5 ms·

Has it been verified that they can break most internet crypto? Or is it just a claim?

by tensor 13y ago

harrytuttle 13y ago
No it's a claim. A claim that needs to be formally disproven based on recent events. The assumption was originally that systems were secure until disproven. Now they are insecure until proven otherwise. The latter statement in the previous sentence is possibly impossible, ergo we're fucked.
- MichaelGG 13y ago
  It's a bit of hyperbole, and nothing direct from Snowden as far as I can tell. The actual releases (like XKEYSCORE) clearly show it intercepting unencrypted traffic. This could be something as simple as RSA1024 being "easily" crackable by the NSA, and hence "most encryption" would be vulnerable since so many people use RSA1024 for TLS. Taking random quotes and highlights from presentations isn't a very good way to get picture of an opponent's capabilities. Otherwise we'd think that Oracle has developed 100% secure database software that is impossible to break. I really hope Snowden releases some hard evidence or specific citations of what the NSA has broken, instead of the hand-wavy "like, everything, man" articles that have been rehashed several times in the past day. Speculation's sorta pointless.
  - nly 13y ago
    > I really hope Snowden releases some hard evidence or specific citations of what the NSA has broken That's fairly unlikely. The Guardian articles say he never had access to such information, nor was it amongst the documents he liberated.
- CoryG89 13y ago
  I'm not sure it was ever the case that the original assumption was that systems are secure until disproven. The claim is more than likely alluding to a combination of techniques for breaking weak crypto (ie. sufficiently small keysize for brute force attack), or attacking the endpoints (backdoors, etc). This still doesn't seem like news to me, but hey, what do I know?
  - harrytuttle 13y ago
    From an academic point of view, you are correct but my point was from a commerce and public perspective.
jack9 13y ago
The article didn't say they can break internet crypto. Anyone can break MOST crypto. It's a matter of effort. I'm still looking for the actual claim that's supposed to be scary. > Thursday's revelation that US and British intelligence agencies are able to decode most Internet traffic Ok, most isn't encrypted. So that means nothing. Let's go to that source... > The National Security Agency (NSA) and its British counterpart have successfully defeated encryption technologies used by a broad swath of online services, including those provided by Google, Facebook, Microsoft, and Yahoo, This doesn't say anything about encryption, per se. It says that it can access big data, which everyone admits to. That's not breaking encryption either (bypassing is not breaking). Let's dig deeper... > They reveal a highly classified program codenamed Bullrun, which according to the reports relied on a combination of "supercomputers, technical trickery, court orders, and behind-the-scenes persuasion" to undermine basic staples of Internet privacy, including virtual private networks (VPNs) and the widely used secure sockets layer (SSL) and transport layer security (TLS) protocols. So the only thing this means is that it's likely they bruteforce some subsets (anything under 256bit AES) and bypass it. This looks a lot like FUD and nothing surprising has been "discovered". I like the synopsis here: http://www.reddit.com/r/technology/comments/1lsvh2/us_and_uk_spy_agencies_defeat_privacy_and/cc2oh9w http://www.reddit.com/r/technology/comments/1lsvh2/us_and_uk...
sillysaurus2 13y ago
jack9, in case you read this, I just wanted to let you know you're hellbanned. I thought about not telling you, but then I checked your comment history and was very shocked to discover that you've been hellbanned for the past 249 days, during which you've made 69 comments that have been seen by almost no one (because you're hellbanned). You may have also noticed that Hacker News is extremely slow for you -- when a user is hellbanned, the site slows down for them. Each page refresh takes an additional ~10sec to load. So assuming a lowball figure of 10 pageviews per each of your comments, this hellban has claimed at least 2 hours of your life just sitting there waiting for HN to load. Hence I feel compelled to show some mercy and let you know that you need to create a new account if you want anyone to see anything you write. And some of your writing is thoughtful. You were probably banned because, quite frankly, you were a complete dick when you first started commenting[1][2] and probably got banned for this comment[3] but the quality of your comments increased after you were banned, so if you've changed, you're nice, and you want to contribute to this community in a positive way, then I assume you'd be welcome back. So make a new account. [1] https://news.ycombinator.com/item?id=4965082 https://news.ycombinator.com/item?id=4965082 [2] https://news.ycombinator.com/item?id=4988839 https://news.ycombinator.com/item?id=4988839 [3] https://news.ycombinator.com/item?id=4993462 https://news.ycombinator.com/item?id=4993462 EDIT: Actually, this[4] is almost certainly what pissed off a mod enough to ban you, and rightfully so: if you still feel that way, then you deserve to remain banned. But I'm optimistic about people's ability to change (I myself was quite a different person 249 days ago). If you still enjoy writing comments that attack people personally, even if the attack is deserved, then you will make me sad, since that will mean I've hurt the community by informing you of your status. So please don't make me regret sticking my neck out for you. Besides, it's much more satisfying to write comments that uplift people rather than tearing them down. [4] https://news.ycombinator.com/item?id=4993757 https://news.ycombinator.com/item?id=4993757
- sillysaurus2 13y ago
  WARNING: Shortly after I posted this, HN no longer loads for my IP address: http://screencast.com/t/J0FIYAhn http://screencast.com/t/J0FIYAhn It may just be coincidence. But that's quite a coincidence. HN completely doesn't load for me, with "No Data Received," meaning the Arc process running HN is specifically deciding not to send any data to my specific IP address (since Tor still works). Meaning my IP got banned. And just before that, I started receiving the message "We've limited requests for this url" for everyone's comment page: http://screencast.com/t/h0n0HjTcM http://screencast.com/t/h0n0HjTcM ... so it does appear that my IP has been singled out for some special reason, possibly for this comment. (I'm not sharing my connection with anybody, so it was definitely something I did.) So until I verify what's going on, don't risk your account by making comments telling hellbanned people that they've been banned. There may be consequences. (If that's the case, then I wish they would've just deleted my comment and told me not to do that... I didn't mean to cause problems. Sorry.) EDIT: The error has changed to "This webpage is not found." http://screencast.com/t/NcFgfnQ3p4 http://screencast.com/t/NcFgfnQ3p4 Still not loading. Other websites load fine. EDIT2: Back to "no data received." Definitely not loading for my IP address. EDIT3: Attempting to unban my IP using the method described at https://news.ycombinator.com/item?id=5631364 https://news.ycombinator.com/item?id=5631364 didn't work. The Arc process really doesn't like my IP address. EDIT4: HN now loads, but https://news.ycombinator.com/user?id=trysomething https://news.ycombinator.com/user?id=trysomething is still returning "We've limited requests for this url." I get that error message for all profile URLs, e.g. https://news.ycombinator.com/user?id=pg https://news.ycombinator.com/user?id=pg EDIT5: Aaand my IP is back to being banned.

