5 ms·

That security systems are designed in the most paranoid fashion possible doesn't tell you anything about the real nature of the threat. Schneier's book doesn't

by guelo 13y ago

That security systems are designed in the most paranoid fashion possible doesn't tell you anything about the real nature of the threat. Schneier's book doesn't tell you that the NSA has been strong arming corporations into giving up their private keys and into installing backdoors on chips. In fact Schneier himself is outraged to the point that he seems to be calling for a redesign of basic Internet protocols and governance in his article today, http://www.theguardian.com/commentisfree/2013/sep/05/government-betrayed-internet-nsa-spying http://www.theguardian.com/commentisfree/2013/sep/05/governm...

tptacek 13y ago
Yeah, I'm a little baffled by Schneier's reaction to this. The revelation is advanced cryptanalytic capabilities at NSA, which is literally an article of faith with Schneier. Why is he freaking out about this when he didn't instead freak out about wholesale call record database dumps or AT&T fiber taps?
- rhizome 13y ago
  What do you mean by, "freak out?"
  - tptacek 13y ago
    I don't mean that dismissively.
    - rhizome 13y ago
      OK, but what do you mean by it?
- gknoy 13y ago
  I think there is a fundamental difference advanced Cryptanalysis (which we always assumed they had due to hiring practices and history) and being able to break crypto by subverting infrastructure. If the NSA said, "Our super smart brain trust figured out how to own your stuff with math five years ago ... ha ha!", I think we would be Totally Fine with that. Hats off to them for winning that game, but at least they played mostly fairly. (In theory.) However, this is different. Winning the cryptanalyis game because they backdoored protocols, gained access to trusted entities' private keys, etc, just means that they are really good at the SPYING game, not at the cryptanalysis game, and somehow that just feels worse.
  - TelmoMenezes 13y ago
    I would be keeping my hat on. They would have done it with the taxpayers' money but without their consent or even knowledge. They would then be withholding a major scientific breakthrough from the public that financed it. A scientific breakthrough that might have all sorts of applications that could make our lives better. They would be exposing all the people that rely in strong cryptography to major risks. Including people that have done nothing illegal and helped fund their research. And more importantly, they shouldn't be reading our emails to being with, independently of them being encrypted or not. That was never the deal, no democratic process ever gave them the right.
    - chakalakasp 13y ago
      Paying some 22 year old deskjockey a couple mil to code a backdoor into an encryption app isn't a scientific breakthrough, it's just traditional spycraft. Using the weight of the US government to force Microsoft to code a backdoor into Bitlocker isn't a scientific breakthrough, it's the sort of things governments do.
  - mpyne 13y ago
    > If the NSA said, "Our super smart brain trust figured out how to own your stuff with math five years ago ... ha ha!", I think we would be Totally Fine with that. Hats off to them for winning that game, but at least they played mostly fairly. (In theory.) I disagree. Certainly they'll be doing that too, but breaking crypto is hazardous to the populace independently of how it's broken, right? Either way from NSA's perspective they are fighting a war, with terrorism, with other nation's crypto efforts, etc. In that context there are very few "unfair" ways to fight. And indeed, the U.S. has done something like this to a certain Soviet pipeline, as I recall. Besides, this at least leaves open the possibility of like-minded people to maintain countermeasures. If crypto is broken in general then we're all naked. If weak implementations are weak then we would need to be fixing those anyways. I just wish I knew which one it is we're looking at.
    - nathan_long 13y ago
      >> breaking crypto is hazardous to the populace independently of how it's broken, right? Breaking crypto from the outside proves that it's breakable; if the NSA can do it, it's just a matter of time until others do. Undermining cryto from the inside means deliberately exposing all communicates to increased risk of hacking by anyone, anywhere. Quite different.
- betterunix 13y ago
  This is not just about cryptanalysis. The NSA has been deliberately introducing weaknesses into cryptosystems used by the general public. That is beyond keeping cryptanalysis techniques secret, which we all assumed they would do and which few really drew any issue with. We are talking about an honest-to-goodness conspiracy, one that yesterday many would have written off as a conspiracy theory that was not even worth considering. Basically, what we thought were the rules of the game are not the rules of the game. We thought we knew where we stood with the NSA -- they would try to attack, we would try to defend. Now we need to be thinking of a much different set of rules, one in which the NSA is not just attacking ciphers but also deliberately sabotaging our defense, and doing so covertly. We cannot even assume that mistakes really are mistakes anymore -- they could be the NSA's doing.
  - anigbrowl 13y ago
    Basically, what we thought were the rules of the game Er...speak for yourself buddy. If you thought that you could get proper crypto security from a boxed software product then I'd like to offer you a fantastic deal on a bridge.
    - betterunix 13y ago
      There is a difference between incompetence / mistakes, which we know to expect from cryptosystems, and deliberate sabotage.
      - anigbrowl 13y ago
        I said nothing about incompetence. Rather, I assume that any commercial product of that kind is compromised, because spies have such an obvious interest in compromising it. I mean, if I were a spy I wouldn't just ask companies to put backdoors in (although I would do that too), I would actively spy on the software companies. I have always assumed powerful intelligence agencies adopted a zero-sum approach to things, because ultimately they are judged on results, not a purity score.
    - superuser2 13y ago
- icambron 13y ago
  There's a difference between assuming something because it's prudent to do so and actually knowing it's true. And even if Schneier was extremely confident about it, he was still, in the minds of most people, just a paranoid guy on the corner screaming conspiracy theories about what the NSA may have and what they may be doing with it. Now he has some ammo, and he'd be foolish not to use it.
- state 13y ago
  I keep hoping that Schneier's position is going to be some kind of guiding light forward because of his longstanding position that these "revelations" should be taken for granted. Since he does seem to be freaking out, do you have another voice that's worth listening to about how to think about all of this going forward?
- chakalakasp 13y ago
  Becuse he assisted the Guardian in working on the story and must have seen some documents that made him hit the ceiling. Even if he isn't explaining the nitty gritty, I trust his reaction.

