4 ms·
Up until very recently, the received wisdom was: the crypto wars are over, we fought the law and the law gave up, the NSA has quit trying to crack encryption, t
by JulianMorrison 13y ago
Up until very recently, the received wisdom was: the crypto wars are over, we fought the law and the law gave up, the NSA has quit trying to crack encryption, they have decided the USA is best strengthened by having a reliable internet which business rival nations can't just read like the morning's news. The NSA knows the problems in crypto and their suggestions make it stronger against attacks we don't know. Trust the NSA.
Would that it were true! It would make sense. This makes no damn sense. Just recently I would have ruled out huge conspiracies as implausible because they inevitably leak (roll save against ethics how many times?). The joke's on me, folks. The NSA has no sense. And the conspiracy leaked.
So now every single decision that was taken with help from the NSA (SELinux, TLS, elliptic curves, etc) needs unpicking and running by a cryptographer who isn't a shill. What a damn drag. And meanwhile, the aftershocks will run for years trashing trust in the networked economy.
Fuckin' brilliant, NSA. You screwed the pooch. You accidentally the whole internet.
- cbr 13y agoSo now every single decision that was taken with help from the NSA (SELinux, TLS, elliptic curves, etc) needs unpicking and running by a cryptographer who isn't a shill. Cryptographers have already been looking very carefully at everything that comes out of the NSA. Lots of security researchers, in and out of the US, would love to find NSA-introduced flaws.
- mpyne 13y agoIt would even be ironic if people's aversion to things like SELinux caused them to use software which is even less secure, and correspondingly easier for NSA to break. They know the long game too...
- D_Alex 13y ago>they inevitably leak (roll save against ethics how many times?) Haha, nicely put. Note too that sooo many "roll save against temptation" must happen to avoid abuses of the NSA capabilities.
- caf 13y agoNote that SELinux isn't crypto - it's code to implement mandatory access control, which is just regular bitbashing that any software engineer is completely qualified to audit.