4 ms·

When it comes to securing ourselves, anything coming from the NSA should be treated as some form of disinformation. The NSA betrayed its "information security"

When it comes to securing ourselves, anything coming from the NSA should be treated as some form of disinformation. The NSA betrayed its "information security" brief long ago and can never be trusted on that front again. We are all better off keeping up with and following consensus best practices and ignoring the NSA, rather than trying to out-think their latest bit of disinformation.

nickpsecurity 11y ago
"When it comes to securing ourselves, anything coming from the NSA should be treated as some form of disinformation." "The NSA betrayed its "information security" brief long ago and can never be trusted on that front again." Err, sort of. They were a valuable part of the field in the 80's and 90's, esp for evaluations. Their own stuff that's actually designed for security is done well and has some things to teach us. These are often called Type 1 products, GOTS high-security, and so on. They're not available to the general public because they work. ;) Here's an accurate picture of DOD/NSA's involvement in creating INFOSEC in business and destroying it later for politics/legal/business/intel reasons from one of old guard: http://lukemuehlhauser.com/wp-content/uploads/Bell-Looking-Back-Addendum.pdf http://lukemuehlhauser.com/wp-content/uploads/Bell-Looking-B... The reasons they stopped pushing it aren't even clear to me at this point. Individuals and businesses rejected almost all high-security products in favor of maximal features, backward compatibility w/ insecure stuff, integration with insecure stuff, faster even if unsafe (eg C lang), cheaper even if less safe, and smaller even if forcing insecure integrations. This was true before, during, and after Walker's CSI. Still is post-Snowden as real security cost money and has tradeoffs that most users refuse. So, the reason we're getting hacked all the time & NSA's IAD is doing little isn't really NSA: it's demand side where people refuse to do anything secure and use insecure stuff en masse. This is true even with usable alternatives: Facebook Messenger vs Threema or whatever; no disk protection vs Truecrypt full disk; no backups vs automated backups to USB; paid, non-snooping, $5/month email vs free, sell-you-out email. Convenience or price almost always win out. So, NSA could disappear entirely and our situation would still be the same. Plus, they deserve credit for their participation in high assurance stuff that stops even them, which is published in enough detail to copy, and which continues to this day. Example on CPU side: http://www.ccs.neu.edu/home/pete/acl206/slides/hardin.pdf http://www.ccs.neu.edu/home/pete/acl206/slides/hardin.pdf https://www.nsa.gov/ia/programs/inline_media_encryptor/ https://www.nsa.gov/ia/programs/inline_media_encryptor/ https://www.nsa.gov/applications/ia/tempest/index.cfm https://www.nsa.gov/applications/ia/tempest/index.cfm So, no, you're best off learning what CompSci, DOD, NSA, and INFOSEC's founders taught us under the banner of high assurance security. Ignore whatever they teach general public or business unless trustworthy pro's will peer review it. Best practices are insufficient as they don't address lifecycle assurance of computer hardware or software. They leave in the vulnerabilities NSA and black hats will continue to hit. So, one must from bottom to top apply high-security techniques to make a better stack. Even post-Snowden, that activity is pretty much non-existent enough that I can count the projects on one or both hands. I rest my case about the problem being on demand and supply sides.
rosser 11y ago
While I trust the NSA about as far as I could throw the Puzzle Palace, I think you're overstating. Part of their brief, however obscured by their reprehensible behavior of late, is to help defend US-based economic interests against foreign intelligence, governmental or private.

nickpsecurity 11y ago

"When it comes to securing ourselves, anything coming from the NSA should be treated as some form of disinformation." "The NSA betrayed its "information security" brief long ago and can never be trusted on that front again." Err, sort of. They were a valuable part of the field in the 80's and 90's, esp for evaluations. Their own stuff that's actually designed for security is done well and has some things to teach us. These are often called Type 1 products, GOTS high-security, and so on. They're not available to the general public because they work. ;) Here's an accurate picture of DOD/NSA's involvement in creating INFOSEC in business and destroying it later for politics/legal/business/intel reasons from one of old guard: http://lukemuehlhauser.com/wp-content/uploads/Bell-Looking-Back-Addendum.pdf http://lukemuehlhauser.com/wp-content/uploads/Bell-Looking-B... The reasons they stopped pushing it aren't even clear to me at this point. Individuals and businesses rejected almost all high-security products in favor of maximal features, backward compatibility w/ insecure stuff, integration with insecure stuff, faster even if unsafe (eg C lang), cheaper even if less safe, and smaller even if forcing insecure integrations. This was true before, during, and after Walker's CSI. Still is post-Snowden as real security cost money and has tradeoffs that most users refuse. So, the reason we're getting hacked all the time & NSA's IAD is doing little isn't really NSA: it's demand side where people refuse to do anything secure and use insecure stuff en masse. This is true even with usable alternatives: Facebook Messenger vs Threema or whatever; no disk protection vs Truecrypt full disk; no backups vs automated backups to USB; paid, non-snooping, $5/month email vs free, sell-you-out email. Convenience or price almost always win out. So, NSA could disappear entirely and our situation would still be the same. Plus, they deserve credit for their participation in high assurance stuff that stops even them, which is published in enough detail to copy, and which continues to this day. Example on CPU side: http://www.ccs.neu.edu/home/pete/acl206/slides/hardin.pdf http://www.ccs.neu.edu/home/pete/acl206/slides/hardin.pdf https://www.nsa.gov/ia/programs/inline_media_encryptor/ https://www.nsa.gov/ia/programs/inline_media_encryptor/ https://www.nsa.gov/applications/ia/tempest/index.cfm https://www.nsa.gov/applications/ia/tempest/index.cfm So, no, you're best off learning what CompSci, DOD, NSA, and INFOSEC's founders taught us under the banner of high assurance security. Ignore whatever they teach general public or business unless trustworthy pro's will peer review it. Best practices are insufficient as they don't address lifecycle assurance of computer hardware or software. They leave in the vulnerabilities NSA and black hats will continue to hit. So, one must from bottom to top apply high-security techniques to make a better stack. Even post-Snowden, that activity is pretty much non-existent enough that I can count the projects on one or both hands. I rest my case about the problem being on demand and supply sides.

rosser 11y ago

While I trust the NSA about as far as I could throw the Puzzle Palace, I think you're overstating. Part of their brief, however obscured by their reprehensible behavior of late, is to help defend US-based economic interests against foreign intelligence, governmental or private.