4 ms·

I believe the problem here is that you're dividing us into "tinfoil hat people" and normal people. This would be a useful designation if the world would remain

I believe the problem here is that you're dividing us into "tinfoil hat people" and normal people. This would be a useful designation if the world would remain static. However, we're clearly seeing that what used to be "tinfoil hat people" are right now just sensible people, so then you have to distinguish the really tinfoil hat people from the previous bunch, and so on. It's a moving target. The key problem from all of this is the injection of distrust into the entire stack caused by state security. I'm not getting into the BTB and pipelining, this article is just a symptom of the problem. The entire technology stack is up for grabs, and authors are going to get a lot of mileage out of taking it apart. So, to me, there are two questions here. 1) Can you demonstrate an attack that uses some weaknesses yet undetected by the average nerd? If so, that's news. 2) Can you speculate that with the resource of a nation-state, such an attack might be made? If so, to me that kind of qualifies as nerd gossip. It may turn out to be true, and it may just be a lot of hand-waving. Some people like this stuff. Some people don't. I never liked the hero-worship crap or the latest from famous author X, so if I had to choose from piles of crap I'd prefer this. For the average person, the only choice right now is to carry on or not. That does not make the situation acceptable or tolerable, that's just how it is. And I really like the word kerfuffle.

DanBC 13y ago
> However, we're clearly seeing that what used to be "tinfoil hat people" are right now just sensible people, so then you have to distinguish the really tinfoil hat people from the previous bunch, and so on. It's a moving target. Well, no. There's a difference between the people who said, for many years, that GCHQ / NSA are monitoring all communications and the people who said that GCHQ / NSA are monitoring all their communications. People deny this, but there is a big difference between "collecting the content" and "collecting the content then grepping it for your contributions to that content". > For the average person, the only choice right now is to carry on or not. I am genuinely baffled by the responses to the snowdon "revelations". i) They're not new ii) They've been included in routine risk assessment for years. What do you have that you want to protect, and who are you protecting it from? If you're protecting your teen-angst poetry from your classmates you can carry on as normal. If you're protecting a stash of images of child sexual abuse from law enforcement you need to continually assess your encryption and secrecy methods. If you're protecting plans to destroy America from a well funded government agency you need to worry about everything. But that's always been the case. There are so many other, easier, attacks than a weakened pool of entropy so it's a shame that people are being distracted by this. Don't get me wrong, I don't like RdRand and I'd prefer it if it was open and transparent, but there's so many other weak steps that people could be fixing before they get to RdRand.
- vidarh 13y ago
  In between those extremes you present, there are the huge number of people who at one point or other does something that might make them blackmail targets if some future administration needs something from them, their family, their friends or their employer, or that have carried out any kind of activism or political or religious activity that might brand them in the future. We have two recent demonstrations of why people should be concerned about this: McCarthyism and 9/11. Imagine McCarthy with access to years worth of stored electronic communications. But you got rid of that. Instead you got post-9/11 restrictions in the dark like the no-fly list. Imagine the post-9/11 attitudes to muslims escalating one step further. It takes very little before a lot of seemingly uninteresting stuff that nobody cares much about now is suddenly enough to ruin careers or relationships. It takes very little before the impact of indiscretions online or on the phone can be used as a source to impose even more restrictions on you. Suddenly some people will get fewer job offers for example. There are much worse possibilities. But these are just simple, straight forward escalations similar to episodes in the recent past. For my own part, about 20 years ago I was politically active in a left wing political party where just a few years before mere membership was often sufficient that you'd get denied entry to the US. Despite the fact that membership lists were confidential and never released to outside sources. But then again all officers of the party had known they'd been under extensive surveillance for many years (yet were considered crackpots for claiming so, until it was proven the Norwegian security services had engaged in extensive illegal surveillance, including against a left wing member of parliament on the parliamentary commission investigating their violations while they were investigating them) The groups that western intelligence organization target have shifted, but I'd be outright shocked if there are not perfectly legal, democratic organisations where membership would cause restrictions on your air travel and trigger additional surveillance without any evidence of even potential threats (some members of the party I was involved with at various points where shadowed on the way to and from work routinely, and "ran into" surveillance people that taunted them about private conversations they'd had in their own home...) This is the flaw with the idea that you don't have anything to hide. Everyone has lots to hide - as much as it doesn't look that way, we all filter and none of us post everything in our lives on Facebook. We just don't think we have anything to hide because many haven't done anything they consider to be wrong or believes the current government will care about. Guess what? Most of the people targeted by Joseph McCarthy didn't think they had anything to hide either, and most didn't until his witch hunts started, yet many of them lost their jobs and got blacklisted. This is the really scary thing about these NSA revelations: The surveillance is bad. But the storage of data over time is 10 times worse - it means the threat is not just abuse now, but abuse from the next government too, and we don't yet know whether that government will be better or worse in terms of how it might use or abuse that data, or if they might simply decide to extend storage periods further and put people at further risk of even later governments.
tptacek 13y ago
Daniel, I wasn't making a political point. I was making an engineering point. I'm not interested in this leg of the conversation and think that injecting politics into this discussion will consume the thread with chaff that will make it harder for people to understand how crypto and hardware work, which is a shame.
- DanielBMarkham 13y ago
  Thomas, I honestly don't understand what you mean. I think perhaps you're suggesting separating the idea of information leakage from talking about those willing to exploit it. That's fine, but it's going to be really difficult to have a long technical conversation about things that might or might not happen without having any person/entity/organization to be doing them. It would be like telling a story without having characters in it. If I understand you correctly, you'd like this to be way too abstract to have much traction with anybody. By all means break out Alice and Bob and have a go at it. But I'm not sure I understand you. I was also not trying to make a political point. I was simply trying to say that if you want to use the term "tinfoil hat people", then acknowledge that the term is a moving target based on a world of contextual information that keeps changing. That's all.

