Cerebro Softwing Lab

Is Open Source an Open Invitation to Hack Webmail Encryption?
In a move influenced by Edward Snowden's revelations about the NSA's email snooping, Yahoo and Google last week announced that they were cooperating on end-to-end encrypting their webmail products.

"We will release source code this fall so that the open source community can help us refine the experience and hunt for bugs," said Yahoo Chief Information Security Officer John Stamos.

While the open source approach to software development has proven its value over and over again, the idea of opening up the code for security features to anyone with eyeballs still creates anxiety in some circles. Such worries are ill-founded, though.

One concern about opening up security code to anyone is that anyone will include the NSA, which has a habit of discovering vulnerabilities and sitting on them so it can exploit them at a later time. Such discoveries shouldn't be a cause of concern, argued Phil Zimmermann, creator of PGP, the encryption scheme Yahoo and Google will be using for their webmail.

"If someone does find a bug and sits on it, someone else will find the same bug and not sit on it," he told TechNewsWorld. "That's why you want to have a lot of people looking at the code."