5 ms·
For something like this - the NSA and FBI have been trying to gain industry trust by releasing these advisories. The NSA at least has publicly admitted to this
by rockskon 3y ago
For something like this - the NSA and FBI have been trying to gain industry trust by releasing these advisories. The NSA at least has publicly admitted to this being one of the big reasons they do so given they've not managed to regain trust post-Snowden.
They have no incentive to lie here.
But see this for what it is: An attempt at gaining trust so more people will voluntarily work with them and give them data.
- boomboomsubban 3y agoI do not understand your position. "The trust they gain from making this unsourced claim is a clear benefit, so they have no incentive to lie about it." Wouldn't the gained trust be an incentive? You could argue if they lied the incentive wouldn't be worth the risk, but proving they lied about this would be difficult and that's a seperate argument from the one you made.
- rockskon 3y agoI am arguing the incentive to lie isn't worth the risk in this case. And they're not likely to give sources because of the whole "protecting sources and methods" bias they have to not reveal how they know what they know. I'm making an argument about their motive here. The damage they'd face from lying is great (what if another leak comes out? What if a backdoor is found in the patch communicating with NSA infrastructure?) and the possible benefit relatively small.
- roenxi 3y agoThese people lie professionally. It is their job to conceal and misrepresent their activities. They've lied to everyone already at some point. They certainly lie to people outside the US, they've lied to people in the US, they've lied to their oversight committees in Congress and they've lied to the president. It seems likely they're lying to each other for office politics reasons. How are they supposed to take damage from lying? They have no credibility to lose. The NSA Wikipedia page takes a while to scroll through and is a saga of backdoors and skullduggery. "Spies lied, news at 11" will read the headline. I'm not saying this specific thing is true or not, what do I know. But if it turned out to be a lie, who could claim to be surprised? It has entered the public record that they developed tech to pretend to be foreigners like the PRC when conducting their cybercrime activities.
- rockskon 3y agoThey are hurting for talent. Each instance of high-profile bad press makes it harder for them to replace their aging workforce and makes companies more reluctant to give them any data or research assistance. Beyond that, they've had a huge brain drain in recent years with their talent being hired away by the private sector. Which also means you should be wary about who gets hired at Amazon/Google/Microsoft/Apple/Hurricane Electric. Last I heard a supervisor from the NSA who was in charge of some team dedicated to breaking cryptography in the early 2000's had since been hired by Amazon to lead cryptographic implementation at AWS. Could be fine. Could be beneficial for Amazon's cryptographic security. But I know I'd be worried on what her reaction would be if the NSA came to her privately and asked for her to make a change at AWS that makes it easier for the NSA to exploit. As for them lying....you have to look at incentives. Spies lie for a reason. They twist words, they lie by omission, they attack peoples' character, they claim their push for changes in the name of public safety is more important than freedoms. They don't lie just for the sake of lying. Lying is not its own reward.
- PartiallyTyped 3y agoNSA has both red and blue teams. Work from blue teams helps the public even if they are only known for their red team. Iirc we saw the blue team with S-Boxes in DES, but I may be misremembering things.
- rockskon 3y agoTheir defensive side has, for many years, been very publicly and vocally sidelined in favor of offense. Defense being given the limelight is relatively new.
- red_admiral 3y agoYou are correct. Hardening the S-Box was the blue team (to protect against differential cryptanalysis). Weakening the key length from 64 to 56 bits by making the MSB of each key byte a checksum, that was the red team.
- PartiallyTyped 3y ago> NSA worked closely with IBM to strengthen the algorithm against all except brute-force attacks and to strengthen substitution tables, called S-boxes. Conversely, NSA tried to convince IBM to reduce the length of the key from 64 to 48 bits. Ultimately they compromised on a 56-bit key.[13][14] From wikipedia. Major compromise tbh :unamused: [13] Thomas R. Johnson (2009-12-18). "American Cryptology during the Cold War, 1945-1989.Book III: Retrenchment and Reform, 1972-1980, page 232" (PDF). National Security Agency. Archived (PDF) from the original on 2015-04-25. Retrieved 2015-07-16 – via National Security Archive FOIA request. This version is differently redacted than the version on the NSA website. [14] Thomas R. Johnson (2009-12-18). "American Cryptology during the Cold War, 1945-1989.Book III: Retrenchment and Reform, 1972-1980, page 232" (PDF). National Security Agency. Archived (PDF) from the original on 2015-04-25. Retrieved 2015-07-16 – via National Security Archive FOIA request. This version is differently redacted than the version on the NSA website.
- factormeta 3y agoyeah post Snowden there are quite bit of big mistrust in NSA type of gov agency. However, what people ought to focus a bit more on are the tel-co companies (AT&T type of companies). They get all your data, call and location via cellular towel triangulation even with internet turned off. As long as you are using a mobile phone they have a lot personal data about you. and they are NOT subject to public scrutiny as NSA type of gov agency. As bad as government agency they are such as NSA, they are still (or need to make an appearance of) being scrutinized by the public. Yeah and as some said there are red/blue teams in the public agency as well, some are still good public servants.
- nsafalseflag 3y ago[flagged]