7 ms·

If it looks and sounds like a duck then its probably a duck. I can't see MS admitting to giving out a backdoor key. In any case it's irrelevant as you should a

If it looks and sounds like a duck then its probably a duck. I can't see MS admitting to giving out a backdoor key. In any case it's irrelevant as you should always assume everything you don't have source to is compromised.

xg15 7y ago
Normally, I'd agree with you, but this seems a bit too on-the-nose for me. When people have to talk about a shady or immoral activity or put mentions of it in writing, they usually get very creative in finding an inconspicuous name for it. As such, if this were really a backdoor, I'd expect it's identifiers to look maximally boring and no direct reference to the NSA given anywhere.
- ethanbond 7y ago
  Conspiracy theories tend to hinge on the idea that the conspirators are simultaneously 5-dimensional chess playing lizard people from the future and, at the end of the day, dumb as a rock.
  - arminiusreturns 7y ago
    Coincidence theories tend to hinge on the idea that everyone is incompetent and that nobody could ever collude together in secret for any sort of malicious or self interested purpose.
    - wahern 7y ago
      They hinge on the idea that the greater the value of T or N, the less likely a conspiracy will remain a secret, where T is time and N is the number of conspirators. N is usually the dominate factor.
      - arminiusreturns 7y ago
        I think there are many obvious weaknesses to this line of logic. There is some merit there, but it oversimplifies the subject in the extreme.
- filleokus 7y ago
  Well, I would think so as well, but we have at least some anecdata (N=1) in the other direction [0]: > In doing this I discovered that the NSA public key had an organizational name of "MiniTruth", and a common name of "Big Brother". Specifically what I saw in my debugger late one night, which was spooky for a short moment was: O=MiniTruth CN=Big Brother [0]: http://www.cypherspace.org/adam/hacks/lotus-nsa-key.html http://www.cypherspace.org/adam/hacks/lotus-nsa-key.html
  - pc86 7y ago
    This could just as easily be a programmer stretching the metaphor as far as possible, which is not exactly an uncommon practice.
  - sterlind 7y ago
    That was specifically a key escrow-style system, so you're right there. Lotus Notes wanted to provide strong encryption abroad, in the bad old days of ITAR. they used a hybrid of an exportable-sized key (~50 bit encryption) and a stronger, backdoored key (MiniTruth.) They were very public about it, though. It sucked they had to water down their encryption, but that was the reality until PGP challenged ITAR head-on.
- jeltz 7y ago
  What if it is a case of malicious compliance like Lotus Notes' backdoor someone else already has mentioned (the classic O=MiniTruth CN=Big Brother)?
- Legogris 7y ago
  I'd wager that there's a high probability that an arbitrary engineer tasked with implementing things like this either doesn't care or is antagonistic, thereby calling the duck a duck. Also, the name was never supposed to be known - it was due to early releases mistakenly having debug symbols included.
mtgx 7y ago
Nadella has just said that he would support a "don't-call-it-a-backdoor" backdoor key for the U.S. (and I assume other) government(s): https://www.theverge.com/2020/1/13/21064267/microsoft-encryption-backdoor-apple-ceo-nadella-pensacola-privacy https://www.theverge.com/2020/1/13/21064267/microsoft-encryp... Also, there are at least several other instances that make Microsoft highly suspicious in regards to this stuff, starting with: - how they bought Skype not long after the NSA was promising billions of dollars (in government contracts most likely) to the company that would bypass Skype's encryption somehow - changing Skype's architecture to be intercept-able - Skype entering the PRISM program the moment Microsoft bought it - some other suspicious "bugs" and design choices in regards to how Bitlocker works, including storing the encryption keys on its servers or defaulting to break-able OEM encryption. Plus the fact that you never do hear about law enforcement being thwarted by laptop encryption - silently adding root certificates in Windows with no official documentation, some for some oppressive regimes, other for the U.S. government - Not to mention that the first thought that came to my mind after hearing about all the hidden tracking stuff built into Windows 10 was that Windows 10 must have been designed based on a FBI/NSA wishlist. If you've ever done anything "wrong" on your Windows 10 machine, the U.S. government will know about it, because Microsoft will know about it. At least Microsoft revealed to us that half of the government's orders to the company were secret and came with gag orders -- too bad they never really fought the government on it and ended-up supporting it with the Cloud Act. There are probably others I missed myself or forgot about. Nadella must think of us all as idiots if he thinks we'll buy the idea that a specially-made encryption key for various governments doesn't equal a backdoor.
- jki275 7y ago
  Where do you believe MS is storing all this tracking data you believe they are taking from every Windows 10 machine on the planet? Doesn't this conspiracy theory stretch belief a great deal?
  - mrguyorama 7y ago
    The NSA has built absolutely fuck off massive datacenters in multiple places in the United States. The parent is suggesting the telemetry from Windows 10 is mostly getting passed off to the NSA
DangerousPie 7y ago
> everything you don't have source to is compromised. Everything for which you haven't read, fully understood, and compiled from the source can be compromised. Just because there's source for something somewhere doesn't mean the binary you downloaded is secure.
- zelon88 7y ago
  Relevant... [1] > Ken describes how he injected a virus into a compiler. Not only did his compiler know it was compiling the login function and inject a backdoor, but it also knew when it was compiling itself and injected the backdoor generator into the compiler it was creating. The source code for the compiler thereafter contains no evidence of either virus. [1]https://wiki.c2.com/?TheKenThompsonHack https://wiki.c2.com/?TheKenThompsonHack
  - clachance 7y ago
    This has always impressed me, I'd love to peek the code and try to read it but I highly doubt I'd be proficient enough to understand it.
    - deleted 7y ago
      [deleted]
- Denvercoder9 7y ago
  Make sure you've also read, understood and recompiled the compiler. And the compiler used to compile the compiler.
  - supercommand 7y ago
    Even then, assembly is too high level. https://m.youtube.com/watch?v=eunYrrcxXfw https://m.youtube.com/watch?v=eunYrrcxXfw And then we get into hardware design... https://m.youtube.com/watch?v=_eSAF_qT_FY https://m.youtube.com/watch?v=_eSAF_qT_FY
  - colejohnson66 7y ago

