4 ms·
I know you have worked with former IC cryptographers and developers at Matasano/NCC Group. I still assert that this world view is inaccurate. I respect where
by linkregister 10y ago
I know you have worked with former IC cryptographers and developers at Matasano/NCC Group. I still assert that this world view is inaccurate. I respect where you're coming from.
Intelligence agencies are lead by people. Those people have motivations that inform their decision-making. Prestige, power, increased income, and (often, but not always) patriotism are, in my opinion, their primary motivators. This should for the most part be similar for any corporate executive.
Unless there are hard metrics tying headcount to performance reviews and promotion considerations, and simultaneously soft-power incentives for having more headcount, then other things will dominate. In the military, splashy achievements dominate.
Or at the minimum, making your boss and your boss's boss like you is essential.
The current NSA chief didn't get his job because he was in charge of the largest Fleet. He got it by networking, seniority, luck, and having a reputation for excellence (I do not know if it is deserved). The same can be said about civilian executives in the IC, who are rated in a more arduous, more holistic manner.
Your bottom line is correct in the specific case. If a Latacora client is targeted by the NSA with high priority, you cannot protect it unless you make it intractable for them. For the rest of us, using boring commodity mitigations, such as TLS and MFA, and sound network architecture are fine. Intractable-for-all is a noble effort, but I don't think it's realistic.
- tptacek 10y agoConfigured properly, boring TLS can be made effectively intractable. From a cryptographic perspective, I don't think intractable is at all unrealistic --- and I don't know many crypto engineers who think it is.
- linkregister 10y agoThat's the least interesting part of my comment. Sure, TLS is great. What about the rest?
- tptacek 10y agoI don't know how incompatible the rest of it is with things I already said. I would just suggest that the NSA is less motivated by preventing terrorism than it is by protecting and expanding the careers of the NSA rank and file.