3 ms·

The infamous "SSL Added and removed here! :^)" slide[0] should have been proof to everyone that no one is safe from $THREE_LETTER_AGENCY or their international

by ipnon 5y ago

The infamous "SSL Added and removed here! :^)" slide[0] should have been proof to everyone that no one is safe from $THREE_LETTER_AGENCY or their international equivalents. The ubiquity of standardized smartphones at the highest levels of government means that unfathomable budgets are dedicated to cracking them with the urgency of national security as their motivation. The world's security blocks are incentivized to share their cracking tools within their spheres of influence, and the trivial margin of reproduction for software means that these tools escape from their security apparatus and proliferate like a virus on the outside. They're simply too useful to remain in the dark. If cracking your phone is possible and a cyber power wants to know what's on it, then your phone is as good as unlocked. [0] https://img.washingtonpost.com/rf/image_1484w/2010-2019/WashingtonPost/2013/10/30/Local/Images/GOOGLE-CLOUD-EXPLOITATION1383148810.jpg?uuid=X09V1kF8EeOwKN6SLXo_Rw https://img.washingtonpost.com/rf/image_1484w/2010-2019/Wash...

cmeacham98 5y ago
Not sure if that's the best example, because by my understanding Google had taken immense efforts to fix this hole, and now always treats the network as if there's hostile actors on the line. It's pretty much a success story of a civilian company against the NSA. (I make no comment about if the NSA has found other ways into Google or Google has willingly let them in, I do not know the answers to those questions)
- mike_d 5y ago
  That is an extremely naive viewpoint. When the NSA develops a capability they don't just sit around spinning in their office chairs until it stops working. There is constant development effort to ensure continued access to the information they need.
  - ipnon 5y ago
    This comment would have been just as effective without the ad hominem to begin.
octoberfranklin 5y ago
> The ubiquity of standardized smartphones at the highest levels of government means that unfathomable budgets are dedicated Our field is in denial about the importance of diversity to security. Biologists have no problem understanding this. Why can't we?
- solarengineer 5y ago
  Could you elaborate? I myself can only guess at what you mean by "diversity to security". I can think of: 1. Develop software in the open. 2. Teach security and cryptography widely using openly-developed syllabus. 3. Encourage parallel initiatives. I don't think you are referring to racial or gender or cultural diversity.
  - dolgo 5y ago
    I assume they were referring to diversity of cell phones/mobile OSes, rather than the duopoly of Android and iOS.
- simonh 5y ago
  It’s not immediately obvious to me that diversity is better. A chain is only as strong as it’s weakest link. If a foreign state has access to two phones with a secret on it and each has a different OS with different vulnerabilities, that just gives them a bigger attack surface. Similarly if there are 5 sophisticated attackers after your secrets, some may have cracked your phone security, but not others. If you use more different phone OSes you increase the chance that more attackers have exploits for at least some of your phones. Also using more phone types complicates training, increases the work you must do checking for vulnerabilities, diluting your efforts.
  - trembonator 5y ago
  - est31 5y ago
    It gets different when you are talking about denial of service attacks. Imagine everyone drove cars from the same brand, and one day a hacker discovers a way to make them all stop. Then society is shut down. If 20% of cars stopped working, it's still a major catastrophy but you can work around it somehow. If you have robot armies or something it gets even more dangerous to put all your eggs into one vendor basket.
deleted 5y ago
[deleted]

by ipnon 5y ago

cmeacham98 5y ago

Not sure if that's the best example, because by my understanding Google had taken immense efforts to fix this hole, and now always treats the network as if there's hostile actors on the line. It's pretty much a success story of a civilian company against the NSA. (I make no comment about if the NSA has found other ways into Google or Google has willingly let them in, I do not know the answers to those questions)

mike_d 5y ago
That is an extremely naive viewpoint. When the NSA develops a capability they don't just sit around spinning in their office chairs until it stops working. There is constant development effort to ensure continued access to the information they need.
- ipnon 5y ago
  This comment would have been just as effective without the ad hominem to begin.

octoberfranklin 5y ago

> The ubiquity of standardized smartphones at the highest levels of government means that unfathomable budgets are dedicated Our field is in denial about the importance of diversity to security. Biologists have no problem understanding this. Why can't we?

solarengineer 5y ago
Could you elaborate? I myself can only guess at what you mean by "diversity to security". I can think of: 1. Develop software in the open. 2. Teach security and cryptography widely using openly-developed syllabus. 3. Encourage parallel initiatives. I don't think you are referring to racial or gender or cultural diversity.
- dolgo 5y ago
  I assume they were referring to diversity of cell phones/mobile OSes, rather than the duopoly of Android and iOS.
simonh 5y ago
It’s not immediately obvious to me that diversity is better. A chain is only as strong as it’s weakest link. If a foreign state has access to two phones with a secret on it and each has a different OS with different vulnerabilities, that just gives them a bigger attack surface. Similarly if there are 5 sophisticated attackers after your secrets, some may have cracked your phone security, but not others. If you use more different phone OSes you increase the chance that more attackers have exploits for at least some of your phones. Also using more phone types complicates training, increases the work you must do checking for vulnerabilities, diluting your efforts.
- trembonator 5y ago
- est31 5y ago
  It gets different when you are talking about denial of service attacks. Imagine everyone drove cars from the same brand, and one day a hacker discovers a way to make them all stop. Then society is shut down. If 20% of cars stopped working, it's still a major catastrophy but you can work around it somehow. If you have robot armies or something it gets even more dangerous to put all your eggs into one vendor basket.

deleted 5y ago

[deleted]