5 ms·

Isn't the much simpler explanation that, for particular servers, they either have permission (e.g. companies have agreed to hand over the encryption keys or all

Isn't the much simpler explanation that, for particular servers, they either have permission (e.g. companies have agreed to hand over the encryption keys or allow monitoring of the data after it is unencrypted on arrival) or some other means (man-in-the-middle attacks, server backdoors, hacking vulnerable software) to bypass the encryption entirely without you knowing? For instance, I find the idea that they would direct huge amounts of computing power to crack individual keys implausible given the previous example methods are so much easier.

redblacktree 11y ago
I agree. The NSA is probably mostly investing in the five-dollar wrench. https://xkcd.com/538/ https://xkcd.com/538/
- sarciszewski 11y ago
  Why spend $5 on a wrench when you can make a phone call to the FBI and compromise any server on US soil? These cryptanalytic capabilities are mostly relevant for servers hosted outside the US, I'd wager.
  - acqq 11y ago
    For the servers outside, the case that happened in Greece after the Olympic games as an example of something much, much bigger but conceptually still more an immense "wrench" than a "cryptanalytic" approach: https://theintercept.com/2015/09/28/death-athens-rogue-nsa-operation/ https://theintercept.com/2015/09/28/death-athens-rogue-nsa-o...
- kllrnohj 11y ago
  The five-dollar wrench doesn't allow for passive collection. You kinda know when you get hit with a wrench.
  - redblacktree 11y ago
    I was thinking more about NSLs and threats to companies to force them to hand over their encryption keys.
- seanwilson 11y ago
  I always considered the "crypto nerd's imagination" panel in the comic to be that the NSA have computational and/or cryptanalysis breakthroughs and super computers so far ahead of anyone else that they can crack almost anything. My guess is that in reality things are much plainer and they can rely on cooperation and server hacks.
  - Spooky23 11y ago
    They very well may. For all we know, some of the Snowden revelations are distractions from some breakthrough, designed to protect the real secrets. The scale out of the NSA capabilities may have become an issue -- adversaries have figured out that the US knows too much, as people get blown up when they pick up the phone.
eli 11y ago
Every time you hack a server or strongarm an engineer you risk detection. Breaking a widely used key would be mostly invisible and seems to better fit the description of capabilities described in their documents.
- wahsd 11y ago
  When you introduced the cascading vulnerability at the most fundamental level, you have a key to everything. Society, humanity even, would be best off scuttling any fundamental technology and everything that has not been thoroughly and fully vetted by multiple diverse and counter-interested groups of individuals. Remember, the most fundamental protocols and technologies were built on and with government funding, which directly injects the interests of long-view organizations.
  - morley 11y ago
    Excuse my ignorance in this -- is there any verifiable evidence that such a fundamental cascading vulnerability exists, and was the result of an NSA action, or are you speaking in hypotheticals?
  - caskance 11y ago
    Or you could simply lie and tell people it's been thoroughly and fully vetted by multiple diverse and counter-interested groups of individuals. Those claims won't undergo the same scrutiny. They can't - otherwise it'd be vetting all the way down.
kllrnohj 11y ago
> they either have permission (e.g. companies have agreed to hand over the encryption keys or allow monitoring of the data after it is unencrypted on arrival) No, because nobody would do that and the NSA has no legal authority with which to force that. Companies wouldn't agree to this because they have everything to lose and nothing to gain. It's not like the NSA could even offer them favors in exchange, as the entire thing is ultra-classified. Also there's exactly zero chance this would ever be able to be kept secret. Companies can't even keep their products secret for the few months it takes from prototypes to launch, there's no way in hell the NSA would trust them to keep this secret for years. The first sys admin forced to do this would instantly talk about it. > some other means (man-in-the-middle attacks, server backdoors, hacking vulnerable software) to bypass the encryption entirely The article talks about this. That's definitely possible, but it's much more targetted and doesn't fit the scale that the Snowden leaks suggested the NSA was achieving.
- seanwilson 11y ago
  > No, because nobody would do that and the NSA has no legal authority with which to force that. Companies wouldn't agree to this because they have everything to lose and nothing to gain. Not claiming I'm well read up on this but wasn't a big part of the leaks that companies were cooperating with the NSA in secret? http://www.wired.com/2014/01/how-the-us-almost-killed-the-internet/ http://www.wired.com/2014/01/how-the-us-almost-killed-the-in... "Gellman wanted to be the first to expose a top-secret NSA program called Prism. Snowden’s files indicated that some of the biggest companies on the web had granted the NSA and FBI direct access to their servers, giving the agencies the ability to grab a person’s audio, video, photos, emails, and documents."
  - wavefunction 11y ago
    Not only that, these companies (AT&T) for example get paid to provide the access.
  - arebop 11y ago
    No, the prism leaks show that the NSA had access to data. It is often implied by various commentators that the access was facilitated by the companies, but there's no evidence to support that. The evidence about companies cooperating with NSA on mass surveillance came out in the first decade of the 2000s, e.g., http://www.salon.com/2006/06/21/att_nsa/ http://www.salon.com/2006/06/21/att_nsa/ and https://en.wikipedia.org/wiki/Room_641A https://en.wikipedia.org/wiki/Room_641A
junto 11y ago
It is surely easier to target and then hack specific engineers at VPN and certificate authorities, then steal their private keys and bingo, a great little lookup key database. GCHQ and Belgacom spring to mind: http://www.spiegel.de/international/europe/british-spy-agency-gchq-hacked-belgian-telecoms-firm-a-923406.html http://www.spiegel.de/international/europe/british-spy-agenc... Let's have a show of hands. Anyone got unencrypted private keys on their machine or on their server? How hard is it to steal those? http://security.stackexchange.com/questions/25437/what-issues-arise-from-sharing-a-ssl-certificates-private-key http://security.stackexchange.com/questions/25437/what-issue... http://www.symantec.com/connect/blogs/how-attackers-steal-private-keys-digital-certificates http://www.symantec.com/connect/blogs/how-attackers-steal-pr...
- deleted 11y ago
  [deleted]
- abrahamepton 11y ago
  Perhaps they do both.
  - AnimalMuppet 11y ago
    Perhaps?

