3 ms·

It should have been obvious to the project team that the hole would be noted, or suspected if the details were obfuscated. I'm more concerned about the waste of

It should have been obvious to the project team that the hole would be noted, or suspected if the details were obfuscated. I'm more concerned about the waste of public money on a doomed project.

toyg 11y ago
Why "doomed"? Public bodies will adopt it. People who need to work with public bodies will adopt it. And sooner or later, ISPs will be forced to adopt it. The protocol is working as expected. It doesn't have to be technologically superior to win adoption, it will be mandated by law. It just has to be good enough for the purpose it was developed: to provide an obfuscation layer that can "keep out" casual intruders while allowing unfettered access to the security apparatus (I won't say "law-enforcement officers" because these people are actually law-breaking).
- SideburnsOfDoom 11y ago
  It's not just that there's a half-open back door that GCHQ knows all about; now there's a half-open back door that everyone knows exists. If you wanted to break in, that's a big help to you. Why adopt this now, when sooner or later the back door will be wide open to everyone?
  - toyg 11y ago
    You don't understand -- this protocol is not supposed to be bulletproof. It's supposed to be good enough to be considered a step up from the status-quo for certain uses from a legal perspective. You won't get the choice to get on board: who has to be onboarded will be legally forced to do so. If you have the resources and know-how, the current telephone system is not very hard to break into; but you don't get the choice of what protocol to use when connecting a phone to the network. This is the modern equivalent.
    - SideburnsOfDoom 11y ago
      > this protocol is not supposed to be bulletproof. It's supposed to be good enough to be considered a step up from the status-quo ... the current telephone system is not very hard to break into ... This is the modern equivalent. I see. Though I would also suggest that the status quo is unsustainable: ever since May 2013 it has become increasingly clear that things can't carry on as before; a minor "step up" to a modern equivalent is not enough for modern times.
- conjectures 11y ago
  "People who need to work with public bodies will adopt it." Meaning the public sector will pay more for bespoke software. Everyone else will most likely ignore it as an option. Who wants to invest in an 'ecosystem' built on an insecure security feature? How do you sell that to users: "with our voice calls nobody can eavesdrop on you, except, umm, the government and telcos."

It should have been obvious to the project team that the hole would be noted, or suspected if the details were obfuscated. I'm more concerned about the waste of public money on a doomed project.

toyg 11y ago

Why "doomed"? Public bodies will adopt it. People who need to work with public bodies will adopt it. And sooner or later, ISPs will be forced to adopt it. The protocol is working as expected. It doesn't have to be technologically superior to win adoption, it will be mandated by law. It just has to be good enough for the purpose it was developed: to provide an obfuscation layer that can "keep out" casual intruders while allowing unfettered access to the security apparatus (I won't say "law-enforcement officers" because these people are actually law-breaking).

SideburnsOfDoom 11y ago
It's not just that there's a half-open back door that GCHQ knows all about; now there's a half-open back door that everyone knows exists. If you wanted to break in, that's a big help to you. Why adopt this now, when sooner or later the back door will be wide open to everyone?
- toyg 11y ago
  You don't understand -- this protocol is not supposed to be bulletproof. It's supposed to be good enough to be considered a step up from the status-quo for certain uses from a legal perspective. You won't get the choice to get on board: who has to be onboarded will be legally forced to do so. If you have the resources and know-how, the current telephone system is not very hard to break into; but you don't get the choice of what protocol to use when connecting a phone to the network. This is the modern equivalent.
  - SideburnsOfDoom 11y ago
    > this protocol is not supposed to be bulletproof. It's supposed to be good enough to be considered a step up from the status-quo ... the current telephone system is not very hard to break into ... This is the modern equivalent. I see. Though I would also suggest that the status quo is unsustainable: ever since May 2013 it has become increasingly clear that things can't carry on as before; a minor "step up" to a modern equivalent is not enough for modern times.
conjectures 11y ago
"People who need to work with public bodies will adopt it." Meaning the public sector will pay more for bespoke software. Everyone else will most likely ignore it as an option. Who wants to invest in an 'ecosystem' built on an insecure security feature? How do you sell that to users: "with our voice calls nobody can eavesdrop on you, except, umm, the government and telcos."