8 ms·
Security agencies have spent hundreds of millions of dollars per year in its efforts to undermine internet encryption standards and implementations. One well-kn
by soraminazuki 4y ago
Security agencies have spent hundreds of millions of dollars per year in its efforts to undermine internet encryption standards and implementations. One well-known case is Dual_EC_DRBG, in which the NSA backdoored a NIST encryption standard and bribed companies to implement it in widely used products.
All of this is well documented by numerous major news outlets, especially since 2013. I wonder if people screaming "conspiracies!" are doing so in good faith.
[1]: https://www.theguardian.com/world/2013/sep/05/nsa-gchq-encryption-codes-security https://www.theguardian.com/world/2013/sep/05/nsa-gchq-encry...
[2]: https://www.nytimes.com/2013/09/06/us/nsa-foils-much-internet-encryption.html https://www.nytimes.com/2013/09/06/us/nsa-foils-much-interne...
[3]: https://finance.yahoo.com/news/juniper-breach-mystery-starts-clear-130016591.html https://finance.yahoo.com/news/juniper-breach-mystery-starts...
[4]: https://en.wikipedia.org/wiki/Dual_EC_DRBG https://en.wikipedia.org/wiki/Dual_EC_DRBG
- Thorrez 4y agoDual_EC_DRBG was a little different. It introduced an asymmetric key that only the NSA had the private key for. So only the NSA was able to exploit it. If they were to make stuff complex generically with the hope of it being buggy, it would lead to bugs that other intelligence agencies could exploit.
- proto_lambda 4y agoThis still assumes that intelligence agencies are good at keeping their backdoors to themselves, which is not necessarily the case.
- soraminazuki 4y agoDo they really care though? NSA's previous handling of zero days [1] suggest that they care more about advancing their offensive capabilities even if it means putting critical public infrastructure at risk. [1]: https://news.ycombinator.com/item?id=12365629 https://news.ycombinator.com/item?id=12365629