3 ms·
It's hard not to assume the worst, especially when you have no concrete reports on their capabilities. And when assessing the threat it creates, you can't reall
by m-p-3 9y ago
It's hard not to assume the worst, especially when you have no concrete reports on their capabilities. And when assessing the threat it creates, you can't really ignore the possibilities by that lack of knowledge.
- linkregister 9y agoBut you have tons of concrete reports from the Snowden leaks and prior leaks. Dual_EC RNG is the worst example anyone can think of, something that has been red-flagged since 2007. Assuming a supposedly* adversarial agency has unlimited resources and ability will only cause you to focus on that threat instead of more immediate ones. Or worse, make you needlessly complacent when there is so much that can be done to harden against APTs and other, more immediate threats. * supposedly because if you're a U.S. citizen, the government works for you. If you're outside of FVEY (AU,CA,UK,US,NZ) and are a government official, military member, have interesting technical infrastructure, or operate an interesting company, then yes you should include NSA in your threat model.