4 ms·

CIA bought an encryption company and used it to spy on clients and countries

52 points by edu 7y ago

ekimekim 7y ago
Original Washington Post article discussed here: https://news.ycombinator.com/item?id=22297963 https://news.ycombinator.com/item?id=22297963
jokoon 7y ago
Is the leak coming from wikileaks? I've heard Assange will soon go to trial. I was still wondering about that "dead's man switch", although I'm not sure it will activate if he get convicted.
- _-___________-_ 7y ago
  I read about this quite a while ago, and while it's a revelation, it doesn't seem big enough to be Assange's dead man's switch. Most people are just going to shrug at this.
  - fit2rule 7y ago
    I have heard it from the crypto cognoscenti circles I know, that this is the calm before the storm and that there will be many, many more leaks to come during the actual trial period. The idea is to point out to the world that Julian isn't the only leaker. This terrifies the spook establishment, and they are therefore preparing for their own campaign of controlled releases, designed to dull the general publics' appetite for the subject. I mean, this is all conjecture and hearsay, but it sure is an interesting time to be watching the show. I do believe we are seeing a cyberwar, like legitimately, underneath all the battle reports ..
cryptos 7y ago
The same could happen with Threema. As much as I like and want to trust Threema, but the story could be repeated, even if I think, that it is not used by governments or military large-scale. Essentially every closed source crypto application isn't trustworthy. Same is true for operating systems.
- bangboombang 7y ago
  Exactly my first thought. I like Threema and one of the reasons I was an early adopter is that the founder worked on m0n0wall before, an OSS firewall that I used for a long time, in contrast to it being just some guy I never heard of. It made me accept the closed source nature. Another big factor was that I indeed consider Switzerland to be a more trustworthy/neutral party in general when it comes to global politics, but this obviously doesn't have to apply to every single individual in that country.
  - _-___________-_ 7y ago
    Why use Threema when there are alternatives that are not closed-source? You had to begin to use Threema, which presumably carries the same difficulty as beginning to use something which isn't as questionable.
    - mmPzf 7y ago
      A big plus for me was the option of using it without mapping the user account to a phone number, something that e.g. Signal doesn't allow.
    - bangboombang 7y ago
      It was consensus between colleagues/friends. And because you still need to trust open source software as well. I certainly don't have the time to review the code, and the "somebody else will do a thorough code review" fallacy should be well known by know. As said, Threema at least had a name attached to it that I somewhat trust. Telegram for example doesn't exactly tick the "not as questionable" box for me, not least because it isn't entirely open source either, but also because I always find it weird if someone is pouring money into software that is available for free, with no obvious benefit for them in return.
- PeterStuer 7y ago
  While you are not wrong, it would be naive to assume key Open Source projects are not infiltrated by the CIA.
fit2rule 7y ago
The free world needs to realise that no matter what systems of enormous value to the world we build, others will attempt to usurp that power for their own needs. It happens with all technology. The reason is, all technology can be weaponised. Some simple facts .. The institutions covered by Crypto AG's technology products, were attempting to maintain their own secrecy. They were, thus, usurped by their own technology - and the CIA merely exploited this fact. This case with the CIA directly addresses the lynchpin in the military-industrial-surveillance states' armour - the ability to keep secrets. From a certain perspective, one might say that .. the Vaticans .. inability to keep secrets is a blessing and a curse. This is also true of many of the other clients. Would that we had access to all the things the CIA knows, as a world people, mmm.. These groups weaponised their own technology, against themselves, by using it to keep secrets. It also happens to be the spooks' biggest weakness too: the light of truth melts any and all justification for these peoples existence, and it whither them. Let us try a thought experiment: If the Vatican applied its vast resources to providing a "Peoples Internet" a la Starlink, instead of using its billions to hide heinous secrets, would the technology of communication have been so easily weaponised? All secrets are weapons, because you cannot have a secret without technology - and all technology can be weaponised. So this is a foot-bullet on the part of Crypto AG, the Vatican et al., and a big win for the CIA - because it means these institutions will now be making more commitment, alas not less - to the keeping of secrets.
jo-m 7y ago
A lot of this has been known for 25 years: https://www.spiegel.de/spiegel/print/d-9088423.html https://www.spiegel.de/spiegel/print/d-9088423.html
lallysingh 7y ago
Is this why US export encryption had to be 40 bits? To push countries to a vendor that was compromised?

