6 ms·

I just pretty much assume US spy agencies can track everything from all the logs they can gather and have access too. Want to keep a secret keep it in your hea

I just pretty much assume US spy agencies can track everything from all the logs they can gather and have access too. Want to keep a secret keep it in your head. Those so called neutral parties like Switzerland are just US proxies with a good imago that only recently got tarnished.

matheusmoreira 6y ago
The US is able to do that now. Humanity as a whole should work to change that. Agencies like the CIA, NSA and whatever other group that does "clandestine" operations shouldn't even exist in the first place. We achieve this by making encryption easy, powerful and ubiquitous. That will take care of their dragnet espionage.
- sangnoir 6y ago
  > We achieve this by making encryption easy, powerful and ubiquitous Ubiquitous encryption will be pointless if the encryption itself is subverted, like it was for 50 years with the 2 leading Swiss encryption vendors. I imagine the CIA/NSA would target the PRNG hardware as the crown-jewel, and the next-best targets would be "enclaves", then back-dooring the algorithms themselves (or implementations thereof). Remember - their aim isn't to break encryption (which would be simple to spot) - it's to make it easier for them to break, while remaining hard for everyone else.
  - matheusmoreira 6y ago
    > I imagine the CIA/NSA would target the PRNG hardware as the crown-jewel The cryptography community seems to already be aware of this risk. I've read about random number algorithms that mix the results of many randomness sources so that one compromised source cannot compromise the result. > and the next-best targets would be "enclaves" Yeah, we should watch out for this. Secure cryptoprocessors are a great thing but we need to be able to trust them. We already have hardware that runs free software but the chip itself can of course be compromised... > then back-dooring the algorithms themselves I trust that the worldwide cryptography community will never let that happen. From what I've read they no longer trust the NSA implicitly.
    - sangnoir 6y ago
      > I trust that the worldwide cryptography community will never let that happen. I wonder who puts in more expert man-hours into safeguarding/defeating crypto: the US alphabet soup agencies, or the rest of the of the "worldwide cryptography community". I'm fairly certain the government spends more dollars (doing things like factoring enough primes AOT to be able to decrypt ~20% of all https traffic in realtime[1]). Often things that community concludes to be "unlikely" or "difficult" are well within the governments ability - cue "SSL added and removed here ;-)" I think the fact that the cryptography community didn't pick up on Crypto AG's subterfuge says a lot, IMO. 1. https://arstechnica.com/information-technology/2015/10/how-the-nsa-can-break-trillions-of-encrypted-web-and-vpn-connections/ https://arstechnica.com/information-technology/2015/10/how-t...
      - andrewnicolalde 6y ago
        How much access did the cryptography community have to Crypto AG’s cipher machines? I thought those were mostly sold to foreign military/diplomatic missions.
    - asymptotically3 6y ago
      > I've read about random number algorithms that mix the results of many randomness sources so that one compromised source cannot compromise the result. You might like djb's article "Entropy Attacks!": https://blog.cr.yp.to/20140205-entropy.html https://blog.cr.yp.to/20140205-entropy.html
  - acruns 6y ago
    And any hardware protection that flows through a supply chain including just FedEx/ups/dhl can be compromised at the hardware level.
- op03 6y ago
  Agencies are just a representation of the human personality spectrum in the population. Saying they shouldn't exist is like saying people driven by ambition, fear, mistrust, aggressiveness should not exist. When people's needs aren't aligned all these personality variations in the population come to the fore.
