Preferences

TL;DR: An EU health data firm run by ex-military cryptographers offers a web portal for encrypting documents, which inherently exposes unencrypted documents to the company and US national security laws. The media outlet incidentally also doubts the trustworthiness of military veterans from Israel.

Even following the "if there's smoke there's fire" model, unclear there's a strong scent of "smoke" here. One could write a similar guilt-by-historical-association article concerning anyone, in the same position, really. Obviously if you're uploading a file to a 3d party website, the vendor has some technical access, this should be warned.


The bigger problem is that this model is inherently flawed. Even if end-to-end encryption with browser crypto were implemented, there is never any security since the code in the browser can simply be swapped with compromised code that diverts the plaintext somewhere.

I've been forced to use this service, by way of healthcare professionals just disclosing correspondence to this service without asking for my consent.

Smeerlappen.

> there is never any security since the code in the browser can simply be swapped with compromised code that diverts the plaintext somewhere.

This is not the case in the land of DICE-like key derivation; see TKey protocol for example. You can download and run an actual rv32 program on actual FPGA over WebUSB without having to worry about its provenance. If the program is modified, firmware will derive a completely different key.

Zivver is a web application. The javascript that comes with the webpage can change at any time for any reason, as Zivver sees fit.
I'm simply pointing out that web standards allow for secure end-to-end communication, and more, in fact they happen to allow arbitrary cryptographic constructions—as long as the program itself never changes.
But this requires special hardware right?
Not necessarily. You can run TKey in qemu :-) etc. The hardware aspect is what makes it easy to use, with WebUSB and all. The derivation algorithm is key. And it takes program binary as parameter to Blake2 hash function.
Security is an illusion.
Then reply with your passwords.
******

Luckily HN automatically detects when you post your password and obfuscates it with * - try it out yourself!

You think I was born yesterday :P

This item has no comments currently.

Keyboard Shortcuts

Story Lists

j
Next story
k
Previous story
Shift+j
Last story
Shift+k
First story
o Enter
Go to story URL
c
Go to comments
u
Go to author

Navigation

Shift+t
Go to top stories
Shift+n
Go to new stories
Shift+b
Go to best stories
Shift+a
Go to Ask HN
Shift+s
Go to Show HN

Miscellaneous

?
Show this modal