3 ms·

AWS hired the architect behind the NSA's attempt at breaking commercial crypto, according the Matthew Green [0]. I can't trust AWS will be truthful about their

AWS hired the architect behind the NSA's attempt at breaking commercial crypto, according the Matthew Green [0]. I can't trust AWS will be truthful about their crypto systems and lack of backdoors. [0] - https://twitter.com/matthew_d_green/status/1357143560005509122 https://twitter.com/matthew_d_green/status/13571435600055091...

LordDragonfang 5y ago
To be fair, if you were interested in hardening your system and evaluating attack surfaces, that is also what you would do.
- arpinum 5y ago
  Great! invite someone into the building who has lied to the entire crypto community to undermine global security. They will surely know how to spot bad actors! Invite a bad actor into the building in order to keep bad actors out. Invite bad actor into the building? Hmm, maybe not.
  - staticassertion 5y ago
    You've just described a decades-long strategy of the strongest information security teams, which has turned into the industry of red teaming.
rainonmoon 5y ago
Green's conviction about this is tantalizing but it's also melodramatic in a way that makes it easy to believe something not quite true (or provable, anyway.) In fact if you look down the thread, you'll see Green admitting that correlating Salter is basically speculation and other people providing plausible alternatives to Green's claims for Salter's motives at AWS. tptacek has a more measured history of what actually happened and it is very different than what you'd glean from Green's tweets.[0] Personally in this case I'd be more worried about touting Ring's end-to-end encryption with one hand while the other hand points one of those ends to your police department[1]. [0] https://sockpuppet.org/blog/2015/08/04/is-extended-random-malicious/ https://sockpuppet.org/blog/2015/08/04/is-extended-random-ma... [1] https://www.theguardian.com/commentisfree/2021/may/18/amazon-ring-largest-civilian-surveillance-network-us https://www.theguardian.com/commentisfree/2021/may/18/amazon...
- arpinum 5y ago
  Good links, thanks

LordDragonfang 5y ago

To be fair, if you were interested in hardening your system and evaluating attack surfaces, that is also what you would do.

arpinum 5y ago
Great! invite someone into the building who has lied to the entire crypto community to undermine global security. They will surely know how to spot bad actors! Invite a bad actor into the building in order to keep bad actors out. Invite bad actor into the building? Hmm, maybe not.
- staticassertion 5y ago
  You've just described a decades-long strategy of the strongest information security teams, which has turned into the industry of red teaming.

rainonmoon 5y ago

Green's conviction about this is tantalizing but it's also melodramatic in a way that makes it easy to believe something not quite true (or provable, anyway.) In fact if you look down the thread, you'll see Green admitting that correlating Salter is basically speculation and other people providing plausible alternatives to Green's claims for Salter's motives at AWS. tptacek has a more measured history of what actually happened and it is very different than what you'd glean from Green's tweets.[0] Personally in this case I'd be more worried about touting Ring's end-to-end encryption with one hand while the other hand points one of those ends to your police department[1]. [0] https://sockpuppet.org/blog/2015/08/04/is-extended-random-malicious/ https://sockpuppet.org/blog/2015/08/04/is-extended-random-ma... [1] https://www.theguardian.com/commentisfree/2021/may/18/amazon-ring-largest-civilian-surveillance-network-us https://www.theguardian.com/commentisfree/2021/may/18/amazon...

arpinum 5y ago
Good links, thanks