11 ms·

The Mitto AG surveillanve case – or why we must never backdoor encryption

113 points by starsep 4y ago

mrjin 4y ago
So it's really from the two options: 1. Rock solid encryption without any backdoor, protecting everyone at the cost of being unable to decrypt some vital info. 2. Encryption with backdoor, decrypting any message at at the cost of potentially exposing everyone.
rossdavidh 4y ago
Looks like a misspelling of "surveillance".
ajsnigrutin 4y ago
tinus_hn 4y ago
The problem of course is that accepting such a backdoor presumes there is some benevolent institution that can be trusted to fairly regulate use of the backdoor.
- Kalium 4y ago
  More than that, it also presumes that no other institution will ever find said backdoor and put it to use for their own purposes.
raincom 4y ago
Don't trust any company that sells "Swiss neutrality" in the name of security. Mitto AG is the 21st century Crypto AG, who sold secure phones to almost all countries, so that the five eyes can spy on diplomatic communications.
driverdan 4y ago
This isn't "breaking news" as this site claims. The source was published in 2021: https://www.bloomberg.com/news/articles/2021-12-06/this-swiss-tech-exec-is-said-to-have-operated-a-secret-surveillance-operation https://www.bloomberg.com/news/articles/2021-12-06/this-swis...
chrisweekly 4y ago
Mods: title typo: surveillanVe
DerekBickerton 4y ago
Phones in general are terrible for opsec. Even if you've flashed a Pixel with GrapheneOS[0] you can't reliably determine if you have malware on your device. They're totally opaque. So are computers in general: They're largely black boxes which we have no insight to and can't readily inspect what they're doing at any given moment. Also: Welcome to the Internet! [0] https://grapheneos.org/ https://grapheneos.org/
- daniel-cussen 4y ago
  Thanks, I love it already! You know one time my computer was compromised I actually tried to clear the malware without reinstalling the OS. Like breaking out of a prison without outside help, just like sending commands trying to kill the virus beyond its capacity to hide itself, move around inside the computer, defend itself against my commands, extend and capture, all that. Maybe it's possible. The other thing is at a some point code transitions into medicine. A friend was describing codebases of like 15000 lines, that they had tumors. And they won't go away just like that, you have to try to contain them from spreading, help them become benign, it's more like medicine at that point. Like you can't sequence every cell, you can't debug completely, you can't clear all malware. Just like in the body there's germs going around, there's lots of cells whose DNA gets modified over time due to radiation, all kinds of shit going on and you can't just debug them one by one.
keraf 4y ago
The Russian shell company as a proof of involvement of Russian intelligence services puzzles me quite a bit. I thought this could be done remotely without the need of a local branch. It sounds more like it has been established there to sell these backdoored encryption products on their market. Or am I missing something?
IAmEveryone 4y ago
The headline is editorializing beyond what’s supported by the article. That technology, SS7, wasn’t intended as a backdoor. It was about network management. As such, it may have been possible to gain access to it far easier than it would be to some intentional backdoor.
teknopaul 4y ago
I have never been under the impression that 2fa with telephone numbers was anything other than surveillance. Either by the company touting it as a security enhancement or by mitm. And for the record don't think that apps that use the central messaging frameworks enforced by Google and Apple are doing anything different. Every time I log in to my bank with Firefox or and device anywhere in the world, Google is told about it. In the real world this means that Google has to autorize my access to my bank.
hulitu 4y ago
> The Mitto AG surveillanve case – or why we must never backdoor encryption But encryption is already backdored. See the article.
- danw1979 4y ago
  The vulnerabilities allegedly exploited in the article (in SS7) have nothing to do with encryption being backdoored. It’s a bit of a weird conclusion to make… Maybe they are saying that if the PSTN ran with strong encryption and authentication and that encryption wasn’t backdoored, this thing that is alleged to have happened wouldn’t have happened ?
  - xvector 4y ago
    I believe that is exactly their point.
  - db48x 4y ago
    SS7 may or may not have been intentionally backdoored at the time, but its development also predates the invention of the RSA algorithm upon which all modern security is founded. A key–exchange system like RSA or its successors is really required to do end–to–end encryption, and some sort of CA system is necessary if you are going have any hope of verifying that you are talking to the correct phone on the other end.

