4 ms·
>The only way that the NSA could be actively making systems less secure would be if they were putting vulnerabilities into the source code or silicon. I just w
by danjoc 10y ago
>The only way that the NSA could be actively making systems less secure would be if they were putting vulnerabilities into the source code or silicon.
I just wanted to point out that the NSA does that.[1][2]
[1]http://www.nytimes.com/interactive/2013/09/05/us/documents-reveal-nsa-campaign-against-encryption.html http://www.nytimes.com/interactive/2013/09/05/us/documents-r...
[2]https://www.grahamcluley.com/2013/12/nsa-bribe-rsa-encryption/ https://www.grahamcluley.com/2013/12/nsa-bribe-rsa-encryptio...
- tptacek 10y agoI believe he's referring to the argument Schneier is making, not to the entire notion of NSA's SIGINT mission. Dual EC was indeed an instance of NSA harming everyone's security (less, at least in the US, than is broadly supposed, but clearly and deliberately). But it's not an instance of NSA acquiring zero-day vulnerabilities and then using them to harm everyone's security.
- ryao 10y agoThat is correct.