3 ms·

why people still think it's ok to have secrets in a government? is it the many movies where the hero help the gov to hide some alien invasion to prevent panic

by gcb 15y ago

why people still think it's ok to have secrets in a government? is it the many movies where the hero help the gov to hide some alien invasion to prevent panic that causes people to think this is right?

jerf 15y ago
Because people who wish you harm for various reasons really exist, and nobody's figured out how to tell the entire world every detail about our defensive capabilities without substantially weakening them in the process. I'm a little-l libertarian and I'll happily join the calls for "more transparency" where appropriate, but "government should have no secrets", especially in the area of self defense, is not a realistic position. It's an abusable-but-necessary evil.
- darklajid 15y ago
  I don't want to be dragged into politics right now, but > Because people who wish you harm for various reasons really exist, and nobody's figured out how to tell the entire world every detail about our defensive capabilities without substantially weakening them in the process. ..sounds like security through obscurity to me.
  - redxaxder 15y ago
    No more than keeping your encryption keys a secret is security through obscurity. Even if you're transparent about your overall scheme, you need to keep some execution details hidden.
    - gcb 15y ago
      no. security and government decency is telling everyone "we spend x billions here and use z and y to encrypt access to it" what happens is "we spent x billions on toilet seats (to quote an alien movie) and password go over the air unencrypted, but we are not telling you the frequency"
  - nl 15y ago
    ..sounds like security through obscurity to me. That sounds like you are echoing something you heard once without understanding the reasoning behind it. security through obscurity usually doesn't make sense WRT computer security because the attacks the computer systems are often subject to are sustained for long periods and can't be stopped (think of someone downloading your software to attack it). In a military situation you do have the capability to retaliate and/or reinforce. This changes the situation because it makes time a critical factor. In that case, obscurity makes a lot of sense because it slows down the attacker. When you have the ability to change things yourself anything that slows down the attack is useful. This applies to computer security too - if you can detect an attack, then anything that stops that attack from being successful for long enough that you can neutralize the attack vector is useful. This doesn't imply "security though obscurity", but it does imply that you have defence-in-depth, and you don't give out information about what those lower level defences are. Then if your outer layer is breached there is at least some chance the attacker will trigger some kind of alert while working out what the next layer of defence is. That isn't "security though obscurity", it is "security and obscurity".
hugh3 15y ago
Interestingly I think that anti-government paranoia in the US is largely itself fed by all those movies in which some corrupt US government agency turns out to be the villain. As a fun exercise, count the number of movies and TV shows in which the CIA is shown in a positive light. The FBI often is, the military usually is, the CIA almost never. Heck, the CIA has such a bad name in American movie land that on the odd occasion they want to show a good American spy (e.g. Die Another Day) they'll put 'em in the NSA instead despite the fact that the activities depicted are much more CIA-like than NSA-like.
- ldar15 15y ago
  Either that or the fact that one minute the President swears to defend the constitution and then the next minute orders unconstitutional wiretaps, torture, invasion, etc. Or maybe that the country exists because of government tyranny. Or because the government arrests people just for showing up to the wrong meeting. Or because they have studied International Relations at Cambridge University and have an understanding of world history. (that one is probably quite rare, but its very effective).

by gcb 15y ago

jerf 15y ago

Because people who wish you harm for various reasons really exist, and nobody's figured out how to tell the entire world every detail about our defensive capabilities without substantially weakening them in the process. I'm a little-l libertarian and I'll happily join the calls for "more transparency" where appropriate, but "government should have no secrets", especially in the area of self defense, is not a realistic position. It's an abusable-but-necessary evil.

darklajid 15y ago
I don't want to be dragged into politics right now, but > Because people who wish you harm for various reasons really exist, and nobody's figured out how to tell the entire world every detail about our defensive capabilities without substantially weakening them in the process. ..sounds like security through obscurity to me.
- redxaxder 15y ago
  No more than keeping your encryption keys a secret is security through obscurity. Even if you're transparent about your overall scheme, you need to keep some execution details hidden.
  - gcb 15y ago
    no. security and government decency is telling everyone "we spend x billions here and use z and y to encrypt access to it" what happens is "we spent x billions on toilet seats (to quote an alien movie) and password go over the air unencrypted, but we are not telling you the frequency"
- nl 15y ago
  ..sounds like security through obscurity to me. That sounds like you are echoing something you heard once without understanding the reasoning behind it. security through obscurity usually doesn't make sense WRT computer security because the attacks the computer systems are often subject to are sustained for long periods and can't be stopped (think of someone downloading your software to attack it). In a military situation you do have the capability to retaliate and/or reinforce. This changes the situation because it makes time a critical factor. In that case, obscurity makes a lot of sense because it slows down the attacker. When you have the ability to change things yourself anything that slows down the attack is useful. This applies to computer security too - if you can detect an attack, then anything that stops that attack from being successful for long enough that you can neutralize the attack vector is useful. This doesn't imply "security though obscurity", but it does imply that you have defence-in-depth, and you don't give out information about what those lower level defences are. Then if your outer layer is breached there is at least some chance the attacker will trigger some kind of alert while working out what the next layer of defence is. That isn't "security though obscurity", it is "security and obscurity".

hugh3 15y ago

Interestingly I think that anti-government paranoia in the US is largely itself fed by all those movies in which some corrupt US government agency turns out to be the villain. As a fun exercise, count the number of movies and TV shows in which the CIA is shown in a positive light. The FBI often is, the military usually is, the CIA almost never. Heck, the CIA has such a bad name in American movie land that on the odd occasion they want to show a good American spy (e.g. Die Another Day) they'll put 'em in the NSA instead despite the fact that the activities depicted are much more CIA-like than NSA-like.

ldar15 15y ago
Either that or the fact that one minute the President swears to defend the constitution and then the next minute orders unconstitutional wiretaps, torture, invasion, etc. Or maybe that the country exists because of government tyranny. Or because the government arrests people just for showing up to the wrong meeting. Or because they have studied International Relations at Cambridge University and have an understanding of world history. (that one is probably quite rare, but its very effective).