3 ms·
That's a bad argument. Firstly, it's my understanding that there have already been root-access 0 days discovered in the ME (and since patched since exposed). AN
by alexandercrohde 9y ago
That's a bad argument. Firstly, it's my understanding that there have already been root-access 0 days discovered in the ME (and since patched since exposed). AND The USB jtag backdoor is the whole point of this post.
Secondly, a security hole and a backdoor are interchangeable these days. So we'll never be able to prove which new 0-days are deliberate, and as far as impact it kinda doesn't matter if they're deliberate.
- lima 9y agoWe're talking about deliberate government backdoors, and it's my opinion that those are highly unlikely. The ME is a really bad idea because it introduces massive, unnecessary attack surface and vulnerabilities are inevitable, but no conspiracy.
- alexandercrohde 9y agoHow can you prove a vulnerability isn't deliberate? We've seen deliberate security vulnerabilities before (DUAL_EC).
- lima 9y agoYou can't, but let me point out that DUAL_EC was a "nobody but us" backdoor that required their private key to use. (and yes, it backfired) If they're introducing regular vulnerabilities, they're also making themselves vulnerable, given that the US government is one of the biggest Intel customers.
- ComputerGuru 9y agoI remember back in the good old days of cryptography export restrictions when the NSA had a much simpler "nobody but us" approach: you encrypted data with a xx-bit private key, half of which was shared with the NSA. Should they need to break content, the other half of the key could be brute-forced at costs that were economically feasible (for targeted use, not blanket suviellance) to the NSA but the full-length key would be unbreakable (in theory) by anyone without prior knowledge of that other half.