5 ms·

40 bit encryption in 2000 wasn't seen as bad, it was seen as decent. It would have required a fair amount of computer power to break in a short time. It was al

40 bit encryption in 2000 wasn't seen as bad, it was seen as decent. It would have required a fair amount of computer power to break in a short time. It was also what was legally exportable at the time. Providing some security is better than providing none. You lock your doors but have glass windows.

Mithorium 8y ago
Arguably stronger than the locks on most home doors, that could be picked in under a minute
joekrill 8y ago
But I don't buy a lock for my front door expecting the manufacturer to simply give the key to anyone that asks nicely for it.
- strictnein 8y ago
  Your lock already has a backdoor. A locksmith can open your door in 2 minutes.
- tomatotomato37 8y ago
  This wasn't providing the key as much as the schematics to the lock, which turns out, they pretty much do: https://www.kwikset.com/Libraries/Literature/Rekeying_Manual.sflb.ashx https://www.kwikset.com/Libraries/Literature/Rekeying_Manual...
  - michaelmrose 8y ago
    It's the spirit of the action. Publishing the source on github ought to be OK in theory if it isn't implemented poorly but it turns out that it is in fact implemented in a deliberately weak fashion. Knowing that his customers privacy was on the line, knowing that there was no due process, knowing that revealing the source would help the NSA violate his customers privacy, not needing any explanation or legal paperwork, not even truly knowing if the person on the other end of the line actually was the NSA, not a private citizen trying to violate the privacy of another citizen he decided to comply without question. Ticking bomb scenarios that can be solved by cracking encryption are so rare I'm not aware of any existing in history. The right answer was to request a court order and wait. If it was truly a matter of national security they can also wake up the judge in the middle of the night and have an officer of the court serve it. They were obsequious about it because they didn't have a leg to stand on. 50 50 they weren't even the NSA but rather a sailor trying to spy on a mates computer. Seeing as all you did was call a naval base and get transferred several times how do we know he wasn't talking to a random individual at the base.
    - pavritch 8y ago
      The ciphers are public. Providing source for this specific implementation of "user interface" did nothing more than indicate sizes of file headers, etc. No customers were put at risk. All I did was save the NSA maybe a few hours of time during a critical moment. Do you really think they couldn't have figured out there is a 4K file header (see, I've said it here, no harm).
      - michaelmrose 8y ago
        Can you explain how you can prove you are talking to the NSA by call foo ask to be transferred to bar, ask to speak to baz? Logically the fact that you called into the navy base indicates you are talking to them but by the time you get transferred how do you know who you are ultimately talking to? Couldn't you be talking to anyone who works at the navy or works with someone who works at the navy? One great thing about court orders is that its trivial to authenticate them and they get the exciting task of making sure the person asking for them is a legitimate actor on legitimate business. If a random private wanted to fool you couldn't they have had you call in in such a way as you would trivially be talking to a known party who will ultimately transfer you said party? Hey this joker is going to be transferred to your extension asking to speak to john doe at the NSA send him to my extension please. Considering that we now know that intelligence apparatus was used to spy on love interests how do you know you were collaborating with a legitimate legal operation as opposed to illegal spying on citizens? Likely you aren't in a position to judge right which is why we have you know judges and court orders and such ceremony. I respond to random calls that seem strange by hanging up and telling them to send me something official in the mail. Neither the people who claim they would like me to give me a fortune I inherited overseas, the guy who claimed I won the lottery, or the guy that claimed to be the IRS demanding immediate payment have followed up yet. At best your judgement is questionable.
        pavritch 8y ago
        Here's how I looked at it -- they are 1000x smarter than me on matters of encryption. It was totally unlikely I knew something they didn't. At most, I saved them a few hours on a matter of life and death, and I had minutes to make that decision. And recall, back then, people felt differently about the NSA. If this was a total spoof - the reality is I didn't give anything up. I didn't invent the encryption ciphers. I just packaged common ciphers in a user interface people really liked. But in response to the people here who think I was tricked. That's not the case. What I didn't put in the post was that a team from the NSA visited me in California a few months later. But again, had I been tricked, it wouldn't have mattered.
michaelmrose 8y ago
Given moores law the only encryption that has ever been acceptable is that which is impossible to break within any reasonable time frame. Taking slightly longer for a computer to open your files while I put my feet up and drink coffee doesn't suggest an increased degree of security unless it requires a truly substantial investment in hardware or time. The encryption in question could have been broken on a home computer 4 years later in 2 weeks. Seen as bad is a poor benchmark it WAS bad. The legal limitations on crypo export is a bad argument on so many fronts its hard to pick one. - The legal matter of exporting encryption was well on its way to settled by 2000 see https://en.wikipedia.org/wiki/Bernstein_v._United_States https://en.wikipedia.org/wiki/Bernstein_v._United_States where such restrictions were found to be illegal in 1999. - Author sold a higher grade of encryption including abroad - Author either didn't care about the law or would have been afoul of it with his paid version. - The laws against exporting encryption were a useless farce that never did anything useful