DanBC 13y ago

> However, we're clearly seeing that what used to be "tinfoil hat people" are right now just sensible people, so then you have to distinguish the really tinfoil hat people from the previous bunch, and so on. It's a moving target. Well, no. There's a difference between the people who said, for many years, that GCHQ / NSA are monitoring all communications and the people who said that GCHQ / NSA are monitoring all their communications. People deny this, but there is a big difference between "collecting the content" and "collecting the content then grepping it for your contributions to that content". > For the average person, the only choice right now is to carry on or not. I am genuinely baffled by the responses to the snowdon "revelations". i) They're not new ii) They've been included in routine risk assessment for years. What do you have that you want to protect, and who are you protecting it from? If you're protecting your teen-angst poetry from your classmates you can carry on as normal. If you're protecting a stash of images of child sexual abuse from law enforcement you need to continually assess your encryption and secrecy methods. If you're protecting plans to destroy America from a well funded government agency you need to worry about everything. But that's always been the case. There are so many other, easier, attacks than a weakened pool of entropy so it's a shame that people are being distracted by this. Don't get me wrong, I don't like RdRand and I'd prefer it if it was open and transparent, but there's so many other weak steps that people could be fixing before they get to RdRand.

vidarh 13y ago
In between those extremes you present, there are the huge number of people who at one point or other does something that might make them blackmail targets if some future administration needs something from them, their family, their friends or their employer, or that have carried out any kind of activism or political or religious activity that might brand them in the future. We have two recent demonstrations of why people should be concerned about this: McCarthyism and 9/11. Imagine McCarthy with access to years worth of stored electronic communications. But you got rid of that. Instead you got post-9/11 restrictions in the dark like the no-fly list. Imagine the post-9/11 attitudes to muslims escalating one step further. It takes very little before a lot of seemingly uninteresting stuff that nobody cares much about now is suddenly enough to ruin careers or relationships. It takes very little before the impact of indiscretions online or on the phone can be used as a source to impose even more restrictions on you. Suddenly some people will get fewer job offers for example. There are much worse possibilities. But these are just simple, straight forward escalations similar to episodes in the recent past. For my own part, about 20 years ago I was politically active in a left wing political party where just a few years before mere membership was often sufficient that you'd get denied entry to the US. Despite the fact that membership lists were confidential and never released to outside sources. But then again all officers of the party had known they'd been under extensive surveillance for many years (yet were considered crackpots for claiming so, until it was proven the Norwegian security services had engaged in extensive illegal surveillance, including against a left wing member of parliament on the parliamentary commission investigating their violations while they were investigating them) The groups that western intelligence organization target have shifted, but I'd be outright shocked if there are not perfectly legal, democratic organisations where membership would cause restrictions on your air travel and trigger additional surveillance without any evidence of even potential threats (some members of the party I was involved with at various points where shadowed on the way to and from work routinely, and "ran into" surveillance people that taunted them about private conversations they'd had in their own home...) This is the flaw with the idea that you don't have anything to hide. Everyone has lots to hide - as much as it doesn't look that way, we all filter and none of us post everything in our lives on Facebook. We just don't think we have anything to hide because many haven't done anything they consider to be wrong or believes the current government will care about. Guess what? Most of the people targeted by Joseph McCarthy didn't think they had anything to hide either, and most didn't until his witch hunts started, yet many of them lost their jobs and got blacklisted. This is the really scary thing about these NSA revelations: The surveillance is bad. But the storage of data over time is 10 times worse - it means the threat is not just abuse now, but abuse from the next government too, and we don't yet know whether that government will be better or worse in terms of how it might use or abuse that data, or if they might simply decide to extend storage periods further and put people at further risk of even later governments.

tptacek 13y ago

Daniel, I wasn't making a political point. I was making an engineering point. I'm not interested in this leg of the conversation and think that injecting politics into this discussion will consume the thread with chaff that will make it harder for people to understand how crypto and hardware work, which is a shame.

DanielBMarkham 13y ago
Thomas, I honestly don't understand what you mean. I think perhaps you're suggesting separating the idea of information leakage from talking about those willing to exploit it. That's fine, but it's going to be really difficult to have a long technical conversation about things that might or might not happen without having any person/entity/organization to be doing them. It would be like telling a story without having characters in it. If I understand you correctly, you'd like this to be way too abstract to have much traction with anybody. By all means break out Alice and Bob and have a go at it. But I'm not sure I understand you. I was also not trying to make a political point. I was simply trying to say that if you want to use the term "tinfoil hat people", then acknowledge that the term is a moving target based on a world of contextual information that keeps changing. That's all.