52 points by edu 7y ago

Original Washington Post article discussed here: https://news.ycombinator.com/item?id=22297963 https://news.ycombinator.com/item?id=22297963

jokoon 7y ago

Is the leak coming from wikileaks? I've heard Assange will soon go to trial. I was still wondering about that "dead's man switch", although I'm not sure it will activate if he get convicted.

_-___________-_ 7y ago
I read about this quite a while ago, and while it's a revelation, it doesn't seem big enough to be Assange's dead man's switch. Most people are just going to shrug at this.
- fit2rule 7y ago
  I have heard it from the crypto cognoscenti circles I know, that this is the calm before the storm and that there will be many, many more leaks to come during the actual trial period. The idea is to point out to the world that Julian isn't the only leaker. This terrifies the spook establishment, and they are therefore preparing for their own campaign of controlled releases, designed to dull the general publics' appetite for the subject. I mean, this is all conjecture and hearsay, but it sure is an interesting time to be watching the show. I do believe we are seeing a cyberwar, like legitimately, underneath all the battle reports ..

cryptos 7y ago

The same could happen with Threema. As much as I like and want to trust Threema, but the story could be repeated, even if I think, that it is not used by governments or military large-scale. Essentially every closed source crypto application isn't trustworthy. Same is true for operating systems.

bangboombang 7y ago
Exactly my first thought. I like Threema and one of the reasons I was an early adopter is that the founder worked on m0n0wall before, an OSS firewall that I used for a long time, in contrast to it being just some guy I never heard of. It made me accept the closed source nature. Another big factor was that I indeed consider Switzerland to be a more trustworthy/neutral party in general when it comes to global politics, but this obviously doesn't have to apply to every single individual in that country.
- _-___________-_ 7y ago
  Why use Threema when there are alternatives that are not closed-source? You had to begin to use Threema, which presumably carries the same difficulty as beginning to use something which isn't as questionable.
  - mmPzf 7y ago
    A big plus for me was the option of using it without mapping the user account to a phone number, something that e.g. Signal doesn't allow.
  - bangboombang 7y ago
    It was consensus between colleagues/friends. And because you still need to trust open source software as well. I certainly don't have the time to review the code, and the "somebody else will do a thorough code review" fallacy should be well known by know. As said, Threema at least had a name attached to it that I somewhat trust. Telegram for example doesn't exactly tick the "not as questionable" box for me, not least because it isn't entirely open source either, but also because I always find it weird if someone is pouring money into software that is available for free, with no obvious benefit for them in return.
PeterStuer 7y ago
While you are not wrong, it would be naive to assume key Open Source projects are not infiltrated by the CIA.

fit2rule 7y ago

The free world needs to realise that no matter what systems of enormous value to the world we build, others will attempt to usurp that power for their own needs. It happens with all technology. The reason is, all technology can be weaponised. Some simple facts .. The institutions covered by Crypto AG's technology products, were attempting to maintain their own secrecy. They were, thus, usurped by their own technology - and the CIA merely exploited this fact. This case with the CIA directly addresses the lynchpin in the military-industrial-surveillance states' armour - the ability to keep secrets. From a certain perspective, one might say that .. the Vaticans .. inability to keep secrets is a blessing and a curse. This is also true of many of the other clients. Would that we had access to all the things the CIA knows, as a world people, mmm.. These groups weaponised their own technology, against themselves, by using it to keep secrets. It also happens to be the spooks' biggest weakness too: the light of truth melts any and all justification for these peoples existence, and it whither them. Let us try a thought experiment: If the Vatican applied its vast resources to providing a "Peoples Internet" a la Starlink, instead of using its billions to hide heinous secrets, would the technology of communication have been so easily weaponised? All secrets are weapons, because you cannot have a secret without technology - and all technology can be weaponised. So this is a foot-bullet on the part of Crypto AG, the Vatican et al., and a big win for the CIA - because it means these institutions will now be making more commitment, alas not less - to the keeping of secrets.

jo-m 7y ago

A lot of this has been known for 25 years: https://www.spiegel.de/spiegel/print/d-9088423.html https://www.spiegel.de/spiegel/print/d-9088423.html

lallysingh 7y ago

Is this why US export encryption had to be 40 bits? To push countries to a vendor that was compromised?