5 ms·

There's still this meme out there that anyone who thinks the government might be doing something nefarious is a "conspiracy theorist." People around here tend t

by api 11y ago

There's still this meme out there that anyone who thinks the government might be doing something nefarious is a "conspiracy theorist." People around here tend to want to be upper-class educated no-nonsense rational types of people, which means you can't be entertaining woo-woo conspiracy theories. I think this is a lazy broken heuristic that ends up labeling all social criticism and all allegations (even if credible) as "crazy." It's very Soviet-- you are mentally ill if you disagree with the government. The problem is that we have hard documentation that governments (including but not limited to the USA) have run actual named and funded programs and efforts with the explicit intent of sabotaging crypto available in the public market. It's not even a "theory." It's established historical fact. Believing the queen of England is a shape shifting reptile or that we didn't go to the Moon is a woo-woo conspiracy theory. Believing in things with a hard paper trail is not, nor is entertaining the possibility that governments might be doing things that we know for a fact they have done in the past.

pdkl95 11y ago
> It's very Soviet It's not only a Soviet phenomena; American politics has utilized a "paranoid style"[1] for a long time. > sabotaging crypto It seems like a lot of people are pretending that BULLRUN doesn't exist. Nobody wants to believe that a coworker might be a collaborator; that kind of thinking can easily erode trust and create paranoia even when it isn't warranted. Unfortunately, the program exists so it's foolish to ignore the probability that it is still working to weaken crypto. As PHK explain in "Operation Orchestra", encouraging weak crypto is much cheaper than breaking real crypto. [1] https://en.wikipedia.org/wiki/The_Paranoid_Style_in_American_Politics https://en.wikipedia.org/wiki/The_Paranoid_Style_in_American...
pvg 11y ago
A nefarious, diabolically clever government wants to compromise this device and then telegraphs that intent to the world by forcing the software to go closed source - that is absolutely an irrational and silly conspiracy theory. To believe that you have to believe that the government is both nefarious, diabolically clever and cartoonishly inept.
- TheSpiceIsLife 11y ago
  Absolutely most certainly yes all three of those things. Nefarious: government is, I contend, only that group of criminals we have collectively decided we would be better to regulate and pay off. I'm not saying this is a bad thing, we certainly need some regulation and law enforcement, etc. Diabolically clever: the word means 'characteristic of the devil' - government is responsible for torturing people, killing people in pointless wars, etc. Cartoonishly inept: for sure! you only have to go outside, pick up a news paper, browse a news website, to see how incompetent government can be. But, we tend to speak of 'government' as some cohesive whole, which it most certainly is not. Is any one branch or agency of government all three of those things at all time? I don't think so. Some parts of government do a fine job of administering their responsibilities, some of the time. Probably. Maybe.
  - dfc 11y ago
    > Cartoonishly inept Can you name one medium to large (resources and headcount) organization that has existed for 20 years that could not be called cartoonishly inept by its detractors?
    - patrickmclaren 10y ago
      Amazon comes to mind.
  - pvg 11y ago
    So you wanted to let me know you deliberately misunderstood my point but then, wait, how clever, you did not. I don't follow.
- mindslight 11y ago
  And this is exactly the type of strawman that usually accompanies the "conspiracy theory" bashing. You've chosen the strongest-claiming narrative, which is easily knocked down. The simplest scenario isn't that YubiKey 4 went closed source to support a government backdoor. It's that it's entirely for business reasons as they've said. And then after a few years, a few more layers of middle management, a few interesting users, and a little more TLA focus, Yubikey 6 quietly gets subverted. Tangentially - I was pretty close to buying a Yubikey Neo for its form factor, but it didn't seem like I could modify/reload the OpenPGP applet, and documentation was scant as to how configurable it was. I really want the thing to operate as semi trusted hardware - passphrase, etc. Smartcard tech is nifty, but it seems like a non-hardened chip would be more worthwhile for the ability to iterate features/UI.

by api 11y ago

pdkl95 11y ago

> It's very Soviet It's not only a Soviet phenomena; American politics has utilized a "paranoid style"[1] for a long time. > sabotaging crypto It seems like a lot of people are pretending that BULLRUN doesn't exist. Nobody wants to believe that a coworker might be a collaborator; that kind of thinking can easily erode trust and create paranoia even when it isn't warranted. Unfortunately, the program exists so it's foolish to ignore the probability that it is still working to weaken crypto. As PHK explain in "Operation Orchestra", encouraging weak crypto is much cheaper than breaking real crypto. [1] https://en.wikipedia.org/wiki/The_Paranoid_Style_in_American_Politics https://en.wikipedia.org/wiki/The_Paranoid_Style_in_American...

pvg 11y ago

A nefarious, diabolically clever government wants to compromise this device and then telegraphs that intent to the world by forcing the software to go closed source - that is absolutely an irrational and silly conspiracy theory. To believe that you have to believe that the government is both nefarious, diabolically clever and cartoonishly inept.

TheSpiceIsLife 11y ago
Absolutely most certainly yes all three of those things. Nefarious: government is, I contend, only that group of criminals we have collectively decided we would be better to regulate and pay off. I'm not saying this is a bad thing, we certainly need some regulation and law enforcement, etc. Diabolically clever: the word means 'characteristic of the devil' - government is responsible for torturing people, killing people in pointless wars, etc. Cartoonishly inept: for sure! you only have to go outside, pick up a news paper, browse a news website, to see how incompetent government can be. But, we tend to speak of 'government' as some cohesive whole, which it most certainly is not. Is any one branch or agency of government all three of those things at all time? I don't think so. Some parts of government do a fine job of administering their responsibilities, some of the time. Probably. Maybe.
- dfc 11y ago
  > Cartoonishly inept Can you name one medium to large (resources and headcount) organization that has existed for 20 years that could not be called cartoonishly inept by its detractors?
  - patrickmclaren 10y ago
    Amazon comes to mind.
- pvg 11y ago
  So you wanted to let me know you deliberately misunderstood my point but then, wait, how clever, you did not. I don't follow.
mindslight 11y ago
And this is exactly the type of strawman that usually accompanies the "conspiracy theory" bashing. You've chosen the strongest-claiming narrative, which is easily knocked down. The simplest scenario isn't that YubiKey 4 went closed source to support a government backdoor. It's that it's entirely for business reasons as they've said. And then after a few years, a few more layers of middle management, a few interesting users, and a little more TLA focus, Yubikey 6 quietly gets subverted. Tangentially - I was pretty close to buying a Yubikey Neo for its form factor, but it didn't seem like I could modify/reload the OpenPGP applet, and documentation was scant as to how configurable it was. I really want the thing to operate as semi trusted hardware - passphrase, etc. Smartcard tech is nifty, but it seems like a non-hardened chip would be more worthwhile for the ability to iterate features/UI.