To clarify, the most criticism that the EFF secure messaging scorecard had was:
* CryptoCat got a perfect rating, despite it's long history of insecurity, attack vectors, and questionable audits.
* Skype got rated more favorably then is likely the truth. It has since been corrected though.
* PGP got buried as a recommendation.
* A good number of tools were missing on initial release.
The big issue with the scorecard is the lack of rigid definitions, such as code audits. Developers will audit and review each other's code all the time. But most won't qualify that as a "security audit". So, does a security audit require a cryptographer to audit the code? A third party security agency? How in depth do audits go? Are there any standards or "best practices" to go by when auditing crypto code, or is it just a rubber stamp?
With that said, it does list (incompletely) a good set of tools that you can investigate, that you may not have heard of.
Comments
To clarify, the most criticism that the EFF secure messaging scorecard had was:
* CryptoCat got a perfect rating, despite it's long history of insecurity, attack vectors, and questionable audits.
* Skype got rated more favorably then is likely the truth. It has since been corrected though.
* PGP got buried as a recommendation.
* A good number of tools were missing on initial release.
The big issue with the scorecard is the lack of rigid definitions, such as code audits. Developers will audit and review each other's code all the time. But most won't qualify that as a "security audit". So, does a security audit require a cryptographer to audit the code? A third party security agency? How in depth do audits go? Are there any standards or "best practices" to go by when auditing crypto code, or is it just a rubber stamp?
With that said, it does list (incompletely) a good set of tools that you can investigate, that you may not have heard of.