3 ms·

which would require infecting the VPN machines themselves? Just wiretapping isn't sufficient because of public key encryption Assuming the nodes themselves ar

by rtpg 10y ago

which would require infecting the VPN machines themselves? Just wiretapping isn't sufficient because of public key encryption Assuming the nodes themselves are not compromised (big ask) and identity can be confirmed(like via key exchange), state actors can listen as much as they want to the wires, they won't be getting much. Except if some private key were out there...

nkadri 10y ago
What if they are able to wiretap the traffic exiting the VPN server. With the help of the server ISP for example ?
tP5n 10y ago
> Just wiretapping isn't sufficient Please explain, I was under the impression that the above could not reasonably be claimed anymore with any kind of certainty [1][2][3]. Perhaps I'm misunderstanding something important here or the 'Happy Dance!!' slide [4] made me paranoid. [1] http://arstechnica.com/security/2016/10/how-the-nsa-could-put-undetectable-trapdoors-in-millions-of-crypto-keys/ http://arstechnica.com/security/2016/10/how-the-nsa-could-pu... [2] http://arstechnica.com/security/2016/08/cisco-firewall-exploit-shows-how-nsa-decrypted-vpn-traffic/ http://arstechnica.com/security/2016/08/cisco-firewall-explo... [3] http://arstechnica.com/security/2015/10/how-the-nsa-can-break-trillions-of-encrypted-web-and-vpn-connections/ http://arstechnica.com/security/2015/10/how-the-nsa-can-brea... [4] http://www.spiegel.de/media/media-35515.pdf http://www.spiegel.de/media/media-35515.pdf
- rtpg 10y ago
  in the slides, check Slide 28. There's a bunch of useful software for wiretapping, but they need access to things like the Pre-Shared Key, or to be using an easily-exploitable connection mechanism like PPTP. Of course router/firmware exploits cannot be prevented in the general case, so NSA-likes could figure out a way get in. But the null hypothesis is still that the NSA cannot crack strong encryption without some sort of pre-built backdoor IMO. Based off of the leaks, NSA gets into things via two ways: - poisoning the encryption methods - social engineering/legal coercion to get keys

by rtpg 10y ago

nkadri 10y ago

What if they are able to wiretap the traffic exiting the VPN server. With the help of the server ISP for example ?

tP5n 10y ago

> Just wiretapping isn't sufficient Please explain, I was under the impression that the above could not reasonably be claimed anymore with any kind of certainty [1][2][3]. Perhaps I'm misunderstanding something important here or the 'Happy Dance!!' slide [4] made me paranoid. [1] http://arstechnica.com/security/2016/10/how-the-nsa-could-put-undetectable-trapdoors-in-millions-of-crypto-keys/ http://arstechnica.com/security/2016/10/how-the-nsa-could-pu... [2] http://arstechnica.com/security/2016/08/cisco-firewall-exploit-shows-how-nsa-decrypted-vpn-traffic/ http://arstechnica.com/security/2016/08/cisco-firewall-explo... [3] http://arstechnica.com/security/2015/10/how-the-nsa-can-break-trillions-of-encrypted-web-and-vpn-connections/ http://arstechnica.com/security/2015/10/how-the-nsa-can-brea... [4] http://www.spiegel.de/media/media-35515.pdf http://www.spiegel.de/media/media-35515.pdf

rtpg 10y ago
in the slides, check Slide 28. There's a bunch of useful software for wiretapping, but they need access to things like the Pre-Shared Key, or to be using an easily-exploitable connection mechanism like PPTP. Of course router/firmware exploits cannot be prevented in the general case, so NSA-likes could figure out a way get in. But the null hypothesis is still that the NSA cannot crack strong encryption without some sort of pre-built backdoor IMO. Based off of the leaks, NSA gets into things via two ways: - poisoning the encryption methods - social engineering/legal coercion to get keys