redblacktree 11y ago

I agree. The NSA is probably mostly investing in the five-dollar wrench. https://xkcd.com/538/ https://xkcd.com/538/

sarciszewski 11y ago
Why spend $5 on a wrench when you can make a phone call to the FBI and compromise any server on US soil? These cryptanalytic capabilities are mostly relevant for servers hosted outside the US, I'd wager.
- acqq 11y ago
  For the servers outside, the case that happened in Greece after the Olympic games as an example of something much, much bigger but conceptually still more an immense "wrench" than a "cryptanalytic" approach: https://theintercept.com/2015/09/28/death-athens-rogue-nsa-operation/ https://theintercept.com/2015/09/28/death-athens-rogue-nsa-o...
kllrnohj 11y ago
The five-dollar wrench doesn't allow for passive collection. You kinda know when you get hit with a wrench.
- redblacktree 11y ago
  I was thinking more about NSLs and threats to companies to force them to hand over their encryption keys.
seanwilson 11y ago
I always considered the "crypto nerd's imagination" panel in the comic to be that the NSA have computational and/or cryptanalysis breakthroughs and super computers so far ahead of anyone else that they can crack almost anything. My guess is that in reality things are much plainer and they can rely on cooperation and server hacks.
- Spooky23 11y ago
  They very well may. For all we know, some of the Snowden revelations are distractions from some breakthrough, designed to protect the real secrets. The scale out of the NSA capabilities may have become an issue -- adversaries have figured out that the US knows too much, as people get blown up when they pick up the phone.

eli 11y ago

Every time you hack a server or strongarm an engineer you risk detection. Breaking a widely used key would be mostly invisible and seems to better fit the description of capabilities described in their documents.

