3 ms·
Agreed, although I think this is the hard bit: > - Audit the hell out of these and offer bounties for any vulnerabilities which can be demonstrated. The NSA b
by Closi 5y ago
Agreed, although I think this is the hard bit:
> - Audit the hell out of these and offer bounties for any vulnerabilities which can be demonstrated.
The NSA backdoors will be pretty hard to find if they are there - It's not like you are going to see something like "If User == "NSA" Then Divulge_Key()". The backdoor is going to be something like a very subtle bug with how a particular crypto library is implemented, or some obscure buffer oveflow attack, and it probably won't even be discernible from an accidental bug.
In reality I doubt there is any way to know if the NSA can eavesdrop, it's a complete coin toss.
- dredmorbius 5y agoAFAIU most of the NSA's capabilities come through workfactor-reduction values --- seed values to cryptographic functions which reduce the time to crack a given message (if the secret seeds are known). Avoiding NIST-recommended ciphers seems to be generally-advisable in this case. There are other backdoors (see the case of Juniper Networks), but there's probably an enumerable set of pracices. One helpful option is to use Free Software tools in which single actors are ulikely to be able to subvert the tool, and many have an interest in its integrity.