5 ms·

I was guessing changing the protocol, like adding or subtracting a few aes rounds to a ssh connection so a standard connection doesn't even speak your protocol

I was guessing changing the protocol, like adding or subtracting a few aes rounds to a ssh connection so a standard connection doesn't even speak your protocol and can't connect. This also reminds me of when somebody here wrote about meeting one of the cryptographers at a con for SHA3 (Blake?) and the guy shrugged off his efforts saying it was all for fun meaning whatever device you have is so completely back doored already either through sabotaged/weakened standards or outright (proprietary microcode) that believing any algorithm can keep a secret from nation state adversaries is laughable.

dom0 10y ago
> believing any algorithm can keep a secret from nation state adversaries is laughable. Well, yeah, it is. Defence against (crypto-buzzword) state-level actors (SLAs) doesn't start with gpg and FDE, rather, with operational security, or, even better, not being a worthwhile target in the first place (if your briefcase of secret documents is already on CNN there is no need to infiltrate your stuff beyond gaining assurance that you don't have another briefcase - which is the thing you want to proof as publicly as possible to convince your highly paranoid adversary) There is that saying "never trust a computer you can't throw out the window". Computers are networked. You're trusting a network of computers, even if you don't use "networked functionality". Can you throw the internet out the window? Probably not! Hence, don't trust computers. People who trust computers to keep their secrets are foolish¹ (Trottel), so just don't. ¹ Notice how governments²³ trust computers to keep their secrets safe, and how admirably and totally that failed. Ask yourself, what wasn't leaked by Snowden? Stuff that wasn't in any computer in the first place! ² Or how celebrities trusted computers to keep their dickpics safe. ³ Or how companies trusted computers to keep their business secrets, well, uh, secret. To make my point another way: Computers are for disseminating information. If secrecy is more important than dissemination, then don't use a computer.
- kakarot 10y ago
  Umm... I think the number of things not leaked by Snowden far surpasses the number of things leaked by him, and the things he didn't leak weren't not leaked because they weren't on a computer... they just weren't in the files he accessed.
  - nickthemagicman 10y ago
    Bad example but his point is overall pretty solid imo.
    - fapjacks 10y ago
      I think the NSA definitely seemed to hit a point where they calmed down. At first there was a palpable sense of "O NOE" as the NSA scrambled to discover what exactly had been stolen. And then just as suddenly, it seemed to go away. I don't think the really shocking stuff was exfil'ed by Snowden. I won't speculate what wasn't revealed, except that I think it's telling that the NSA has been asking for the ability to award high-level mathematics commendations to its workers without explaining why they deserve the award. Not much in Snowden's documents seem to fit that particular bill. The NSA isn't going to want to award the Fields Medal to someone for 0day exploits, weakening crypto infrastructure, or friggin USB hacks.
      - dmfdmf 10y ago
        <At first there was a palpable sense of "O NOE" as the NSA scrambled to discover what exactly had been stolen. And then just as suddenly, it seemed to go away.> I think a big part of them not commenting on the issue was that they didn't know what Snowden had and they got caught in a number of lies early on.

dom0 10y ago

> believing any algorithm can keep a secret from nation state adversaries is laughable. Well, yeah, it is. Defence against (crypto-buzzword) state-level actors (SLAs) doesn't start with gpg and FDE, rather, with operational security, or, even better, not being a worthwhile target in the first place (if your briefcase of secret documents is already on CNN there is no need to infiltrate your stuff beyond gaining assurance that you don't have another briefcase - which is the thing you want to proof as publicly as possible to convince your highly paranoid adversary) There is that saying "never trust a computer you can't throw out the window". Computers are networked. You're trusting a network of computers, even if you don't use "networked functionality". Can you throw the internet out the window? Probably not! Hence, don't trust computers. People who trust computers to keep their secrets are foolish¹ (Trottel), so just don't. ¹ Notice how governments²³ trust computers to keep their secrets safe, and how admirably and totally that failed. Ask yourself, what wasn't leaked by Snowden? Stuff that wasn't in any computer in the first place! ² Or how celebrities trusted computers to keep their dickpics safe. ³ Or how companies trusted computers to keep their business secrets, well, uh, secret. To make my point another way: Computers are for disseminating information. If secrecy is more important than dissemination, then don't use a computer.

kakarot 10y ago
Umm... I think the number of things not leaked by Snowden far surpasses the number of things leaked by him, and the things he didn't leak weren't not leaked because they weren't on a computer... they just weren't in the files he accessed.
- nickthemagicman 10y ago
  Bad example but his point is overall pretty solid imo.
  - fapjacks 10y ago
    I think the NSA definitely seemed to hit a point where they calmed down. At first there was a palpable sense of "O NOE" as the NSA scrambled to discover what exactly had been stolen. And then just as suddenly, it seemed to go away. I don't think the really shocking stuff was exfil'ed by Snowden. I won't speculate what wasn't revealed, except that I think it's telling that the NSA has been asking for the ability to award high-level mathematics commendations to its workers without explaining why they deserve the award. Not much in Snowden's documents seem to fit that particular bill. The NSA isn't going to want to award the Fields Medal to someone for 0day exploits, weakening crypto infrastructure, or friggin USB hacks.
    - dmfdmf 10y ago
      <At first there was a palpable sense of "O NOE" as the NSA scrambled to discover what exactly had been stolen. And then just as suddenly, it seemed to go away.> I think a big part of them not commenting on the issue was that they didn't know what Snowden had and they got caught in a number of lies early on.