11 ms·
The NSA Called Me After Midnight and Requested My Source Code
- jbyers 8y ago"But there’s still one thing that continues to nag me after all these years - how the hell did Dave track me down 3,000 miles away from home after midnight on that hot summer’s eve in Bristol, Connecticut?" Assuming the author flew cross-country from California and his brother had a phone number in the family name, it doesn't seem too hard to piece together with good old fasioned detective work - on top of good old fashioned databases open to the NSA. I wonder if Dave got it right on the first call?
- pavritch 8y agoI'm the author. They found me on the firsts call. I have a unique name - the footprint was there. But, I had 5 relatives in the same town. Nobody else got a call. Were they just lucky?
- mtgx 8y agoThis guy had dubious ethics right from the start by offering most users a free version with weak encryption just so they can pay for the premium version. The export control excuse is bogus as by then DJB had already won the lawsuit against the U.S. government over this issue. So all in all, I could see it coming that he would be offering the source code on the silver platter to the NSA after reading the first couple of paragraphs from the post. I also like how he calls that guy a "dumb criminal" for not buying his military-grade encrypted software, as if he hadn't already admitted that he was giving the source code for the full version to the NSA anyway. In other words, he didn't just break the trust of the free users, but also of those paying him to keep their conversations private. This is why I said he had dubious ethics.
- jawns 8y agoI don't see why it's any different than a photo-editing app that applies a watermark to the free version. It's intended to let people give the software a try, and if it seems to meet their needs, they buy the actual product. As for sharing the source code with the NSA, I think you have a better argument there. That said, it's kind of like helping someone install a secure lock on their door to keep out criminals, yet being willing to share a master key with police if it's a matter of life and death.
- web007 8y agoIt's not a master key, it's a blueprint of the lock with no combination or exact pin layout.
- deleted 8y ago[deleted]
- Mithorium 8y agonot the master key, the schematics to the lock maybe. Assuming no bugs, I don't see how the source code could help in any way, they may as well have downloaded the source code for openssl. He also didn't bother to verify whether it was a matter of life or death, he just immediately assumed he was helping break into a file containing the deactivation code for a bomb or something, who knows what the NSA was actually doing.
- dabernathy89 8y ago> offering most users a free version with weak encryption just so they can pay for the premium version As long as that wasn't a hidden fact from the users, I don't see the issue.
- michaelmrose 8y agoPeople are stupid. Seat belts that appeared to work but didn't actually keep you safe would be illegal even if labeled.
- jhall1468 8y agoYou die if your seatbelt doesn't work and companies charge for seat belts. You don't die if your encryption is weak and you aren't paying for it. But otherwise, super useful analogy.
- ddalex 8y ago> You don't die if your encryption is weak This really depends on the business you're in.
- pavritch 8y agoThe laws were different back then. The State Dept changed the rules a decade or more ago, I forget when, and AES 256 has been the default cipher ever since. Encryption is listed as a munition. I would have gone to jail if I put anything greater than 40-bit encryption on the shareware sites. Look what happened with Phil Z with PGP.
- michaelmrose 8y agoThe law was changed a year before your story takes place.
- imglorp 8y agoFurthermore, if the government calls someone a criminal, their target may well be a dissident, journalist, whistleblower, etc. Things aren's so black and white any more.
- SimonPStevens 8y agoGood security isn't based on keeping source code secret. There is plenty of the most secure encryption software that is open source. I don't really see any ethical issue in handing over the source code.
- pavritch 8y agoExactly. TrueCrypt was the big open source product at the time. A great product used by many hundreds of thousands of people -- I know, because I used to track their progress.
- tantalor 8y agoHow does access to the source code help?
- AdamJacobMuller 8y agoattempting to find bugs (likely cryptographic weaknesses) that will let them crack the encryption faster.
- Mithorium 8y agoI should hope he didn't roll his own encryption, pretty sure openssl existed in 2000, the NSA could have gotten a copy of that easily
- pavritch 8y agoI did not roll my own. Very few people in the world are smart enough to do that. I just create a very nice user interface to make things easy for ordinary Windows users.
- a3n 8y agoLooking for bugs. Promising avenues of attack.
- djhworld 8y agothe cynic in me thinks they could use the source to plant a backdoor in, then try to manipulate known targets into installing the tampered software under the guise of an update
- brohee 8y agoGives them a few hours headstart over reverse engineering to get the details of the binary format, and most likely, if the application was password based, which KDF was used. Because even if it was indeed 256 bits encryption, a weak KDF was all too common... In any case, they didn't need the source if their goal was as some say, not to decrypt files a bit faster but to produce a backdoored version.
- 8y ago
- jerkstate 8y agoSo, the NSA was able to build and deploy a backdoored version of this software to their targets without the trouble of reverse engineering and modifying it. Nice
- lurquer 8y agoAll for the cost of a coffee cup.
