<html><head><meta http-equiv="Content-Type" content="text/html charset=windows-1252"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;">I echo nikos questions, especially question #2:<div><br></div><div><blockquote type="cite">2. How is Skype communications "encrypted so the provider can't read"<br>verified? (or even more important how is this compatible with Prism? ;))</blockquote><div><br class="webkit-block-placeholder"></div><div>Sorry if I missed it, but I searched and don't believe he received an answer.</div><div><br></div><div>It seems to me this question also applies to Apple's iMessages, which can be read by the provider:</div><div><br></div><div><a href="https://twitter.com/taoeffect/status/529841963378671618">https://twitter.com/taoeffect/status/529841963378671618</a></div><div><br class="webkit-block-placeholder"></div><div>Also, I don't believe Apple deserves the checkbox for "Are past comms secure if keys are stolen", since that does not appear to be the case:</div><div><br></div><div><a href="https://twitter.com/taoeffect/status/529852246125981696">https://twitter.com/taoeffect/status/529852246125981696</a></div><div><br></div><div>In summary, could someone please either provide an explanation for why Apple received these two checkbox, or could the EFF please update their table so that that Apple's iMessages is truthfully represented in the table?</div><div><br></div><div>Thank you,</div><div>Greg Slepak</div><div>
<br class="Apple-interchange-newline"><span style="color: rgb(0, 0, 0); font-family: Helvetica; font-size: 14px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; display: inline !important; float: none;">--</span><br style="color: rgb(0, 0, 0); font-family: Helvetica; font-size: 14px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px;"><span style="color: rgb(0, 0, 0); font-family: Helvetica; font-size: 14px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; display: inline !important; float: none;">Please do not email me anything that you are not comfortable also sharing</span><span style="color: rgb(0, 0, 0); font-family: Helvetica; font-size: 14px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; display: inline !important; float: none;"> with the NSA.</span>
</div>
<br><div><div>On Nov 4, 2014, at 10:02 AM, Nikos Roussos <<a href="mailto:comzeradd@fsfe.org">comzeradd@fsfe.org</a>> wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite">On 11/04/2014 06:43 PM, Joseph Bonneau wrote:<br><blockquote type="cite">First version launched today: <a href="https://www.eff.org/secure-messaging-scorecard">https://www.eff.org/secure-messaging-scorecard</a><br><br>This was a collaboration between tech advisers (primarily Peter<br>Eckersley and myself) and a good team of people with experience in<br>journalism and activism.<br></blockquote><br>This is indeed a great tool. Kudos for work. Some comments:<br><br>1. How is that iMessage, Facebook Chat or Hangouts are *independently*<br>audited if there is no code available?<br><br>2. How is Skype communications "encrypted so the provider can't read"<br>verified? (or even more important how is this compatible with Prism? ;))<br><br>3. There should be a column "Does is it require to provide your phone<br>number?", which should be considered a security drawback (especially for<br>journalists or their sources).<br><br>4. Probably a column for extra points if an app can easily route traffic<br>through Tor (like ChatSecure).<br><br>5. Not 100% sure, but I think that pidgin/libpurple have been audited in<br>the past.<br><br><br>~nikos<br><br><br>_______________________________________________<br>Messaging mailing list<br><a href="mailto:Messaging@moderncrypto.org">Messaging@moderncrypto.org</a><br>https://moderncrypto.org/mailman/listinfo/messaging<br></blockquote></div><br></div></body></html>