xg15 7y ago

Normally, I'd agree with you, but this seems a bit too on-the-nose for me. When people have to talk about a shady or immoral activity or put mentions of it in writing, they usually get very creative in finding an inconspicuous name for it. As such, if this were really a backdoor, I'd expect it's identifiers to look maximally boring and no direct reference to the NSA given anywhere.

ethanbond 7y ago
Conspiracy theories tend to hinge on the idea that the conspirators are simultaneously 5-dimensional chess playing lizard people from the future and, at the end of the day, dumb as a rock.
- arminiusreturns 7y ago
  Coincidence theories tend to hinge on the idea that everyone is incompetent and that nobody could ever collude together in secret for any sort of malicious or self interested purpose.
  - wahern 7y ago
    They hinge on the idea that the greater the value of T or N, the less likely a conspiracy will remain a secret, where T is time and N is the number of conspirators. N is usually the dominate factor.
    - arminiusreturns 7y ago
      I think there are many obvious weaknesses to this line of logic. There is some merit there, but it oversimplifies the subject in the extreme.
filleokus 7y ago
Well, I would think so as well, but we have at least some anecdata (N=1) in the other direction [0]: > In doing this I discovered that the NSA public key had an organizational name of "MiniTruth", and a common name of "Big Brother". Specifically what I saw in my debugger late one night, which was spooky for a short moment was: O=MiniTruth CN=Big Brother [0]: http://www.cypherspace.org/adam/hacks/lotus-nsa-key.html http://www.cypherspace.org/adam/hacks/lotus-nsa-key.html
- pc86 7y ago
  This could just as easily be a programmer stretching the metaphor as far as possible, which is not exactly an uncommon practice.
- sterlind 7y ago
  That was specifically a key escrow-style system, so you're right there. Lotus Notes wanted to provide strong encryption abroad, in the bad old days of ITAR. they used a hybrid of an exportable-sized key (~50 bit encryption) and a stronger, backdoored key (MiniTruth.) They were very public about it, though. It sucked they had to water down their encryption, but that was the reality until PGP challenged ITAR head-on.
jeltz 7y ago
What if it is a case of malicious compliance like Lotus Notes' backdoor someone else already has mentioned (the classic O=MiniTruth CN=Big Brother)?
Legogris 7y ago
I'd wager that there's a high probability that an arbitrary engineer tasked with implementing things like this either doesn't care or is antagonistic, thereby calling the duck a duck. Also, the name was never supposed to be known - it was due to early releases mistakenly having debug symbols included.