wahsd 11y ago
When you introduced the cascading vulnerability at the most fundamental level, you have a key to everything. Society, humanity even, would be best off scuttling any fundamental technology and everything that has not been thoroughly and fully vetted by multiple diverse and counter-interested groups of individuals. Remember, the most fundamental protocols and technologies were built on and with government funding, which directly injects the interests of long-view organizations.
- morley 11y ago
  Excuse my ignorance in this -- is there any verifiable evidence that such a fundamental cascading vulnerability exists, and was the result of an NSA action, or are you speaking in hypotheticals?
- caskance 11y ago
  Or you could simply lie and tell people it's been thoroughly and fully vetted by multiple diverse and counter-interested groups of individuals. Those claims won't undergo the same scrutiny. They can't - otherwise it'd be vetting all the way down.

kllrnohj 11y ago

> they either have permission (e.g. companies have agreed to hand over the encryption keys or allow monitoring of the data after it is unencrypted on arrival) No, because nobody would do that and the NSA has no legal authority with which to force that. Companies wouldn't agree to this because they have everything to lose and nothing to gain. It's not like the NSA could even offer them favors in exchange, as the entire thing is ultra-classified. Also there's exactly zero chance this would ever be able to be kept secret. Companies can't even keep their products secret for the few months it takes from prototypes to launch, there's no way in hell the NSA would trust them to keep this secret for years. The first sys admin forced to do this would instantly talk about it. > some other means (man-in-the-middle attacks, server backdoors, hacking vulnerable software) to bypass the encryption entirely The article talks about this. That's definitely possible, but it's much more targetted and doesn't fit the scale that the Snowden leaks suggested the NSA was achieving.

seanwilson 11y ago
> No, because nobody would do that and the NSA has no legal authority with which to force that. Companies wouldn't agree to this because they have everything to lose and nothing to gain. Not claiming I'm well read up on this but wasn't a big part of the leaks that companies were cooperating with the NSA in secret? http://www.wired.com/2014/01/how-the-us-almost-killed-the-internet/ http://www.wired.com/2014/01/how-the-us-almost-killed-the-in... "Gellman wanted to be the first to expose a top-secret NSA program called Prism. Snowden’s files indicated that some of the biggest companies on the web had granted the NSA and FBI direct access to their servers, giving the agencies the ability to grab a person’s audio, video, photos, emails, and documents."
- wavefunction 11y ago
  Not only that, these companies (AT&T) for example get paid to provide the access.
- arebop 11y ago
  No, the prism leaks show that the NSA had access to data. It is often implied by various commentators that the access was facilitated by the companies, but there's no evidence to support that. The evidence about companies cooperating with NSA on mass surveillance came out in the first decade of the 2000s, e.g., http://www.salon.com/2006/06/21/att_nsa/ http://www.salon.com/2006/06/21/att_nsa/ and https://en.wikipedia.org/wiki/Room_641A https://en.wikipedia.org/wiki/Room_641A

junto 11y ago

It is surely easier to target and then hack specific engineers at VPN and certificate authorities, then steal their private keys and bingo, a great little lookup key database. GCHQ and Belgacom spring to mind: http://www.spiegel.de/international/europe/british-spy-agency-gchq-hacked-belgian-telecoms-firm-a-923406.html http://www.spiegel.de/international/europe/british-spy-agenc... Let's have a show of hands. Anyone got unencrypted private keys on their machine or on their server? How hard is it to steal those? http://security.stackexchange.com/questions/25437/what-issues-arise-from-sharing-a-ssl-certificates-private-key http://security.stackexchange.com/questions/25437/what-issue... http://www.symantec.com/connect/blogs/how-attackers-steal-private-keys-digital-certificates http://www.symantec.com/connect/blogs/how-attackers-steal-pr...

deleted 11y ago
[deleted]
abrahamepton 11y ago
Perhaps they do both.
- AnimalMuppet 11y ago
  Perhaps?