10 ms·

A novel (to me) thought: if we count on the government not to break our crypto (edit: originally said break the law, I don't want to comment on the legality of

by 6AA4FD 6y ago

A novel (to me) thought: if we count on the government not to break our crypto (edit: originally said break the law, I don't want to comment on the legality of nsa actions here, it strikes me as off topic), we are already screwed. A million other crypto discussions have surfaced: if someone wants your keys, the can break your knees (rhymes too). If VA stops paying benefits, unless the organization that funds and controls them steps in, a lot of people are very screwed. While it's admirable to ensure crypto at every level (especially to address threats from other states or private individuals), ultimately as long as all three branches let the NSA eat our proverbial lunches and sneak under my mattress (gag orders, huge budget, sealing court records, etc), secure crypto is going to be a sisyphean at best. Obviously there are good reasons to push the stone upwards, but the fitting solution to problems like infiltration and gag orders seems like it will be a political one not a technical one.

_bxg1 6y ago
I think it's still worthwhile to make it as expensive for them as possible. Sure, they have supercomputers that can break any crypto a normal citizen is using. But can they break every piece of encrypted data that everyone is using? Maybe not. And if so, they're going to spend a lot of money on hardware and electricity to do so (especially as Moore's Law putters out). Now, that doesn't apply to cases when they can get their hands on a centralized key through back-room court orders. But we do also have the ability to avoid using at least some of those products in the first place.
- 6AA4FD 6y ago
  Consider that we have openssl and libressl (a fork) for open source ssl libraries (if I'm missing any please correct me). With gag orders and infiltration, is it unrealistic to assume that the NSA at least could backdoor both of them? Also consider things like adding bogus/weak crypto to NIST, intel ME and other hardware backdoors. Yes, with enough collective effort there are ways around all of it (option a), but ultimately with that much collective time and money it might be more effective to vote, advocate, and advertise (option b). Furthermore, if you go option a, anyone who poses a threat to whoever holds the reins can still be successfully abducted. (edit: and free speech/safety in political dissent is one of the major prizes everyone has their eyes on here)
  - zenhack 6y ago
    It's not an either/or; we should be doing both.
    - 6AA4FD 6y ago
      Agreed.
  - gcthomas 6y ago
    How would the NSA gag-order work on a Canada-based organisation with open source code worked on by devs around the world? (Libressl is developed by OpenBsd)
    - Gaelan 6y ago
      Presumably, there's at least one US citizen who is on the LibreSSL "core team." With a gag order, get them to write a subtle backdoor (see [0]), and add it to the codebase however they normally do. The developer is presumably trusted, so their code probably gets minimal code review, at least compared to some unknown person from the NSA trying to add it themselves. Alternatively, the US and Canadian governments are close enough that the NSA could conceivably get Canada to do that instead. [0]: http://underhanded-c.org http://underhanded-c.org
      - gcthomas 6y ago
        Wouldn't that require an NSA operative in that role? I'm probably mistaken, but what powers does the NSA have to force programmers to write code? National Security Letters, the ones that come with gag orders, are for requiring the handing over of surveillance data aren't they?
        rvnx 6y ago
        Not at all. Once you write significant software, it's frequent that the NSA or police will offer you collaboration (eg. How CloudFlare started with Project Honeypot, or how Facebook got investment by the CIA, Crypto AG that got investment, etc). The intelligence services don't have to coerce you through a gag order; they can just make a generous offer. One of the LibreSSL author(s) maybe has financial problems. In this case, what is better for him ? Accept a juicy 5M USD consulting contract, be a nice boy, solve all the problems and beyond, or be the guy that will discover what it means to be sued to oblivion on frivolous charge (NSA will never charge you but they can share information). If the US companies respect orders of the NSA, it's because they don't want to end up sacrified. If the DoJ for example needs help from Facebook to capture documents from Airbus to give them to Boeing, you think Zuck will give away all his shares, stock, money, family, or just collaborate ? The CEOs will fight the decision until they can (because of the PR risk), but at some point if the pressure is strong enough they won't be able to refuse (and I respect their choice to protect their families and by extension, protecting the families of their employees by protecting their job). If someone knows your weaknesses he has unlimited power. It doesn't matter if it is a legal or illegal organization.
jjoonathan 6y ago
But that's just it. 1800: The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no warrants shall issue, but upon probable cause... 2000: lol tech lets us read it all 2025: Oh no, crypto is good now? They want us to get a warrant and use non-dragnet surveillance to pursue leads? THE HORROR!
- bluejekyll 6y ago
  Honestly curious why the 2025 on the last comment. The police and govt have been screaming this ever more loudly over the last decade.
  - stepstop 6y ago
    And I’d also add the Clipper chip to the history
  - jjoonathan 6y ago
    Because the timeline is a simplification and because I didn't see (2015) in the title and thought "it's probably reasonable to speculate this mess will be cleaned up in the next 5 years." Joke's on me -- it probably did get cleaned up in the last 5 years, the resulting cutoff of illegal dragnet surveillance probably caused the panicked rhetoric about "going dark" we've seen from the intelligence community, and I probably would have been better off putting 2020. Calling 2000 as the "year of dragnet surveillance" has similar issues, because you could argue that dragnet surveillance really got started in the telegraph era and scaled during -- was it WWI? If I think too hard about these dates I'm going to wake up tomorrow drooling on the keyboard from a wikipedia binge.
- leephillips 6y ago
  c.1850: The feds camp out at AT&T telegraph offices and transcribe every single message with no warrants. Or something like like. It's in The Puzzle Palace.
- Spooky23 6y ago
  The root problem is a legal one. Electronic documents held by a custodian aren’t held to the standard that paper is. Hopefully the aftermath of this era of corruption and grift in government is a better legal framework.
thaumasiotes 6y ago
> if someone wants your keys, they can break your knees This doesn't seem relevant here. The government can make all the secret attempts to read your communications remotely that they want. If they want to take the strategy of torturing you until you hand the information over yourself, at a bare minimum they need to be willing to admit to doing it. It's not a threat to worry about, from the US government.
- 6AA4FD 6y ago
  I think that if a government agency thinks it can get away with away with wiretapping on the PRISM scale, it or another government agency also will think it can get away with abductions, torture, and killing.
  - sakisv 6y ago
    Especially if they throw around the "national security" argument.
  - wongarsu 6y ago
    The US government is known to kidnap people [1], torture people [2], and kill people [3]. It wouldn't be that surprising to learn that some people were victims of all three. 1: https://en.wikipedia.org/wiki/Extraordinary_rendition https://en.wikipedia.org/wiki/Extraordinary_rendition 2: https://en.wikipedia.org/wiki/Enhanced_interrogation_techniques https://en.wikipedia.org/wiki/Enhanced_interrogation_techniq... 3: https://en.wikipedia.org/wiki/Police_brutality_in_the_United_States https://en.wikipedia.org/wiki/Police_brutality_in_the_United...
    - AtlasBarfed 6y ago
      You forgot about drone strikes.
- tsimionescu 6y ago
  > It's not a threat to worry about, from the US government. You are first of all assuming the worries are coming from US citizens. People outside the US can obviously worry about the US government or its allies breaking their knees, it is a widely documented fact of life in many US war zones. We know that the US has officially been torturing people it suspected of terrorism for information (Guantanamo, CIA prisons in Eastern Europe) . Second of all, we also know from the past that the FBI has been involved in campaigns of infiltration, blackmail, threats, incitement to violence, and almost certainly assassination of civil rights organizations and leaders (COINTELPRO). This was investigated at the time by Congress and new laws were put in place to prevent this type of behavior, but we have no guarantee that it didn't resurface in some form, especially in the current political climate (especially by not only the 'war on terrorism' started by Bush and escalated by Obama, and enthusiastically supported by Trump). Overall, I think it's perfectly reasonable to fear the US government may physically force you to give up secrets, obviously so if you are not a citizen, and quite likely even if you are one.
mrkeen 6y ago
> if someone wants your keys, the can break your knees Whose knees to break though?

