3 ms·

>I actually don't think the NSA cares about reading traffic from everyone; Im sorry but your assumtions are just wrong. We know from Snowden that they DO colle

by nickik 11y ago

>I actually don't think the NSA cares about reading traffic from everyone; Im sorry but your assumtions are just wrong. We know from Snowden that they DO collect all the data and have suffisticated search and anlysis tools for things like social graphs. They want to know with whom the targets talk. Thats why they are doing it. > The NSA is a government agency tasked with the mission of intelligence gathering outside the US. That does not stop them from doing it inside. > Intelligence is far more valuable when you know something and others don't. Backdoors in crypto or hardware are extremly hard to find and if you pit them in, you have a huge advantage for a long time or forever. > The NSA has a huge advantage over those other countries' spy agencies in the form of resources; Breaking encryption with brute force just does not work. We know from the snowden leaks that they almost never go after the crypto directly. Even if they can break RSA 4096, try breaking all the millions of https connections a day. Its even worse if its not public key crypto. Its hard enough collect the data without breaking encryption first. You can also combine the too. They made sure that RSA used a weak default that they could break.

tptacek 11y ago
You haven't rebutted his argument by adding this extra detail. Much of the personal communications infrastructure of the Internet is housed in the US; foreign targets of US intelligence use these services. It makes sense that NSA wants access to that data, and that their mission is harmed by US Internet services that provide an easy-to-use refuge from surveillance for the country's adversaries. (I'm not making a normative argument). I don't know what you mean by "weak defaults in RSA". You mean RSA-1024? People use RSA-1024 because, especially during the time period where TLS began being rolled out to non-commerce websites, RSA-2048 was prohibitively expensive.
- nickik 11y ago
  I was talking about the company itself. I would have to look up the exact case.
  - tptacek 11y ago
    You mean the (very plausible) allegation that NSA paid RSA to backdoor BSAFE, their commercial RSA library, by using Dual_EC as their default RNG. But that doesn't help your argument much either: the targets that used BSAFE were much more likely to be foreign and much less likely to be large-scale US communications infrastructure, virtually none of which uses BSAFE-encumbered software. Just a reminder to other readers: RSA was originally the company formed in the 80s to commercialize the RSA algorithm IP. But in the mid-90s, a hardware token company called SDTI bought them and took over the RSA name. Tokens and enterprise multifactor auth have been the mainstay lines of business at RSA ever since, not crypto libraries.

by nickik 11y ago

tptacek 11y ago

You haven't rebutted his argument by adding this extra detail. Much of the personal communications infrastructure of the Internet is housed in the US; foreign targets of US intelligence use these services. It makes sense that NSA wants access to that data, and that their mission is harmed by US Internet services that provide an easy-to-use refuge from surveillance for the country's adversaries. (I'm not making a normative argument). I don't know what you mean by "weak defaults in RSA". You mean RSA-1024? People use RSA-1024 because, especially during the time period where TLS began being rolled out to non-commerce websites, RSA-2048 was prohibitively expensive.

nickik 11y ago
I was talking about the company itself. I would have to look up the exact case.
- tptacek 11y ago
  You mean the (very plausible) allegation that NSA paid RSA to backdoor BSAFE, their commercial RSA library, by using Dual_EC as their default RNG. But that doesn't help your argument much either: the targets that used BSAFE were much more likely to be foreign and much less likely to be large-scale US communications infrastructure, virtually none of which uses BSAFE-encumbered software. Just a reminder to other readers: RSA was originally the company formed in the 80s to commercialize the RSA algorithm IP. But in the mid-90s, a hardware token company called SDTI bought them and took over the RSA name. Tokens and enterprise multifactor auth have been the mainstay lines of business at RSA ever since, not crypto libraries.