4 ms·

I'll bite. Because we can't really predict the future and some far-fetched science-fiction sounding things such as quantum computers and future advancements we

I'll bite. Because we can't really predict the future and some far-fetched science-fiction sounding things such as quantum computers and future advancements we can't currently conceive of may completely and utterly change that, perhaps even overnight. From a paranoid security point of view, it's definitely a bad idea to assume your cryptography is perfect and always will be.

mpyne 13y ago
And from a paranoid physical security point of view it's definitely a bad idea to assume I would survive my car trip to the grocery store every week.... I do it anyways, as it's still much better than the alternatives.
- merlincorey 13y ago
  I believe this a logical fallacy. I didn't argue that due to said paranoia one should not engage in cryptography, any more than I would argue that one should not drive their car to the grocery store every week. I'm talking about complacency, and how it's a better idea for us to assume that sooner or later (if not currently) our best-known cryptography will be broken. If I recall correctly, in 2008, Simple Nomad[1] told us to consider PGP broken by the government. He wasn't saying it is... just we should consider it as such and find something better, before it's too late. [1] http://www.youtube.com/watch?v=N9AKpHtgpoM http://www.youtube.com/watch?v=N9AKpHtgpoM
  - mpyne 13y ago
    And if I just told you to assume AES is broken by the government and find something better, would that be all the incitement you need? Or would you want actual evidence that at least hints it's probably instead of just assumptions?
    - merlincorey 13y ago
      You're missing the point. I already am thinking of it as broken, even without evidence, because I want to look ahead. This doesn't mean I don't use cryptography "because it's broken", it means I don't trust it as if it wasn't broken. Also, to be a bit unfair, I have no idea who you are, but I know who Simple Nomad[1] is. If Simple Nomad told me the government had definitely owned PGP, AES, or anything else of that nature I'd be very concerned, no evidence necessary. The implication is that he already has the evidence, but maybe can't share it with me. Or he's really drunk and messing with me.... either way, good times ahead! [1] http://www.soldierx.com/hdb/Simple-Nomad http://www.soldierx.com/hdb/Simple-Nomad > He has spoken at DefCon, BlackHat, ^Shmoocon^, and ToorCon, and he is known for his somewhat paranoid mindset.
    - Natsu 13y ago
      The problem with cryptography is that you only have to be wrong once.
      - mpyne 13y ago
        That's also the problem with switching to a new and untested solution. You only get to be wrong once. Is there any symmetric cypher with more cryptanalytic effort put into than AES? Is there even one? You switch to something else out of paranoia and you could easily switch to something with a theoretical backdoor that NSA has already identified and exploited (after all, they're "10-20 years ahead of us", right?).
rsync 13y ago
Unless it's a one time pad with good RNG. In that case it is indeed a good idea to assume your cryptography is perfect and always will be.
- merlincorey 13y ago
  Just don't lose the key... As I'm sure I don't have to tell you. What book would you use? That's how "they" used to do it.
- lotsofcows 13y ago
  Perfect? Two people know the key.

mpyne 13y ago

And from a paranoid physical security point of view it's definitely a bad idea to assume I would survive my car trip to the grocery store every week.... I do it anyways, as it's still much better than the alternatives.

merlincorey 13y ago
I believe this a logical fallacy. I didn't argue that due to said paranoia one should not engage in cryptography, any more than I would argue that one should not drive their car to the grocery store every week. I'm talking about complacency, and how it's a better idea for us to assume that sooner or later (if not currently) our best-known cryptography will be broken. If I recall correctly, in 2008, Simple Nomad[1] told us to consider PGP broken by the government. He wasn't saying it is... just we should consider it as such and find something better, before it's too late. [1] http://www.youtube.com/watch?v=N9AKpHtgpoM http://www.youtube.com/watch?v=N9AKpHtgpoM
- mpyne 13y ago
  And if I just told you to assume AES is broken by the government and find something better, would that be all the incitement you need? Or would you want actual evidence that at least hints it's probably instead of just assumptions?
  - merlincorey 13y ago
    You're missing the point. I already am thinking of it as broken, even without evidence, because I want to look ahead. This doesn't mean I don't use cryptography "because it's broken", it means I don't trust it as if it wasn't broken. Also, to be a bit unfair, I have no idea who you are, but I know who Simple Nomad[1] is. If Simple Nomad told me the government had definitely owned PGP, AES, or anything else of that nature I'd be very concerned, no evidence necessary. The implication is that he already has the evidence, but maybe can't share it with me. Or he's really drunk and messing with me.... either way, good times ahead! [1] http://www.soldierx.com/hdb/Simple-Nomad http://www.soldierx.com/hdb/Simple-Nomad > He has spoken at DefCon, BlackHat, ^Shmoocon^, and ToorCon, and he is known for his somewhat paranoid mindset.
  - Natsu 13y ago
    The problem with cryptography is that you only have to be wrong once.
    - mpyne 13y ago
      That's also the problem with switching to a new and untested solution. You only get to be wrong once. Is there any symmetric cypher with more cryptanalytic effort put into than AES? Is there even one? You switch to something else out of paranoia and you could easily switch to something with a theoretical backdoor that NSA has already identified and exploited (after all, they're "10-20 years ahead of us", right?).

rsync 13y ago

Unless it's a one time pad with good RNG. In that case it is indeed a good idea to assume your cryptography is perfect and always will be.

merlincorey 13y ago
Just don't lose the key... As I'm sure I don't have to tell you. What book would you use? That's how "they" used to do it.
lotsofcows 13y ago
Perfect? Two people know the key.