But you have tons of concrete reports from the Snowden leaks and prior leaks. Dual_EC RNG is the worst example anyone can think of, something that has been red-

But you have tons of concrete reports from the Snowden leaks and prior leaks. Dual_EC RNG is the worst example anyone can think of, something that has been red-flagged since 2007. Assuming a supposedly* adversarial agency has unlimited resources and ability will only cause you to focus on that threat instead of more immediate ones. Or worse, make you needlessly complacent when there is so much that can be done to harden against APTs and other, more immediate threats. * supposedly because if you're a U.S. citizen, the government works for you. If you're outside of FVEY (AU,CA,UK,US,NZ) and are a government official, military member, have interesting technical infrastructure, or operate an interesting company, then yes you should include NSA in your threat model.