4 ms·

it's always unsettling seeing a governmental or otherwise undisclosed institution developing such cryptographic breakthroughs in secrecy. this leaves me as a de

by jcfrei 14y ago

it's always unsettling seeing a governmental or otherwise undisclosed institution developing such cryptographic breakthroughs in secrecy. this leaves me as a developer with inferior tools to protect my data against any kind of intrusion. it’s understandable from a national perspective but unfortunate for the programming community at large. so far we still have bcrypt or scrypt - but who knows, maybe someday we'll have an efficient collision attack there as well...

dfc 14y ago
The "programming community's" threat model in cyberspace is no different than anyone's threat model in meatspace. If a well funded government decides you are an enemy of the state they can harm you in meatspace or cyberspace. Are you staying up at night worried about a hellfire missile coming in your window?
- vecinu 14y ago
  His fear stems from the fact that most people believe they have a right to the Internet and are essentially anonymous. To respond to your hellfire missile analogy, if I am in Canada or the US, I'm not worrying about it but if I'm in the middle east, it's a different story.
  - dfc 14y ago
    And I am saying that he does not have to worry about NSA, Mossad or The Secret Army of Northern Virginia spending years to develop Flame 2.0 so they can read his email. On the flip side if you are a high level enemy of the state you should still be worried if you are in Topeka or Ottawa; if its not a hellfire coming in the window it will be equally lethal scary rough men dressed in black.
  - danielharan 14y ago
    If your government starts sending hellfire missiles in people's homes (well, on your territory), that might get peopled worked up. But if it's something that can evade detection for years, you have no idea you're being spied on. That's slightly unsettling, no?
- jcfrei 14y ago
  the great thing about the internet is that it puts you as a citizen in a superior position to your local government (assuming you can somehow hack your way thru government controlled routers, which is in most cases trivial), because thanks to the anonymous nature of the web and the global access to it you can circumvent any national censorship and expose any kind of unjustice happening in your own country. those kinds of cryptographic attacks reduce anonymity on the web and make internet users an easier target for national espionage. as internet citizens (or netizens) it would just be nice if we could keep the upper hand in this game.
  - niels_olson 14y ago
    This is why Sergey Brin is netizen hero number one in my book. He actually cares, at a visceral level, about this and has taken actions to protect the net.
0x0 14y ago
On the other hand, keeping data safe from (known and unknown) attacks is also in the interest of such institutions. So I guess it goes both ways. (See: NSA "suggesting" IBM's DES use modified S-boxes, for (at the time) undisclosed reasons)
commandar 14y ago
The fascinating thing is that strong commercial/public cryptography has only really become a "thing" in the past couple of decades; it used to be nearly exclusively the domain of governments, which is why even today there are still residual export controls on strong cryptography.[1] [1] http://en.wikipedia.org/wiki/Export_of_cryptography_in_the_United_States#Current_status http://en.wikipedia.org/wiki/Export_of_cryptography_in_the_U...
- eli 14y ago
  Indeed, the days of "This T-Shirt Is a Munition" weren't that long ago. http://www.loundy.com/Roadside_T-Shirt.html http://www.loundy.com/Roadside_T-Shirt.html

by jcfrei 14y ago

dfc 14y ago

The "programming community's" threat model in cyberspace is no different than anyone's threat model in meatspace. If a well funded government decides you are an enemy of the state they can harm you in meatspace or cyberspace. Are you staying up at night worried about a hellfire missile coming in your window?

vecinu 14y ago
His fear stems from the fact that most people believe they have a right to the Internet and are essentially anonymous. To respond to your hellfire missile analogy, if I am in Canada or the US, I'm not worrying about it but if I'm in the middle east, it's a different story.
- dfc 14y ago
  And I am saying that he does not have to worry about NSA, Mossad or The Secret Army of Northern Virginia spending years to develop Flame 2.0 so they can read his email. On the flip side if you are a high level enemy of the state you should still be worried if you are in Topeka or Ottawa; if its not a hellfire coming in the window it will be equally lethal scary rough men dressed in black.
- danielharan 14y ago
  If your government starts sending hellfire missiles in people's homes (well, on your territory), that might get peopled worked up. But if it's something that can evade detection for years, you have no idea you're being spied on. That's slightly unsettling, no?
jcfrei 14y ago
the great thing about the internet is that it puts you as a citizen in a superior position to your local government (assuming you can somehow hack your way thru government controlled routers, which is in most cases trivial), because thanks to the anonymous nature of the web and the global access to it you can circumvent any national censorship and expose any kind of unjustice happening in your own country. those kinds of cryptographic attacks reduce anonymity on the web and make internet users an easier target for national espionage. as internet citizens (or netizens) it would just be nice if we could keep the upper hand in this game.
- niels_olson 14y ago
  This is why Sergey Brin is netizen hero number one in my book. He actually cares, at a visceral level, about this and has taken actions to protect the net.

0x0 14y ago

On the other hand, keeping data safe from (known and unknown) attacks is also in the interest of such institutions. So I guess it goes both ways. (See: NSA "suggesting" IBM's DES use modified S-boxes, for (at the time) undisclosed reasons)

commandar 14y ago

The fascinating thing is that strong commercial/public cryptography has only really become a "thing" in the past couple of decades; it used to be nearly exclusively the domain of governments, which is why even today there are still residual export controls on strong cryptography.[1] [1] http://en.wikipedia.org/wiki/Export_of_cryptography_in_the_United_States#Current_status http://en.wikipedia.org/wiki/Export_of_cryptography_in_the_U...

eli 14y ago
Indeed, the days of "This T-Shirt Is a Munition" weren't that long ago. http://www.loundy.com/Roadside_T-Shirt.html http://www.loundy.com/Roadside_T-Shirt.html