[jhlgkhkhil]

But the OP doesn't go around saying one branch of smart phones are the best of a bad bunch - he goes around saying that they are good. How does he know? Is he better as reverse engineering than everyone as the NSA put together? (And that's not even taking into account all the potential wrench attack targets at a large US company?)

[tptacek]

This doesn't even make sense. "Better reverse engineer than the NSA"? What would that mean here?

[jhlgkhkhil]

It means on what basis can you stand and say to people who's lives may be at risk that you trust apple's press releases?

Please don't respond with the strawman you keep using of Iphone vs. Android. I am not arguing that Android is more secure. I am saying that taking either to meet an at risk source is bad. Your advice on this forum will contribute to journalists feeling comfortable doing this.

[tptacek]

Non sequitur.

[jhlgkhkhil]

So we should just trust you?

[bmelton]

I want to preface this with an apology, because I don't think there's a way to say this without sounding cliquish. For that, I apologize in advance, but because your account appears to be relatively new, I feel like this is somewhat necessary. If this account is a re-roll of a previous one, then I doubly apologize.

Things you probably don't know (whether based on account age or admissions within this thread):

* tptacek has been an exceedingly active member of this forum for many, many years

* tptacek has been giving us all free security advice for as long as I can recall

* tptacek has founded at least two successful companies primarily dealing with security

* tptacek has, in the past, given much advice that I've considered questionable at the time, but which has proven to be right to me after I've learned enough to realize my errors

And because that all sounds very much like an appeal to authority, I apologize again, but here's the thing -- the comments he made that you object to, and consider to be trolling? They're spot on. I'm not saying that you should believe him because he has a history of making believable claims. What I am saying is that you should believe him because he's far more versed on the subject at hand than you are, and that's by your own admissions within this thread.

It's worth taking a step back here and asking yourself how well you actually know the things you think you know in regards to this thread. I am honestly not savvy enough on mobile security anywhere near capably enough to suggest that he's right and that you're wrong, so please don't assume that's what I'm doing here -- but many of the people you're arguing with in this thread are people who have the requisite bona fides to make their claims with confidence, and while you are boldly asserting the opposite, you acknowledge that this is not your field of expertise, and that you haven't bothered to learn reverse engineering.

Again, if this seems harsh, please know that it isn't intended to. Language is clumsy, and I'm not its best handler on the best of days, but while you might be 100% correct in every one of the claims you've made, the consensus seems to be otherwise, and you haven't done a good job of convincing me that you should be believed over someone who literally pays their bills through the dispensation of their subject matter expertise on this type of material.

Because of the fantastic community, it's obvious that HN is a great place to teach and to learn. Knowing which to do, and when isn't always so obvious. Most of us have made that mistake in the time. Consider whether or not you may be making it now, or figure out how to better support your claims so as to teach more effectively, but cat-pawing at each other throughout the entire thread isn't doing anyone any favors.

[tptacek]

Thanks, but I'm not even asking him to trust me in this particular subthread. The point he made, about the NSA having better reverse engineers than everyone else, really does seem to me to be a non-sequitur.

Reverse engineering isn't zero sum. The benefit you get from reverse-engineering a closed platform doesn't vanish when someone else reverse-engineers the platform, just like your ability to read open source code isn't damaged by NSA's ability to read it faster.

[jhlgkhkhil]

I've been on here for years. I just don't tend to remember my passwords very well :).

I am very familiar with the OPs posts. I do not want this to become personal. If you re-read this thread (and others in this discussion you might notice that.)

[tedunangst]

Which phone do you use that's too secure for the NSA to hack?

[nickpsecurity]

A strong, domestic TLA should be assumed to hack or intercept all of them if companies are local. Then game changes to the caller hiding their identity. Text-to-speech and burner phones can do that. However, messaging and email over WiFi's on devices bought with cash hides voice, has better clarity, allows file transfers, and can still do voice as an attachment.

[tedunangst]

If uber can figure out which burner phones are used by cops, global adversaries aren't going to have trouble with it.

[nickpsecurity]

Good for people I told to keep their burners off unless transmitting from semi-anonymous locations. That's their best privacy technique if they're non-technical.

[tedunangst]

And how well did they follow this advice? Would you know if they didn't turn their burner off, or even bother with a burner? "They didn't die in a prison camp, so they must have done things right"? Lay people who value privacy can fuck up their opsec pretty bad without noticing consequences. This is getting in to tiger repelling rocks territory, where it's no measure of one's stealth skills by hiding when nobody's looking.

[nickpsecurity]

It boils down to two areas of trust: a computer that's potentially malicious against a nation-state with stuff like QUANTUM; their ability to go somewhere remote/crowded and make calls. Im thinking lay people can do the latter because they have for ages. The latter also takes HUMINT to counter which is a precious resource they can't throw at all the reporters simultaneously like electronic attacks.