4 ms·

Assume the 411 call is legit, and this really was the NSA. The author has no evidence there was a ticking time bomb scenario underway. Other than the fact that

by neilk 8y ago

Assume the 411 call is legit, and this really was the NSA. The author has no evidence there was a ticking time bomb scenario underway. Other than the fact that he was called late at night. Calling him at his parents’ place late at night seems less like a coincidence and more like an ominous demonstration of their power. I know that would influence me, and I’d feel more disposed to cooperate. I could forgive someone making a rash decision after midnight while traveling. But here it is, some time later, and the author still seems to think it’s a cool story. Nice to know that a maker of privacy software doesn’t think skeptically about the government.

jhall1468 8y ago
He gave away the source code, not the master keys to unlock every single version of the software. At best, the source allowed the NSA to derive the binary format used by the files. Whoopie.
- tdbgamer 8y ago
  Yeah so if there are any vulnerabilities in his software, he just gave them all they need to exploit them...
- _asummers 8y ago
  Not quite. Not that source code secrecy should be relied on, but the source code not being secret increases the changes of e.g. side channels being discovered that jeopardize all the users of the author's software.
  - pavritch 8y ago
    The ciphers are public. What the NSA really wanted was the size of file headers, special markers, etc -- so they could skip over the fluff and home in on the juicy stuff. I gave up nothing that would put the product or users at risk.
    - _asummers 8y ago
      With due respect, the person you spoke to on the phone didn't really answer your questions, per your post. What leads you to the conclusion? From my perspective, it doesn't sound like you know what they were using it for at all, or even if there was an urgent matter that even required it. For all we know, it was just a Tuesday and they were just hunting for the source of a common encryption utility. And just because a cipher is public does not mean that there does not exist a side channel in the implementation of the ciphers or a mistake in your usage of them.
      - bb88 8y ago
        > And just because a cipher is public does not mean that there does not exist a side channel in the implementation of the ciphers or a mistake in your usage of them. And just because they have the source code, doesn't mean they couldn't get it from reverse engineering the binary. I have not seen a binary that was completely resistant to reverse engineering yet. Likely he was just saving them time.
    - hnmonkey 8y ago
      You seem to be arguing (across multiple comments) that you gave up nothing that would put your product or users at risk though you have no evidence of that. In fact, just the fact that you gave them what they wanted means that it had some impact greater than nothing and it certainly wouldn't be for the positive towards your users or the product. Why did they want it in the first place then?
      - bb88 8y ago
        So one of the many services the NSA offers to the US Government is reverse engineering. Do you really think that his software was so mysterious that they couldn't figure this out eventually?
        tarboreus 8y ago
        That's resource intensive. They might have, but it's also entirely possible they would have decided it wasn't worth it. Might as well first see if the author is kind enough to just hand over the source. At the very least, he should have made the code open source after giving it to the NSA so that there was a chance of zero days they discovered getting worked out.
- sixstringtheory 8y ago
  With source in hand, couldn’t they just distribute backdoored copies of said software?
  - aYsY4dDQ2NrcNzA 8y ago
    It seems a little unlikely that the NSA would require the source code of a small shareware utility just to release a backdoored version.
devy 8y ago
Also, author didn't mention how his programmer securely transmitted source code to NSA. Did NSA publish their public keys anywhere on Contact Us form?
AnIdiotOnTheNet 8y ago
You have to take into account the temporal setting of the story. 18 years ago is pre-9/11 and all the reveals that happened between then and now.
- neilk 8y ago
  The 1990s were the era of the cypherpunks, the Clipper chip, and, as the author alludes to, some fairly inane export restrictions on cryptography. This was not some innocent time. If you want to go further back, there's the Church Committee (which concluded that security agencies were way out of control and had to be reined in).
  - burger_moon 8y ago
    You're passing judgement based on a life time of learnings. How much did this person know at the time? Arm chair quarter backs always seem to have the right answers.
    - neilk 8y ago
      If I’m coming across as accusing that he made the wrong decision, I don’t mean to say that. The story he’s telling suggests he made a difficult decision under the impression that it was urgent and important. What I am saying is that in hindsight, this seems like the wrong decision, and I would hope a maker of crypto software would realize that.

by neilk 8y ago

jhall1468 8y ago

He gave away the source code, not the master keys to unlock every single version of the software. At best, the source allowed the NSA to derive the binary format used by the files. Whoopie.

tdbgamer 8y ago
Yeah so if there are any vulnerabilities in his software, he just gave them all they need to exploit them...
_asummers 8y ago
Not quite. Not that source code secrecy should be relied on, but the source code not being secret increases the changes of e.g. side channels being discovered that jeopardize all the users of the author's software.
- pavritch 8y ago
  The ciphers are public. What the NSA really wanted was the size of file headers, special markers, etc -- so they could skip over the fluff and home in on the juicy stuff. I gave up nothing that would put the product or users at risk.
  - _asummers 8y ago
    With due respect, the person you spoke to on the phone didn't really answer your questions, per your post. What leads you to the conclusion? From my perspective, it doesn't sound like you know what they were using it for at all, or even if there was an urgent matter that even required it. For all we know, it was just a Tuesday and they were just hunting for the source of a common encryption utility. And just because a cipher is public does not mean that there does not exist a side channel in the implementation of the ciphers or a mistake in your usage of them.
    - bb88 8y ago
      > And just because a cipher is public does not mean that there does not exist a side channel in the implementation of the ciphers or a mistake in your usage of them. And just because they have the source code, doesn't mean they couldn't get it from reverse engineering the binary. I have not seen a binary that was completely resistant to reverse engineering yet. Likely he was just saving them time.
  - hnmonkey 8y ago
    You seem to be arguing (across multiple comments) that you gave up nothing that would put your product or users at risk though you have no evidence of that. In fact, just the fact that you gave them what they wanted means that it had some impact greater than nothing and it certainly wouldn't be for the positive towards your users or the product. Why did they want it in the first place then?
    - bb88 8y ago
      So one of the many services the NSA offers to the US Government is reverse engineering. Do you really think that his software was so mysterious that they couldn't figure this out eventually?
      - tarboreus 8y ago
        That's resource intensive. They might have, but it's also entirely possible they would have decided it wasn't worth it. Might as well first see if the author is kind enough to just hand over the source. At the very least, he should have made the code open source after giving it to the NSA so that there was a chance of zero days they discovered getting worked out.
sixstringtheory 8y ago
With source in hand, couldn’t they just distribute backdoored copies of said software?
- aYsY4dDQ2NrcNzA 8y ago
  It seems a little unlikely that the NSA would require the source code of a small shareware utility just to release a backdoored version.

devy 8y ago

Also, author didn't mention how his programmer securely transmitted source code to NSA. Did NSA publish their public keys anywhere on Contact Us form?

AnIdiotOnTheNet 8y ago

You have to take into account the temporal setting of the story. 18 years ago is pre-9/11 and all the reveals that happened between then and now.

neilk 8y ago
The 1990s were the era of the cypherpunks, the Clipper chip, and, as the author alludes to, some fairly inane export restrictions on cryptography. This was not some innocent time. If you want to go further back, there's the Church Committee (which concluded that security agencies were way out of control and had to be reined in).
- burger_moon 8y ago
  You're passing judgement based on a life time of learnings. How much did this person know at the time? Arm chair quarter backs always seem to have the right answers.
  - neilk 8y ago
    If I’m coming across as accusing that he made the wrong decision, I don’t mean to say that. The story he’s telling suggests he made a difficult decision under the impression that it was urgent and important. What I am saying is that in hindsight, this seems like the wrong decision, and I would hope a maker of crypto software would realize that.