions that make sense, using separate accounts? Commented Oct 16, 2015 at 8:41
  • So, I guess I was wondering if nowadays it is actually possible to have a mobile messaging app where you will actually know (as opposed to hoping with some trust) what this app actually does and what it accesses and why. Commented Oct 16, 2015 at 8:44
  • In theory yes, in practice I don't think so. Theoretically, there are open source messaging apps, so you could analyse what they do and verify they are trustworthy. However, this is not practical and few have the necessary skills. I think you are still trusting in RSA and its implementations - that trust might be strong and based on good info, but it is still trust and may be misplaced (consider this weeks news about the NSA and DH, which highlights the issues of theory and implementation differences). Commented Oct 16, 2015 at 21:54