Mithorium 8y ago

Arguably stronger than the locks on most home doors, that could be picked in under a minute

joekrill 8y ago

But I don't buy a lock for my front door expecting the manufacturer to simply give the key to anyone that asks nicely for it.

strictnein 8y ago
Your lock already has a backdoor. A locksmith can open your door in 2 minutes.
tomatotomato37 8y ago
This wasn't providing the key as much as the schematics to the lock, which turns out, they pretty much do: https://www.kwikset.com/Libraries/Literature/Rekeying_Manual.sflb.ashx https://www.kwikset.com/Libraries/Literature/Rekeying_Manual...
- michaelmrose 8y ago
  It's the spirit of the action. Publishing the source on github ought to be OK in theory if it isn't implemented poorly but it turns out that it is in fact implemented in a deliberately weak fashion. Knowing that his customers privacy was on the line, knowing that there was no due process, knowing that revealing the source would help the NSA violate his customers privacy, not needing any explanation or legal paperwork, not even truly knowing if the person on the other end of the line actually was the NSA, not a private citizen trying to violate the privacy of another citizen he decided to comply without question. Ticking bomb scenarios that can be solved by cracking encryption are so rare I'm not aware of any existing in history. The right answer was to request a court order and wait. If it was truly a matter of national security they can also wake up the judge in the middle of the night and have an officer of the court serve it. They were obsequious about it because they didn't have a leg to stand on. 50 50 they weren't even the NSA but rather a sailor trying to spy on a mates computer. Seeing as all you did was call a naval base and get transferred several times how do we know he wasn't talking to a random individual at the base.
  - pavritch 8y ago
    The ciphers are public. Providing source for this specific implementation of "user interface" did nothing more than indicate sizes of file headers, etc. No customers were put at risk. All I did was save the NSA maybe a few hours of time during a critical moment. Do you really think they couldn't have figured out there is a 4K file header (see, I've said it here, no harm).
    - michaelmrose 8y ago
      Can you explain how you can prove you are talking to the NSA by call foo ask to be transferred to bar, ask to speak to baz? Logically the fact that you called into the navy base indicates you are talking to them but by the time you get transferred how do you know who you are ultimately talking to? Couldn't you be talking to anyone who works at the navy or works with someone who works at the navy? One great thing about court orders is that its trivial to authenticate them and they get the exciting task of making sure the person asking for them is a legitimate actor on legitimate business. If a random private wanted to fool you couldn't they have had you call in in such a way as you would trivially be talking to a known party who will ultimately transfer you said party? Hey this joker is going to be transferred to your extension asking to speak to john doe at the NSA send him to my extension please. Considering that we now know that intelligence apparatus was used to spy on love interests how do you know you were collaborating with a legitimate legal operation as opposed to illegal spying on citizens? Likely you aren't in a position to judge right which is why we have you know judges and court orders and such ceremony. I respond to random calls that seem strange by hanging up and telling them to send me something official in the mail. Neither the people who claim they would like me to give me a fortune I inherited overseas, the guy who claimed I won the lottery, or the guy that claimed to be the IRS demanding immediate payment have followed up yet. At best your judgement is questionable.
      - pavritch 8y ago
        Here's how I looked at it -- they are 1000x smarter than me on matters of encryption. It was totally unlikely I knew something they didn't. At most, I saved them a few hours on a matter of life and death, and I had minutes to make that decision. And recall, back then, people felt differently about the NSA. If this was a total spoof - the reality is I didn't give anything up. I didn't invent the encryption ciphers. I just packaged common ciphers in a user interface people really liked. But in response to the people here who think I was tricked. That's not the case. What I didn't put in the post was that a team from the NSA visited me in California a few months later. But again, had I been tricked, it wouldn't have mattered.

michaelmrose 8y ago

Given moores law the only encryption that has ever been acceptable is that which is impossible to break within any reasonable time frame. Taking slightly longer for a computer to open your files while I put my feet up and drink coffee doesn't suggest an increased degree of security unless it requires a truly substantial investment in hardware or time. The encryption in question could have been broken on a home computer 4 years later in 2 weeks. Seen as bad is a poor benchmark it WAS bad. The legal limitations on crypo export is a bad argument on so many fronts its hard to pick one. - The legal matter of exporting encryption was well on its way to settled by 2000 see https://en.wikipedia.org/wiki/Bernstein_v._United_States https://en.wikipedia.org/wiki/Bernstein_v._United_States where such restrictions were found to be illegal in 1999. - Author sold a higher grade of encryption including abroad - Author either didn't care about the law or would have been afoul of it with his paid version. - The laws against exporting encryption were a useless farce that never did anything useful