by guelo 13y ago

tptacek 13y ago

Yeah, I'm a little baffled by Schneier's reaction to this. The revelation is advanced cryptanalytic capabilities at NSA, which is literally an article of faith with Schneier. Why is he freaking out about this when he didn't instead freak out about wholesale call record database dumps or AT&T fiber taps?

rhizome 13y ago
What do you mean by, "freak out?"
- tptacek 13y ago
  I don't mean that dismissively.
  - rhizome 13y ago
    OK, but what do you mean by it?
gknoy 13y ago
I think there is a fundamental difference advanced Cryptanalysis (which we always assumed they had due to hiring practices and history) and being able to break crypto by subverting infrastructure. If the NSA said, "Our super smart brain trust figured out how to own your stuff with math five years ago ... ha ha!", I think we would be Totally Fine with that. Hats off to them for winning that game, but at least they played mostly fairly. (In theory.) However, this is different. Winning the cryptanalyis game because they backdoored protocols, gained access to trusted entities' private keys, etc, just means that they are really good at the SPYING game, not at the cryptanalysis game, and somehow that just feels worse.
- TelmoMenezes 13y ago
  I would be keeping my hat on. They would have done it with the taxpayers' money but without their consent or even knowledge. They would then be withholding a major scientific breakthrough from the public that financed it. A scientific breakthrough that might have all sorts of applications that could make our lives better. They would be exposing all the people that rely in strong cryptography to major risks. Including people that have done nothing illegal and helped fund their research. And more importantly, they shouldn't be reading our emails to being with, independently of them being encrypted or not. That was never the deal, no democratic process ever gave them the right.
  - chakalakasp 13y ago
    Paying some 22 year old deskjockey a couple mil to code a backdoor into an encryption app isn't a scientific breakthrough, it's just traditional spycraft. Using the weight of the US government to force Microsoft to code a backdoor into Bitlocker isn't a scientific breakthrough, it's the sort of things governments do.
- mpyne 13y ago
  > If the NSA said, "Our super smart brain trust figured out how to own your stuff with math five years ago ... ha ha!", I think we would be Totally Fine with that. Hats off to them for winning that game, but at least they played mostly fairly. (In theory.) I disagree. Certainly they'll be doing that too, but breaking crypto is hazardous to the populace independently of how it's broken, right? Either way from NSA's perspective they are fighting a war, with terrorism, with other nation's crypto efforts, etc. In that context there are very few "unfair" ways to fight. And indeed, the U.S. has done something like this to a certain Soviet pipeline, as I recall. Besides, this at least leaves open the possibility of like-minded people to maintain countermeasures. If crypto is broken in general then we're all naked. If weak implementations are weak then we would need to be fixing those anyways. I just wish I knew which one it is we're looking at.
  - nathan_long 13y ago
    >> breaking crypto is hazardous to the populace independently of how it's broken, right? Breaking crypto from the outside proves that it's breakable; if the NSA can do it, it's just a matter of time until others do. Undermining cryto from the inside means deliberately exposing all communicates to increased risk of hacking by anyone, anywhere. Quite different.
betterunix 13y ago
This is not just about cryptanalysis. The NSA has been deliberately introducing weaknesses into cryptosystems used by the general public. That is beyond keeping cryptanalysis techniques secret, which we all assumed they would do and which few really drew any issue with. We are talking about an honest-to-goodness conspiracy, one that yesterday many would have written off as a conspiracy theory that was not even worth considering. Basically, what we thought were the rules of the game are not the rules of the game. We thought we knew where we stood with the NSA -- they would try to attack, we would try to defend. Now we need to be thinking of a much different set of rules, one in which the NSA is not just attacking ciphers but also deliberately sabotaging our defense, and doing so covertly. We cannot even assume that mistakes really are mistakes anymore -- they could be the NSA's doing.
- anigbrowl 13y ago
  Basically, what we thought were the rules of the game Er...speak for yourself buddy. If you thought that you could get proper crypto security from a boxed software product then I'd like to offer you a fantastic deal on a bridge.
  - betterunix 13y ago
    There is a difference between incompetence / mistakes, which we know to expect from cryptosystems, and deliberate sabotage.
    - anigbrowl 13y ago
      I said nothing about incompetence. Rather, I assume that any commercial product of that kind is compromised, because spies have such an obvious interest in compromising it. I mean, if I were a spy I wouldn't just ask companies to put backdoors in (although I would do that too), I would actively spy on the software companies. I have always assumed powerful intelligence agencies adopted a zero-sum approach to things, because ultimately they are judged on results, not a purity score.
  - superuser2 13y ago
icambron 13y ago
There's a difference between assuming something because it's prudent to do so and actually knowing it's true. And even if Schneier was extremely confident about it, he was still, in the minds of most people, just a paranoid guy on the corner screaming conspiracy theories about what the NSA may have and what they may be doing with it. Now he has some ammo, and he'd be foolish not to use it.
state 13y ago
I keep hoping that Schneier's position is going to be some kind of guiding light forward because of his longstanding position that these "revelations" should be taken for granted. Since he does seem to be freaking out, do you have another voice that's worth listening to about how to think about all of this going forward?
chakalakasp 13y ago
Becuse he assisted the Guardian in working on the story and must have seen some documents that made him hit the ceiling. Even if he isn't explaining the nitty gritty, I trust his reaction.