- ekianjo 6y ago
  > Agencies like the CIA, NSA and whatever other group that does "clandestine" operations shouldn't even exist in the first place. Who cares if they should or should not exist? The point is that they are there in most countries already (nothing limited to the US) so worrying about the ideal situation of not having them around is not very helpful. Just like "we should not have nuclear weapons" is a very weak argument as there's no way you can put the genie back in the box.
- colechristensen 6y ago
  > Agencies like the CIA, NSA and whatever other group that does "clandestine" operations shouldn't even exist in the first place. Such organizations are simply necessary to run a nation. Global politics is a game, and everyone plays it. It involves gathering intelligence and acting on it. The work isn’t beyond reproach, and the nature of secrecy makes doing dirty things an unavoidable consequence... but ultimately you have to accept that reality is messy, the world isn’t very nice, and sometimes you don’t have a choice as a nation but to do some detestable act for some higher purpose... and rarely will it be possible for the whole story to be told publicly in order to be judged fairly. Sure it would be nice if everybody stopped being so awful to each other, but you can’t pretend like that is already true if you don’t want to lose everything. In plenty of circumstances intelligence agencies have done things that never should have been done, but that isn’t an argument to stop all together.
  - tsimionescu 6y ago
    > sometimes you don’t have a choice as a nation but to do some detestable act for some higher purpose It's always important to force yourself to remember that essentially all detestable acts are done for detestable purposes, no matter how selfless the rhetoric tries to make them sound. There may have been a handful of exceptions in history, but they are so vastly outnumbered by the other kind that they can safely be ignored. The narrative of doing something for the greater good should be treated as a lie until the burden of evidence is so high that you are forced to accept that it was indeed good. In particular, spy agencies have produced far more terrorism, coups, and disinformation for their own people, with the goal of supporting the monetary interests of their nation, all others be damned, than they have ever defended anything. The exceptions almost always happen when the goals of empire happen to be aligned with those of the people, like during WW2.
    - colechristensen 6y ago
      > The narrative of doing something for the greater good should be treated as a lie until the burden of evidence is so high that you are forced to accept that it was indeed good. An obvious impossible standard, more than that you can’t really know if an action was right or wrong without an oracle to tell you what would have happened if different forces had been made.
- HappyDreamer 6y ago
  > Agencies like ... that does "clandestine" operations shouldn't even exist in the first place If one day they have all disappeared, it just means they hid themselves from you, and fooled you completely.
powersnail 6y ago
I just assume that if any nation-level actor wants to "get" me, it can. I really don't include spy agencies in my threat models because I feel like it's a battle already lost before I even begin. If they put a gun at my head, I'll tell them my password anyway. Nothing in my hard drive --- or my head --- is worth my life. As long as my devices can fend off the generic attacks, like script kiddies, port scanners, DNS hijacking at public wifi, I'm content. That said, my defeatist attitude is at least partly because I'm a nobody. For high-value targets, they must have their own method of protection that doesn't rely simply on a promise to be neutral.