- bigmonads 8y agoThis person is either lying or delusional, or got pranked really hard. The "details" provided, while they make great story, simply don't cohere with how the NSA operate.
- devoply 8y agohttps://www.amazon.com/11-ounce-NSA-NATIONAL-Multi-color/dp/B01B6MBZG8 https://www.amazon.com/11-ounce-NSA-NATIONAL-Multi-color/dp/... In case you need to ever thank anyone for helping you.
- deleted 8y ago[deleted]
- web007 8y agoCould be confusing Bethesda (which afaik only has the Navy hospital and admin offices, not a base?) with Ft Meade?
- flavor8 8y agoI noticed one internally inconsistent detail, although possibly he just mis-remembered. They called him "after midnight" in Connecticut. He called them back, which took less than 10 minutes. After some discussion he calls his employee in Oregon - "by then it was after 4AM on the west coast." Midnight in Connecticut is 9PM on the West Coast, so unless the conversation went on for 7 hours before he called Ron, he's wrong about one or the other of the times.
- deleted 8y ago[deleted]
- apple4ever 8y ago18 years is a long time ago, and memories fade and get corrupted even after a short period of time, much less that long (its on reason we have statutes of limitations on most crimes).
- lbj 8y agoMy guess is that this is a marketing ploy designed to convey the message that the author's skills are above the NSA's and as such his software should be bought by anyone and everyone interested in great security. Considering the shareware version was 40bit encrypted, I highly doubt the NSA couldn't crack it before making that phonecall.
- pavritch 8y agoAll commercial encryption software uses the same public ciphers. Do you really think nearly 20 years after the fact I'm trying to impress anyone? But, they were impressed at the time about my user interface which wrapped the ciphers, and they later had a group visit me in California about some internal uses of that same UX; but nothing came of it in the end.
- lbj 8y agoYeah that was the impression the blogpost left me with. If I'm in the wrong I apologize but as always I feel that honesty is the best policy.
- michaelmrose 8y agoPeople use encryption so that their files are secure in situations where failure would be disastrous. Ranging all the way from protecting your credit card number to protecting your sources from being tortured and killed for talking to you. Offering broken encryption that appears to work is dangerous, unethical, and stupid. The author ought to be ashamed and people ought to be smarter.
- StavrosK 8y agoYes, but offering non-broken encryption was illegal at the time.
- zelon88 8y agoAs the author stated, encryption was export controlled for a long time. The legal fight was very intense. If I recall any encryption stronger than 40 bits needed a license to export outside of the USA until about 2000 or so.
- PopeDotNinja 8y agoYeah, I remember that being a thing in browsers. It was kind of odd to download a browser with 128-bit encryption that forbade me to distributing it to anyone outside of the USA.
- michaelmrose 8y agoPretty sure this isn't accurate. I thought the government dropped their lawsuit against PGP in the 90s.
- StavrosK 8y agoYeah, my brain said "18 years ago? Yeah, that was the nineties" and I didn't realize it was 2000, although the shareware version might have been developed much earlier. Also the lawsuit was against Phil Zimmermann himself, not PGP.
- 8y ago
- clubm8 8y agoWhat a dingus. Maybe there was no emergency, they just wanted your original source to look for imperfections in your implementation. Maybe 256 is secure, that doesn't mean your 256 is secure.
- neilk 8y agoAssume the 411 call is legit, and this really was the NSA. The author has no evidence there was a ticking time bomb scenario underway. Other than the fact that he was called late at night. Calling him at his parents’ place late at night seems less like a coincidence and more like an ominous demonstration of their power. I know that would influence me, and I’d feel more disposed to cooperate. I could forgive someone making a rash decision after midnight while traveling. But here it is, some time later, and the author still seems to think it’s a cool story. Nice to know that a maker of privacy software doesn’t think skeptically about the government.
- jhall1468 8y agoHe gave away the source code, not the master keys to unlock every single version of the software. At best, the source allowed the NSA to derive the binary format used by the files. Whoopie.
- tdbgamer 8y agoYeah so if there are any vulnerabilities in his software, he just gave them all they need to exploit them...
- _asummers 8y agoNot quite. Not that source code secrecy should be relied on, but the source code not being secret increases the changes of e.g. side channels being discovered that jeopardize all the users of the author's software.
- tdbgamer 8y agoThis article seems like a great argument for using open source encryption software. This guy handed over his source code to the NSA without a warrant or anything? So any idiot that steals your laptop can just call him up and exploit his software to get to your files. Great.
- ghewgill 8y agoLooks like weak security is a trend with this software. > You attempted to reach www.safehousesoftware.com, but the server presented a certificate signed using a weak signature algorithm (such as SHA-1). This means that the security credentials that the server presented could have been forged, and the server may not be the server that you expected (you may be communicating with an attacker).
