3 ms·

Assuming this isn't just PR, in some ways this is scary and disheartening. But my first reaction was "Cool, our government really cares, is creative and has th

Assuming this isn't just PR, in some ways this is scary and disheartening. But my first reaction was "Cool, our government really cares, is creative and has the necessary power to get things done." For those of you who've worked with government, you've seen how insanely difficult the procurement process is. Being as specific as needing to get competitive bids for toilet paper purchases, etc. So the fact that they could get potentially large amounts of bribe money means (a)This goes to high levels in the organization (b)They've probably done this before. I wonder how much they offered? And I wonder how many other pieces of software have backdoors. I would think the first things they would try and get access to is (a)Certificate issuers and (b) VPN software. Do we know that Godaddy,LetsEncrypt, OpenVPN, Cisco VPN, Juniper, etc don't have backdoors?

falcolas 9y ago
> Cool, our government really cares I wonder what they really care about? Liberty, individual rights, security, or more power? They're people too, so I'm sure they believe in the first three, but the last one is a more seductive and drives a lot more of the bad we see governments do; worse is that the drive for more power is frequently justified as "we need this power to protect our nation". > has the necessary power to get things done This actually frightens me a bit. The US government has the ability (and has displayed the willingness) to absolutely destroy people's lives in their pursuit of "national security". What checks and balances are in place to keep this kind of power in check?
- tuna-piano 9y ago
  I agree with you completely. I think it's good that they aren't sitting behind a desk doing nothing, but I'm glad these stories come out so we can have the proper conversations and keep privacy-security tradeoffs at a comfortable level for society.
- AmIFirstToThink 9y ago
  One... to see if you are for sale. If you can be bought, other state actors will try and may succeed, whether US actually bribes you or not. US needs to know if a successful App is up for taking bribe, including top developers individually, or not, because millions of Americans including persons in position of power might be using that app. Two... essentially, this is power of people applied. Lot of interest in keeping status quo of power, of narrative, of money. They want to have dirt on everyone and then choose to use it when needed. Putting pressure or not can be decided later, dirt will be collected by default. No point in digging the well when you are thirsty, you need to do it well upfront the need arising. >What checks and balances are in place to keep this kind of power in check? Either play the game, or be too big to fail and lobby the government for your needs. I think the best one can do is choose your masters either USA, China, Russia or to some extent India or EU main players.
  - falcolas 9y ago
    I think that the first point is a legitimate one - if your own government can buy you, so can someone else. Of course, when it comes down to it, everyone has a pressure point. In my thoroughly uninformed opinion, it would be better to identify and protect against such tactics than do them yourself and watch it backfire like this. The rest, I can't argue with, though it doesn't really make me feel any better.
- Retric 9y ago
  The paradox is many people feel the US government should have done more about 9/11 or other such events. Further, people can't get upset about surveillance that they are not aware of. So, the push is always going to be to collect more data (barring leaks) and it's only people aware of what's going on and thus inside the system that can really resist that pull. Which means the government and politicians are often the most effective supporters of privacy.
  - fredsir 9y ago
    > The paradox is many people feel the US government should have done more about 9/11 or other such events. Certainly. After all, they chose money instead of keeping the one tool[1] they already had that were able to tell them about 9/11 before it happened and save all those people who have died in 9/11 and other attacks. Negligence is complicity when it's a government choosing money over it's citizens, so in the case of 9/11, I'd say the US government is as guilty as the attackers. A great documentary about NSA and ThinThread is A Good American[2], and a good follow-up is The Maze[3]. [1]: https://en.wikipedia.org/wiki/ThinThread https://en.wikipedia.org/wiki/ThinThread [2]: http://agoodamerican.org http://agoodamerican.org [3]: https://vimeo.com/ondemand/themaze https://vimeo.com/ondemand/themaze
2_listerine_pls 9y ago
> Cool, our government really cares Government == Individuals that work in public positions and do not think as one.
SXX 9y ago
> LetsEncrypt Let's Encrypt is CA and tools and mostly by 3rd parties. Centralized CA system is imperfect, but certainly can't have "backdoor" in it especially now when Certificate Transparency is heavily enforced.
PeterisP 9y ago
"Do we know that [...] Cisco VPN, Juniper, etc don't have backdoors?" Wasn't it published in NSA leaks that Cisco and Juniper do/did have backdoors? We can trust particular crypto algorithms, but I'd bet money that for all complex, popular software there are not only vulnerabilities found by various agencies, but also vulnerabilities intentionally inserted there. Looking back at known historical intelligence operations from the cold war, it'd be ridiculous to assume that noone has tried and succeeded to get some technician (or manager) to insert some backdoors for them. Compared to other intelligence activities, the required effort for that is so small and the benefit so large, that I'd assume that multiple nationstates have inserted their own backdoors in various key components of global infrastructure.