matheusmoreira 6y ago

The US is able to do that now. Humanity as a whole should work to change that. Agencies like the CIA, NSA and whatever other group that does "clandestine" operations shouldn't even exist in the first place. We achieve this by making encryption easy, powerful and ubiquitous. That will take care of their dragnet espionage.

sangnoir 6y ago
> We achieve this by making encryption easy, powerful and ubiquitous Ubiquitous encryption will be pointless if the encryption itself is subverted, like it was for 50 years with the 2 leading Swiss encryption vendors. I imagine the CIA/NSA would target the PRNG hardware as the crown-jewel, and the next-best targets would be "enclaves", then back-dooring the algorithms themselves (or implementations thereof). Remember - their aim isn't to break encryption (which would be simple to spot) - it's to make it easier for them to break, while remaining hard for everyone else.
- matheusmoreira 6y ago
  > I imagine the CIA/NSA would target the PRNG hardware as the crown-jewel The cryptography community seems to already be aware of this risk. I've read about random number algorithms that mix the results of many randomness sources so that one compromised source cannot compromise the result. > and the next-best targets would be "enclaves" Yeah, we should watch out for this. Secure cryptoprocessors are a great thing but we need to be able to trust them. We already have hardware that runs free software but the chip itself can of course be compromised... > then back-dooring the algorithms themselves I trust that the worldwide cryptography community will never let that happen. From what I've read they no longer trust the NSA implicitly.
  - sangnoir 6y ago
    > I trust that the worldwide cryptography community will never let that happen. I wonder who puts in more expert man-hours into safeguarding/defeating crypto: the US alphabet soup agencies, or the rest of the of the "worldwide cryptography community". I'm fairly certain the government spends more dollars (doing things like factoring enough primes AOT to be able to decrypt ~20% of all https traffic in realtime[1]). Often things that community concludes to be "unlikely" or "difficult" are well within the governments ability - cue "SSL added and removed here ;-)" I think the fact that the cryptography community didn't pick up on Crypto AG's subterfuge says a lot, IMO. 1. https://arstechnica.com/information-technology/2015/10/how-the-nsa-can-break-trillions-of-encrypted-web-and-vpn-connections/ https://arstechnica.com/information-technology/2015/10/how-t...
    - andrewnicolalde 6y ago
      How much access did the cryptography community have to Crypto AG’s cipher machines? I thought those were mostly sold to foreign military/diplomatic missions.
  - asymptotically3 6y ago
    > I've read about random number algorithms that mix the results of many randomness sources so that one compromised source cannot compromise the result. You might like djb's article "Entropy Attacks!": https://blog.cr.yp.to/20140205-entropy.html https://blog.cr.yp.to/20140205-entropy.html
- acruns 6y ago
  And any hardware protection that flows through a supply chain including just FedEx/ups/dhl can be compromised at the hardware level.
op03 6y ago
Agencies are just a representation of the human personality spectrum in the population. Saying they shouldn't exist is like saying people driven by ambition, fear, mistrust, aggressiveness should not exist. When people's needs aren't aligned all these personality variations in the population come to the fore.
ekianjo 6y ago
> Agencies like the CIA, NSA and whatever other group that does "clandestine" operations shouldn't even exist in the first place. Who cares if they should or should not exist? The point is that they are there in most countries already (nothing limited to the US) so worrying about the ideal situation of not having them around is not very helpful. Just like "we should not have nuclear weapons" is a very weak argument as there's no way you can put the genie back in the box.
colechristensen 6y ago
> Agencies like the CIA, NSA and whatever other group that does "clandestine" operations shouldn't even exist in the first place. Such organizations are simply necessary to run a nation. Global politics is a game, and everyone plays it. It involves gathering intelligence and acting on it. The work isn’t beyond reproach, and the nature of secrecy makes doing dirty things an unavoidable consequence... but ultimately you have to accept that reality is messy, the world isn’t very nice, and sometimes you don’t have a choice as a nation but to do some detestable act for some higher purpose... and rarely will it be possible for the whole story to be told publicly in order to be judged fairly. Sure it would be nice if everybody stopped being so awful to each other, but you can’t pretend like that is already true if you don’t want to lose everything. In plenty of circumstances intelligence agencies have done things that never should have been done, but that isn’t an argument to stop all together.
- tsimionescu 6y ago
  > sometimes you don’t have a choice as a nation but to do some detestable act for some higher purpose It's always important to force yourself to remember that essentially all detestable acts are done for detestable purposes, no matter how selfless the rhetoric tries to make them sound. There may have been a handful of exceptions in history, but they are so vastly outnumbered by the other kind that they can safely be ignored. The narrative of doing something for the greater good should be treated as a lie until the burden of evidence is so high that you are forced to accept that it was indeed good. In particular, spy agencies have produced far more terrorism, coups, and disinformation for their own people, with the goal of supporting the monetary interests of their nation, all others be damned, than they have ever defended anything. The exceptions almost always happen when the goals of empire happen to be aligned with those of the people, like during WW2.
  - colechristensen 6y ago
    > The narrative of doing something for the greater good should be treated as a lie until the burden of evidence is so high that you are forced to accept that it was indeed good. An obvious impossible standard, more than that you can’t really know if an action was right or wrong without an oracle to tell you what would have happened if different forces had been made.
HappyDreamer 6y ago
> Agencies like ... that does "clandestine" operations shouldn't even exist in the first place If one day they have all disappeared, it just means they hid themselves from you, and fooled you completely.

powersnail 6y ago

I just assume that if any nation-level actor wants to "get" me, it can. I really don't include spy agencies in my threat models because I feel like it's a battle already lost before I even begin. If they put a gun at my head, I'll tell them my password anyway. Nothing in my hard drive --- or my head --- is worth my life. As long as my devices can fend off the generic attacks, like script kiddies, port scanners, DNS hijacking at public wifi, I'm content. That said, my defeatist attitude is at least partly because I'm a nobody. For high-value targets, they must have their own method of protection that doesn't rely simply on a promise to be neutral.