3 ms·

The DOD has been paying it through the Trusted Foundry Program. Probably not enough use of that, though. ;) https://www.dmea.osd.mil/trustedic.html https://www

The DOD has been paying it through the Trusted Foundry Program. Probably not enough use of that, though. ;) https://www.dmea.osd.mil/trustedic.html https://www.dmea.osd.mil/trustedic.html

Nasrudith 8y ago
If you mean among themselves fine - but among others along the peripheral I think it is for a good reason. It would be something of them isn't something likely to be piggybacked on for several reasons - even aside from the increased cost from overspeccing and reduced economies of scale the DOD easily have the muscle to extort built in spyware to the specification to be trusted to if they want big contracts. And given history believing such is not paranoid and wise in a sense of 'not being stupid' as opposed to prescience given the past history of exposed similar moves and a lack of transparency. Probably a borderline 'blasphemous' statement like other uncomfortable truths about things not working.
- nickpsecurity 8y ago
  I had a recommendation for this during Snowden leaks: use hardware from threat model's most capable opponents. As in, assume it's all backdoored by at least one party. Most threatening are specific, nation states. Use their opponents' hardware. If stopping Chinese hackers, use stuff from Trusted Foundry running most secure software you can. If stopping Five Eyes and Israel, use Russian or Chinese hardware running most secure stuff they support. If not trusting anyone, use a computer made before 1997 that's not on a network and usually hidden in a tamper-evident compartment. If paranoid, get rid of all electronic devices except those that detect electronic devices and emissions. Keep it far away from you itself sealed so it's not a point of attack. Periodically get it out to conduct a sweep. Your brain, pencil, paper, and hiding places are what you trust in this model. Even mechanical typewriters have acoustic and active RF weaknesses. So, now you know how to be paranoid. Have at it. ;)
  - pmlnr 8y ago
    Why 1997?
    - nickpsecurity 8y ago
      As an opponent of NSA, I was studying them closely to assess capabilities. Anderson, Schell, and Karger were pushing "COMPUSEC" in the 1970's on the military who mostly didnt believe in it. They and NSA thought all you needed was access controls on computers plus COMSEC between them. The BLACKER VPN paper mentioned the rivalry between COMSEC vs COMPUSEC people, too. That was somewhere between 1980-1990. It wasn't until around 1990 after many pentests by INFOSEC pioneers and hackers in the media convinced them to hire their own hackers. They were still focused on crypto and software flaws since they were low-hanging fruit. I figured subversion would be high-profile targets only. How Patriot act got passed was straight outta Nazi playbook. If a power grab, I knew secret backdoors, surveillance, and disappearances would follow. They'd launch USAP's forcing people to backdoor stuff or be held indefinitely under Patriot Act. Despite Haydens work, NSA still moves slow. I figured a few years before large-scale capabilities came online. Said 2004. Far as I recall, nothing in Snowden leaks refuted that estimate. What about TAO? Hayden was forcing management to listen to engineers. They'd propose backdoors. Still software focused mostly, though. I estimated 1999. Later article on TAO history said 1997 was their start. Damn. Now I say 1995-1997. Only thing left off was use obscure, less-popular hardware IP holders and terroristd probably werent using. Macs, Amigas, SGI... or just off-brand x86.

The DOD has been paying it through the Trusted Foundry Program. Probably not enough use of that, though. ;) https://www.dmea.osd.mil/trustedic.html https://www.dmea.osd.mil/trustedic.html

Nasrudith 8y ago

If you mean among themselves fine - but among others along the peripheral I think it is for a good reason. It would be something of them isn't something likely to be piggybacked on for several reasons - even aside from the increased cost from overspeccing and reduced economies of scale the DOD easily have the muscle to extort built in spyware to the specification to be trusted to if they want big contracts. And given history believing such is not paranoid and wise in a sense of 'not being stupid' as opposed to prescience given the past history of exposed similar moves and a lack of transparency. Probably a borderline 'blasphemous' statement like other uncomfortable truths about things not working.

nickpsecurity 8y ago
I had a recommendation for this during Snowden leaks: use hardware from threat model's most capable opponents. As in, assume it's all backdoored by at least one party. Most threatening are specific, nation states. Use their opponents' hardware. If stopping Chinese hackers, use stuff from Trusted Foundry running most secure software you can. If stopping Five Eyes and Israel, use Russian or Chinese hardware running most secure stuff they support. If not trusting anyone, use a computer made before 1997 that's not on a network and usually hidden in a tamper-evident compartment. If paranoid, get rid of all electronic devices except those that detect electronic devices and emissions. Keep it far away from you itself sealed so it's not a point of attack. Periodically get it out to conduct a sweep. Your brain, pencil, paper, and hiding places are what you trust in this model. Even mechanical typewriters have acoustic and active RF weaknesses. So, now you know how to be paranoid. Have at it. ;)
- pmlnr 8y ago
  Why 1997?
  - nickpsecurity 8y ago
    As an opponent of NSA, I was studying them closely to assess capabilities. Anderson, Schell, and Karger were pushing "COMPUSEC" in the 1970's on the military who mostly didnt believe in it. They and NSA thought all you needed was access controls on computers plus COMSEC between them. The BLACKER VPN paper mentioned the rivalry between COMSEC vs COMPUSEC people, too. That was somewhere between 1980-1990. It wasn't until around 1990 after many pentests by INFOSEC pioneers and hackers in the media convinced them to hire their own hackers. They were still focused on crypto and software flaws since they were low-hanging fruit. I figured subversion would be high-profile targets only. How Patriot act got passed was straight outta Nazi playbook. If a power grab, I knew secret backdoors, surveillance, and disappearances would follow. They'd launch USAP's forcing people to backdoor stuff or be held indefinitely under Patriot Act. Despite Haydens work, NSA still moves slow. I figured a few years before large-scale capabilities came online. Said 2004. Far as I recall, nothing in Snowden leaks refuted that estimate. What about TAO? Hayden was forcing management to listen to engineers. They'd propose backdoors. Still software focused mostly, though. I estimated 1999. Later article on TAO history said 1997 was their start. Damn. Now I say 1995-1997. Only thing left off was use obscure, less-popular hardware IP holders and terroristd probably werent using. Macs, Amigas, SGI... or just off-brand x86.