3 ms·
That's a pretty asinine way to add a backdoor. I think we can give the intelligence community more credit than that. Plus, if you're an intelligence agency, t
by Kadin 9y ago
That's a pretty asinine way to add a backdoor. I think we can give the intelligence community more credit than that.
Plus, if you're an intelligence agency, the ideal backdoor is one you can use, and only you can use -- one that other adversaries can't take advantage of even if they know it's there. A hardcoded password is the opposite of that; once its existence leaks out, which it invariably will, it's open to everyone.
Having a developer modify some crypto code in a subtle way that happens to reduce the effectiveness of the system such that it becomes marginally more vulnerable to a certain type of obscure cryptanalysis, preferably very resource-intensive analysis that only you can perform, is the direction I'd try for...
- stordoff 9y agoIf a intelligence service is adding the backdoor themselves, or the company is willingly working with them, sure, but I can imagine a scenario where a court orders them to provide access but does not specify the technical means. In that case, the company isn't particularly incentivised to make a subtle/NOBUS backdoor. I'd also wonder about it being a case of deniability - a hardcoded password can be written off as a development/debug oversight, whereas a more structured backdoor/deliberate vulnerability to cryptoanalysis is harder to explain away if found.