by 6AA4FD 6y ago

_bxg1 6y ago

I think it's still worthwhile to make it as expensive for them as possible. Sure, they have supercomputers that can break any crypto a normal citizen is using. But can they break every piece of encrypted data that everyone is using? Maybe not. And if so, they're going to spend a lot of money on hardware and electricity to do so (especially as Moore's Law putters out). Now, that doesn't apply to cases when they can get their hands on a centralized key through back-room court orders. But we do also have the ability to avoid using at least some of those products in the first place.

6AA4FD 6y ago
Consider that we have openssl and libressl (a fork) for open source ssl libraries (if I'm missing any please correct me). With gag orders and infiltration, is it unrealistic to assume that the NSA at least could backdoor both of them? Also consider things like adding bogus/weak crypto to NIST, intel ME and other hardware backdoors. Yes, with enough collective effort there are ways around all of it (option a), but ultimately with that much collective time and money it might be more effective to vote, advocate, and advertise (option b). Furthermore, if you go option a, anyone who poses a threat to whoever holds the reins can still be successfully abducted. (edit: and free speech/safety in political dissent is one of the major prizes everyone has their eyes on here)
- zenhack 6y ago
  It's not an either/or; we should be doing both.
  - 6AA4FD 6y ago
    Agreed.
- gcthomas 6y ago
  How would the NSA gag-order work on a Canada-based organisation with open source code worked on by devs around the world? (Libressl is developed by OpenBsd)
  - Gaelan 6y ago
    Presumably, there's at least one US citizen who is on the LibreSSL "core team." With a gag order, get them to write a subtle backdoor (see [0]), and add it to the codebase however they normally do. The developer is presumably trusted, so their code probably gets minimal code review, at least compared to some unknown person from the NSA trying to add it themselves. Alternatively, the US and Canadian governments are close enough that the NSA could conceivably get Canada to do that instead. [0]: http://underhanded-c.org http://underhanded-c.org
    - gcthomas 6y ago
      Wouldn't that require an NSA operative in that role? I'm probably mistaken, but what powers does the NSA have to force programmers to write code? National Security Letters, the ones that come with gag orders, are for requiring the handing over of surveillance data aren't they?
      - rvnx 6y ago
        Not at all. Once you write significant software, it's frequent that the NSA or police will offer you collaboration (eg. How CloudFlare started with Project Honeypot, or how Facebook got investment by the CIA, Crypto AG that got investment, etc). The intelligence services don't have to coerce you through a gag order; they can just make a generous offer. One of the LibreSSL author(s) maybe has financial problems. In this case, what is better for him ? Accept a juicy 5M USD consulting contract, be a nice boy, solve all the problems and beyond, or be the guy that will discover what it means to be sued to oblivion on frivolous charge (NSA will never charge you but they can share information). If the US companies respect orders of the NSA, it's because they don't want to end up sacrified. If the DoJ for example needs help from Facebook to capture documents from Airbus to give them to Boeing, you think Zuck will give away all his shares, stock, money, family, or just collaborate ? The CEOs will fight the decision until they can (because of the PR risk), but at some point if the pressure is strong enough they won't be able to refuse (and I respect their choice to protect their families and by extension, protecting the families of their employees by protecting their job). If someone knows your weaknesses he has unlimited power. It doesn't matter if it is a legal or illegal organization.

