The grugq, an independent security researcher, writes about operational security, intelligence, and how activists and travelers can protect themselves.
HN commenters cite it for its analysis of nation-state cyber conflict and for its correction of bad travel security advice.
And yet according to these sources[0][1], Firefox is back this year in Pwn2own. A quote from [1]:
> "Mozilla improved their security enough for us to warrant their re-inclusion in the contest," Gorenc said.
Firefox is fine. Like in every other browser, when security problems are found, they are fixed. There's a lot of work going into making Firefox a great and secure browser, and to call for abandoning it en masse is unwarranted IMO.
Edit: Heck, isn't it your own link[2] that claims that one of the security problems with Tor is their homogeny, that they all use the same browser and version? By that logic, abandoning Firefox is a bad move for overall security.
[0] https://blog.trendmicro.com/pwn2own-returns-for-2017-to-celebrate-10-years-of-exploits/
[1] http://www.eweek.com/security/pwn2own-2017-takes-aim-at-linux-servers-and-web-browsers.html
[2] https://medium.com/@thegrugq/tor-and-its-discontents-ef5164845908
> I've been using Firefox for years without any problems and find it much better (just as fast, more privacy-minded) than chrome.
Then you must not value security at all.
Firefox is by far the worst of the modern browsers in how easy it's to exploit. Don't listen to me, listen to the experts [1] [2] [3]
I would go as far as to say that if Firefox is your main browser, odds are you're owned by multiple parties, and I don't mean nation states. This can not be fixed by iterative improvements, Firefox needs to die. By far the best thing you can do for your online peace of mind is to switch to Chromium/Chrome or (on Windows only) Edge.
[1] https://twitter.com/thegrugq/status/803693249789509632
[2] https://medium.com/@thegrugq/tor-and-its-discontents-ef5164845908
[3] https://it.slashdot.org/story/16/02/12/034206/pwn2own-2016-wont-attack-firefox-because-its-too-easy
As the grugq has pointed out, incentives are not currently aligned properly to produce secure industrial systems:
"Firstly, a lot of infrastructure and data is in civilian hands. The people and organizations responsible for securing things are not the ones responsible for retaliating against attacks. They can’t do it anyway because they lack the resources, capability, and legal authority to do so.
As for investing in securing their systems, there is no regulatory requirement to do so. Indeed, for a board of directors, I’ve seen it suggested that they have a fiduciary duty to shareholders not to bear the cost burden of securing critical national infrastructure. It’s not their business to directly bear the costs of defending the nation, that’s what the nation state is for in the first place!"
https://medium.com/@thegrugq/idle-thoughts-on-cyber-82170b2b7280
First, you're not wrong about Signal being insufficient against nation state adversaries. The Grugq has a nice talk about opsec that I can't seem to find atm. He sums up the issues with Signal nicely in a Medium article. [1]
That said, this particular development is a lot more than a puppy. It's at least a full grown, happy, friendly Golden Retriever who's already house trained and knows how to fetch your slippers.
They've removed one of the biggest remaining weaknesses of their system, where they still required the users to "just trust" them. That's pretty cool, especially for the vast majority of us whose primary adversaries are smaller or profit-driven.
[1] https://medium.com/@thegrugq/signal-intelligence-free-for-all-5993c2f72f90
Security people recommend Signal a lot (e.g. https://medium.com/@thegrugq/signal-intelligence-free-for-all-5993c2f72f90, Snowden uses it and repeatedly recommended it: https://twitter.com/Snowden/status/661313394906161152, ...). Personally, I use it all the time and it's nice. Most of the initial problems have been sorted out, so I encourage anyone who's had trouble with it before to try it out again.
It has text (one-on-one and groups) and voice calls. Things that could use improvement: group management, switching to a new device. It doesn't have some of the features some people like (stickers and whatnot), but personally I don't care much about those. Video calls would also be nice.
I don't have time to list everyone, but a few off-hand:
For crypto, Matt Green: https://twitter.com/matthew_d_green https://blog.cryptographyengineering.com/
For cybercrime, Brian Krebs (though I would call him an investigative journalist rather than an expert): https://krebsonsecurity.com/
For intelligence/counterintelligence/OPSEC, thegrugq: https://twitter.com/thegrugq https://medium.com/@thegrugq
A few of these can occasionally be biased when there's a political edge to something, but some others I trust: Moxie Marlinspike, Daniel Bernstein, Dan Kaminsky, Rob Graham, Thomas Ptacek, Michał Zalewski, @SwiftOnSecurity (semi-parody account, but trustworthy info), Tavis Ormandy