- AnIdiotOnTheNet 8y ago> But seriously, this laptop idiot was planning to blow up a building, or something equally as bad, but wasn’t smart enough or flush enough to pop for the $39.99 to step up to the maximum-strength encryption? Boy, you sure seem confident in your assessment of the severity of the situation. It's not like the NSA would have any idea how to get information out of people by convincing them the situation was something other than what it actually was. Granted 18 years ago was a much different time than today. It's a shame that these agencies have proven their motives so untrustworthy.
- sabarn01 8y agoLets also assume there is a selection bias. The things the do right with the right intentions you never hear of. Its only when things go wrong do we know.
- mtw 8y agoThere's nothing to be proud of and writing a blog post about it. Your users used the software to protect them, or even paid for it. Now this "Dave" can crack files generated by this shareware. Maybe "Dave" had a genuine national security situation. But was it really? What if Dave just wanted to prank the author, during a boring afternoon? What if it were a couple of guys parked outside who hijacked the phone system, so even if you call 411, it would route to their van outside? Or what if Dave already did the same demand to dozens of other security vendors, effectively having the source code of all encryption software? And even if it was a national security situation, what is the legal basis of giving up source code and keys? What I get is "I was just a regular computer programmer and overnight, I was actually important enough to be useful for the NSA"
- metildaa 8y agoThe ethical implications are often not considered by software developers, thus you get cases like this where the author did not stop to push back, acting as a useful idiot for the NSA. There are way too many people like that in tech, who don't stop to take in the bigger picture before performing the requested action.
- Taniwha 8y agoI agree, the first thing he should have asked for is a warrant signed by a judge, and then independently verified it was real.
- Latteland 8y agoAt the very least there are many circumstances where reporters who were reporting on pretty underhanded activities in the us were targeted by the us govt, and what if this situation happened to them. My govt is generally good here in the us, but we know plenty of cases where they didn't have good intentions, this is done to intimidate. So if you are an author of security software, you might keep this in mind. And other countries like Russia and China would definitely put pressure on people to help them.
- StavrosK 8y agoLet's be a bit more realistic, the title might as well have been "how I open-sourced my encryption software at the request of someone". Yes, the author was way too quick to give up the source code, but it was just source code, not a backdoor key.
- ElBarto 8y agoNotice how he masterfully distilled cool details about his software culminating in the 'low' price, all wrapped in a captivating story? 30 minutes later after he has left and you have closed the door to go back to your chores, you're wondering why you ordered 2 magic-mix blenders...
- pavritch 8y agoThe only thing I did masterfully was write a Medium article that got some attention. I didn't even include a link to the old software which hasn't been updated in a decade. It's nothing more than an interesting story about one night nearly 20 years ago. Sorry to disappoint.
- ElBarto 8y agoCan I return the blenders?
- bitwize 8y agoI think I know his brother. Given his intellectual interests, especially at the time, I bet the phone call from the NSA is something they still talk about.
- pavritch 8y agoHa ha. We moved on years ago. Our conversations are now typically about the fact he as way more patents than me. I only have two ;)
- strictnein 8y agoThe number of commenters who clearly did not read the story and have completely missed that this story was about the year 2000 is pretty stunning. Plus the complete lack of understanding of the encryption standards that were legally exportable (which is also mentioned in the story) and seen as good enough is kind of stunning. 40 bit encryption in 2000 was decent. It wasn't great, but it would deter almost anyone.
- mc_fish 8y agoI get that we all want to feel like something we are a part of is so important that James Bond-esque stuff happens to us. But, the author of this software did a disservice to his users by immediately rolling over to an, essentially, unknown party. I'm wondering what he would have given up if "Dave" had claimed to be Nigerian nobility. Though, kudos to "Dave" if this was just a ruse to avoid paying for the $39.99 version.
- psychedictic 8y agoGod bless you for doing what's right for America.
- onemoresoop 8y agoSocial engineering at its best.
- LiamPa 8y agoMitnick?
- stef25 8y agoI'm about half way through Ghost in the Wires and this sounds exactly like something he'd do. "Hi, this is so-and-so and I'm with this-and-that. Could you send me a copy of the source code? I'm all over your phone line" The book is a continuous stream of anecdotes like this. Love it.
- LiamPa 8y agoYep so good and the ‘ring this number to prove I am real’ was a walk in the park for him.
- notacoward 8y agoIf it were me, I'd be very wary about that coffee cup.
- no_identd 8y agoYepp, throw that thing in an x-ray machine.
- alexandernst 8y agoI'm not surprised at all seeing all sort of comments from the people of the ethical sect... I'd really love to see any of these people in such situation. Or maybe even further, in a situation in which they actually have a tangible proof that "something bad is going to happen".