undefined | Better HN

0 pointsDanBC12y ago0 comments

> You can build a webapp that is only ever downloaded once, and from then on loads its own code from the filesystem; and which verifies new "releases" of its own source using whatever crypto it likes before overwriting the client-side stored copies of itself.

But if you don't trust Hushmail they could force a back-doored update onto you.

0 comments

4 comments · 1 top-level

derefr12y ago· 3 in thread

At that point you've got "well, that's not worse than anything else, then" security. The NSA, for example, could MITM your computer's connection to Ubuntu's update servers, FISA a sysadmin for a copy of their package signing key, and inject a "critical security update" only for you. Auto-update systems are suspicious as a whole, now, and should only be trusted in general as a compromise to convenience, and the statistical unlikelihood of you being attacked.

DanBCOP12y ago

But this is why risk assessment is part of choosing and using crypto.

If you think the NSA is after you then all bets are off and whatever you're doing is probably not working because most people don't have an armoured bunker with armed guards. We need to be careful to differentiate between active NSA snooping (in which case anything we do is probably weak) and passive snooping (where we just want to make it expensive enough for them to not bother with our communications).

But if you think the FBI is after you then you'll want to avoid something that can be done by a court order - such as your encrypted email provider being forced to serve you a malformed client that allows law enforcement to view all your communications. This is a real risk, and is what happened to Hushmail.

lmm12y ago

If you're running a decent linux you can turn auto-update off. No browser will let you do that.

derefr12y ago

All the portable-app versions of Chrome and Firefox (for example, the Firefox that comes with the Tor bundle) have auto-update disabled, for both the browser, and included extensions.

1 more reply

j / k navigate · click thread line to collapse