falcolas 9y ago

> Cool, our government really cares I wonder what they really care about? Liberty, individual rights, security, or more power? They're people too, so I'm sure they believe in the first three, but the last one is a more seductive and drives a lot more of the bad we see governments do; worse is that the drive for more power is frequently justified as "we need this power to protect our nation". > has the necessary power to get things done This actually frightens me a bit. The US government has the ability (and has displayed the willingness) to absolutely destroy people's lives in their pursuit of "national security". What checks and balances are in place to keep this kind of power in check?

tuna-piano 9y ago
I agree with you completely. I think it's good that they aren't sitting behind a desk doing nothing, but I'm glad these stories come out so we can have the proper conversations and keep privacy-security tradeoffs at a comfortable level for society.
AmIFirstToThink 9y ago
One... to see if you are for sale. If you can be bought, other state actors will try and may succeed, whether US actually bribes you or not. US needs to know if a successful App is up for taking bribe, including top developers individually, or not, because millions of Americans including persons in position of power might be using that app. Two... essentially, this is power of people applied. Lot of interest in keeping status quo of power, of narrative, of money. They want to have dirt on everyone and then choose to use it when needed. Putting pressure or not can be decided later, dirt will be collected by default. No point in digging the well when you are thirsty, you need to do it well upfront the need arising. >What checks and balances are in place to keep this kind of power in check? Either play the game, or be too big to fail and lobby the government for your needs. I think the best one can do is choose your masters either USA, China, Russia or to some extent India or EU main players.
- falcolas 9y ago
  I think that the first point is a legitimate one - if your own government can buy you, so can someone else. Of course, when it comes down to it, everyone has a pressure point. In my thoroughly uninformed opinion, it would be better to identify and protect against such tactics than do them yourself and watch it backfire like this. The rest, I can't argue with, though it doesn't really make me feel any better.
Retric 9y ago
The paradox is many people feel the US government should have done more about 9/11 or other such events. Further, people can't get upset about surveillance that they are not aware of. So, the push is always going to be to collect more data (barring leaks) and it's only people aware of what's going on and thus inside the system that can really resist that pull. Which means the government and politicians are often the most effective supporters of privacy.
- fredsir 9y ago
  > The paradox is many people feel the US government should have done more about 9/11 or other such events. Certainly. After all, they chose money instead of keeping the one tool[1] they already had that were able to tell them about 9/11 before it happened and save all those people who have died in 9/11 and other attacks. Negligence is complicity when it's a government choosing money over it's citizens, so in the case of 9/11, I'd say the US government is as guilty as the attackers. A great documentary about NSA and ThinThread is A Good American[2], and a good follow-up is The Maze[3]. [1]: https://en.wikipedia.org/wiki/ThinThread https://en.wikipedia.org/wiki/ThinThread [2]: http://agoodamerican.org http://agoodamerican.org [3]: https://vimeo.com/ondemand/themaze https://vimeo.com/ondemand/themaze

2_listerine_pls 9y ago

> Cool, our government really cares Government == Individuals that work in public positions and do not think as one.

SXX 9y ago

> LetsEncrypt Let's Encrypt is CA and tools and mostly by 3rd parties. Centralized CA system is imperfect, but certainly can't have "backdoor" in it especially now when Certificate Transparency is heavily enforced.

PeterisP 9y ago

"Do we know that [...] Cisco VPN, Juniper, etc don't have backdoors?" Wasn't it published in NSA leaks that Cisco and Juniper do/did have backdoors? We can trust particular crypto algorithms, but I'd bet money that for all complex, popular software there are not only vulnerabilities found by various agencies, but also vulnerabilities intentionally inserted there. Looking back at known historical intelligence operations from the cold war, it'd be ridiculous to assume that noone has tried and succeeded to get some technician (or manager) to insert some backdoors for them. Compared to other intelligence activities, the required effort for that is so small and the benefit so large, that I'd assume that multiple nationstates have inserted their own backdoors in various key components of global infrastructure.