4 ms·

The access to source code is mostly irrelevant. Access to signing keys is very relevant, and I think there is a very real chance (p>0.2) that the huge oversigh

The access to source code is mostly irrelevant. Access to signing keys is very relevant, and I think there is a very real chance (p>0.2) that the huge oversight MS did with the terminal server keys happened because they were ordered to do it.

tptacek 14y ago
That's an awfully baroque government backdoor --- a misconfigured X.509 attribute on a certificate that turns out to be signed with a hash for which controlled collisions turn out to be feasible.
- aparadja 14y ago
  Well, it does have a lot more plausible deniability than a straightforward backdoor. Which, of course, proves absolutely nothing.
  - tptacek 14y ago
    So that makes Pinkie Pie's 92-step Chrome exploit especially likely to be a backdoor, then? :)