mtgx 7y ago

Nadella has just said that he would support a "don't-call-it-a-backdoor" backdoor key for the U.S. (and I assume other) government(s): https://www.theverge.com/2020/1/13/21064267/microsoft-encryption-backdoor-apple-ceo-nadella-pensacola-privacy https://www.theverge.com/2020/1/13/21064267/microsoft-encryp... Also, there are at least several other instances that make Microsoft highly suspicious in regards to this stuff, starting with: - how they bought Skype not long after the NSA was promising billions of dollars (in government contracts most likely) to the company that would bypass Skype's encryption somehow - changing Skype's architecture to be intercept-able - Skype entering the PRISM program the moment Microsoft bought it - some other suspicious "bugs" and design choices in regards to how Bitlocker works, including storing the encryption keys on its servers or defaulting to break-able OEM encryption. Plus the fact that you never do hear about law enforcement being thwarted by laptop encryption - silently adding root certificates in Windows with no official documentation, some for some oppressive regimes, other for the U.S. government - Not to mention that the first thought that came to my mind after hearing about all the hidden tracking stuff built into Windows 10 was that Windows 10 must have been designed based on a FBI/NSA wishlist. If you've ever done anything "wrong" on your Windows 10 machine, the U.S. government will know about it, because Microsoft will know about it. At least Microsoft revealed to us that half of the government's orders to the company were secret and came with gag orders -- too bad they never really fought the government on it and ended-up supporting it with the Cloud Act. There are probably others I missed myself or forgot about. Nadella must think of us all as idiots if he thinks we'll buy the idea that a specially-made encryption key for various governments doesn't equal a backdoor.

jki275 7y ago
Where do you believe MS is storing all this tracking data you believe they are taking from every Windows 10 machine on the planet? Doesn't this conspiracy theory stretch belief a great deal?
- mrguyorama 7y ago
  The NSA has built absolutely fuck off massive datacenters in multiple places in the United States. The parent is suggesting the telemetry from Windows 10 is mostly getting passed off to the NSA

DangerousPie 7y ago

> everything you don't have source to is compromised. Everything for which you haven't read, fully understood, and compiled from the source can be compromised. Just because there's source for something somewhere doesn't mean the binary you downloaded is secure.

zelon88 7y ago
Relevant... [1] > Ken describes how he injected a virus into a compiler. Not only did his compiler know it was compiling the login function and inject a backdoor, but it also knew when it was compiling itself and injected the backdoor generator into the compiler it was creating. The source code for the compiler thereafter contains no evidence of either virus. [1]https://wiki.c2.com/?TheKenThompsonHack https://wiki.c2.com/?TheKenThompsonHack
- clachance 7y ago
  This has always impressed me, I'd love to peek the code and try to read it but I highly doubt I'd be proficient enough to understand it.
  - deleted 7y ago
    [deleted]
Denvercoder9 7y ago
Make sure you've also read, understood and recompiled the compiler. And the compiler used to compile the compiler.
- supercommand 7y ago
  Even then, assembly is too high level. https://m.youtube.com/watch?v=eunYrrcxXfw https://m.youtube.com/watch?v=eunYrrcxXfw And then we get into hardware design... https://m.youtube.com/watch?v=_eSAF_qT_FY https://m.youtube.com/watch?v=_eSAF_qT_FY
- colejohnson66 7y ago