jjoonathan 6y ago

But that's just it. 1800: The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no warrants shall issue, but upon probable cause... 2000: lol tech lets us read it all 2025: Oh no, crypto is good now? They want us to get a warrant and use non-dragnet surveillance to pursue leads? THE HORROR!

bluejekyll 6y ago
Honestly curious why the 2025 on the last comment. The police and govt have been screaming this ever more loudly over the last decade.
- stepstop 6y ago
  And I’d also add the Clipper chip to the history
- jjoonathan 6y ago
  Because the timeline is a simplification and because I didn't see (2015) in the title and thought "it's probably reasonable to speculate this mess will be cleaned up in the next 5 years." Joke's on me -- it probably did get cleaned up in the last 5 years, the resulting cutoff of illegal dragnet surveillance probably caused the panicked rhetoric about "going dark" we've seen from the intelligence community, and I probably would have been better off putting 2020. Calling 2000 as the "year of dragnet surveillance" has similar issues, because you could argue that dragnet surveillance really got started in the telegraph era and scaled during -- was it WWI? If I think too hard about these dates I'm going to wake up tomorrow drooling on the keyboard from a wikipedia binge.
leephillips 6y ago
c.1850: The feds camp out at AT&T telegraph offices and transcribe every single message with no warrants. Or something like like. It's in The Puzzle Palace.
Spooky23 6y ago
The root problem is a legal one. Electronic documents held by a custodian aren’t held to the standard that paper is. Hopefully the aftermath of this era of corruption and grift in government is a better legal framework.

thaumasiotes 6y ago

> if someone wants your keys, they can break your knees This doesn't seem relevant here. The government can make all the secret attempts to read your communications remotely that they want. If they want to take the strategy of torturing you until you hand the information over yourself, at a bare minimum they need to be willing to admit to doing it. It's not a threat to worry about, from the US government.

6AA4FD 6y ago
I think that if a government agency thinks it can get away with away with wiretapping on the PRISM scale, it or another government agency also will think it can get away with abductions, torture, and killing.
- sakisv 6y ago
  Especially if they throw around the "national security" argument.
- wongarsu 6y ago
  The US government is known to kidnap people [1], torture people [2], and kill people [3]. It wouldn't be that surprising to learn that some people were victims of all three. 1: https://en.wikipedia.org/wiki/Extraordinary_rendition https://en.wikipedia.org/wiki/Extraordinary_rendition 2: https://en.wikipedia.org/wiki/Enhanced_interrogation_techniques https://en.wikipedia.org/wiki/Enhanced_interrogation_techniq... 3: https://en.wikipedia.org/wiki/Police_brutality_in_the_United_States https://en.wikipedia.org/wiki/Police_brutality_in_the_United...
  - AtlasBarfed 6y ago
    You forgot about drone strikes.
tsimionescu 6y ago
> It's not a threat to worry about, from the US government. You are first of all assuming the worries are coming from US citizens. People outside the US can obviously worry about the US government or its allies breaking their knees, it is a widely documented fact of life in many US war zones. We know that the US has officially been torturing people it suspected of terrorism for information (Guantanamo, CIA prisons in Eastern Europe) . Second of all, we also know from the past that the FBI has been involved in campaigns of infiltration, blackmail, threats, incitement to violence, and almost certainly assassination of civil rights organizations and leaders (COINTELPRO). This was investigated at the time by Congress and new laws were put in place to prevent this type of behavior, but we have no guarantee that it didn't resurface in some form, especially in the current political climate (especially by not only the 'war on terrorism' started by Bush and escalated by Obama, and enthusiastically supported by Trump). Overall, I think it's perfectly reasonable to fear the US government may physically force you to give up secrets, obviously so if you are not a citizen, and quite likely even if you are one.

mrkeen 6y ago

> if someone wants your keys, the can break your knees Whose knees to break though?