113 points by starsep 4y ago

So it's really from the two options: 1. Rock solid encryption without any backdoor, protecting everyone at the cost of being unable to decrypt some vital info. 2. Encryption with backdoor, decrypting any message at at the cost of potentially exposing everyone.

rossdavidh 4y ago

Looks like a misspelling of "surveillance".

ajsnigrutin 4y ago

tinus_hn 4y ago

The problem of course is that accepting such a backdoor presumes there is some benevolent institution that can be trusted to fairly regulate use of the backdoor.

Kalium 4y ago
More than that, it also presumes that no other institution will ever find said backdoor and put it to use for their own purposes.

raincom 4y ago

Don't trust any company that sells "Swiss neutrality" in the name of security. Mitto AG is the 21st century Crypto AG, who sold secure phones to almost all countries, so that the five eyes can spy on diplomatic communications.

driverdan 4y ago

This isn't "breaking news" as this site claims. The source was published in 2021: https://www.bloomberg.com/news/articles/2021-12-06/this-swiss-tech-exec-is-said-to-have-operated-a-secret-surveillance-operation https://www.bloomberg.com/news/articles/2021-12-06/this-swis...

chrisweekly 4y ago

Mods: title typo: surveillanVe

DerekBickerton 4y ago

Phones in general are terrible for opsec. Even if you've flashed a Pixel with GrapheneOS[0] you can't reliably determine if you have malware on your device. They're totally opaque. So are computers in general: They're largely black boxes which we have no insight to and can't readily inspect what they're doing at any given moment. Also: Welcome to the Internet! [0] https://grapheneos.org/ https://grapheneos.org/

daniel-cussen 4y ago
Thanks, I love it already! You know one time my computer was compromised I actually tried to clear the malware without reinstalling the OS. Like breaking out of a prison without outside help, just like sending commands trying to kill the virus beyond its capacity to hide itself, move around inside the computer, defend itself against my commands, extend and capture, all that. Maybe it's possible. The other thing is at a some point code transitions into medicine. A friend was describing codebases of like 15000 lines, that they had tumors. And they won't go away just like that, you have to try to contain them from spreading, help them become benign, it's more like medicine at that point. Like you can't sequence every cell, you can't debug completely, you can't clear all malware. Just like in the body there's germs going around, there's lots of cells whose DNA gets modified over time due to radiation, all kinds of shit going on and you can't just debug them one by one.

keraf 4y ago

The Russian shell company as a proof of involvement of Russian intelligence services puzzles me quite a bit. I thought this could be done remotely without the need of a local branch. It sounds more like it has been established there to sell these backdoored encryption products on their market. Or am I missing something?

IAmEveryone 4y ago

The headline is editorializing beyond what’s supported by the article. That technology, SS7, wasn’t intended as a backdoor. It was about network management. As such, it may have been possible to gain access to it far easier than it would be to some intentional backdoor.

teknopaul 4y ago

I have never been under the impression that 2fa with telephone numbers was anything other than surveillance. Either by the company touting it as a security enhancement or by mitm. And for the record don't think that apps that use the central messaging frameworks enforced by Google and Apple are doing anything different. Every time I log in to my bank with Firefox or and device anywhere in the world, Google is told about it. In the real world this means that Google has to autorize my access to my bank.

hulitu 4y ago

> The Mitto AG surveillanve case – or why we must never backdoor encryption But encryption is already backdored. See the article.

danw1979 4y ago
The vulnerabilities allegedly exploited in the article (in SS7) have nothing to do with encryption being backdoored. It’s a bit of a weird conclusion to make… Maybe they are saying that if the PSTN ran with strong encryption and authentication and that encryption wasn’t backdoored, this thing that is alleged to have happened wouldn’t have happened ?
- xvector 4y ago
  I believe that is exactly their point.
- db48x 4y ago
  SS7 may or may not have been intentionally backdoored at the time, but its development also predates the invention of the RSA algorithm upon which all modern security is founded. A key–exchange system like RSA or its successors is really required to do end–to–end encryption, and some sort of CA system is necessary if you are going have any hope of verifying that you are talking to the correct phone on the other end.