Has it been verified that they can break most internet crypto? Or is it just a claim?

by tensor 13y ago

Has it been verified that they can break most internet crypto? Or is it just a claim?

No it's a claim. A claim that needs to be formally disproven based on recent events. The assumption was originally that systems were secure until disproven. Now they are insecure until proven otherwise. The latter statement in the previous sentence is possibly impossible, ergo we're fucked.

MichaelGG 13y ago
It's a bit of hyperbole, and nothing direct from Snowden as far as I can tell. The actual releases (like XKEYSCORE) clearly show it intercepting unencrypted traffic. This could be something as simple as RSA1024 being "easily" crackable by the NSA, and hence "most encryption" would be vulnerable since so many people use RSA1024 for TLS. Taking random quotes and highlights from presentations isn't a very good way to get picture of an opponent's capabilities. Otherwise we'd think that Oracle has developed 100% secure database software that is impossible to break. I really hope Snowden releases some hard evidence or specific citations of what the NSA has broken, instead of the hand-wavy "like, everything, man" articles that have been rehashed several times in the past day. Speculation's sorta pointless.
- nly 13y ago
  > I really hope Snowden releases some hard evidence or specific citations of what the NSA has broken That's fairly unlikely. The Guardian articles say he never had access to such information, nor was it amongst the documents he liberated.
CoryG89 13y ago
I'm not sure it was ever the case that the original assumption was that systems are secure until disproven. The claim is more than likely alluding to a combination of techniques for breaking weak crypto (ie. sufficiently small keysize for brute force attack), or attacking the endpoints (backdoors, etc). This still doesn't seem like news to me, but hey, what do I know?
- harrytuttle 13y ago
  From an academic point of view, you are correct but my point was from a commerce and public perspective.

jack9 13y ago

The article didn't say they can break internet crypto. Anyone can break MOST crypto. It's a matter of effort. I'm still looking for the actual claim that's supposed to be scary. > Thursday's revelation that US and British intelligence agencies are able to decode most Internet traffic Ok, most isn't encrypted. So that means nothing. Let's go to that source... > The National Security Agency (NSA) and its British counterpart have successfully defeated encryption technologies used by a broad swath of online services, including those provided by Google, Facebook, Microsoft, and Yahoo, This doesn't say anything about encryption, per se. It says that it can access big data, which everyone admits to. That's not breaking encryption either (bypassing is not breaking). Let's dig deeper... > They reveal a highly classified program codenamed Bullrun, which according to the reports relied on a combination of "supercomputers, technical trickery, court orders, and behind-the-scenes persuasion" to undermine basic staples of Internet privacy, including virtual private networks (VPNs) and the widely used secure sockets layer (SSL) and transport layer security (TLS) protocols. So the only thing this means is that it's likely they bruteforce some subsets (anything under 256bit AES) and bypass it. This looks a lot like FUD and nothing surprising has been "discovered". I like the synopsis here: http://www.reddit.com/r/technology/comments/1lsvh2/us_and_uk_spy_agencies_defeat_privacy_and/cc2oh9w http://www.reddit.com/r/technology/comments/1lsvh2/us_and_uk...

sillysaurus2 13y ago

jack9, in case you read this, I just wanted to let you know you're hellbanned. I thought about not telling you, but then I checked your comment history and was very shocked to discover that you've been hellbanned for the past 249 days, during which you've made 69 comments that have been seen by almost no one (because you're hellbanned). You may have also noticed that Hacker News is extremely slow for you -- when a user is hellbanned, the site slows down for them. Each page refresh takes an additional ~10sec to load. So assuming a lowball figure of 10 pageviews per each of your comments, this hellban has claimed at least 2 hours of your life just sitting there waiting for HN to load. Hence I feel compelled to show some mercy and let you know that you need to create a new account if you want anyone to see anything you write. And some of your writing is thoughtful. You were probably banned because, quite frankly, you were a complete dick when you first started commenting[1][2] and probably got banned for this comment[3] but the quality of your comments increased after you were banned, so if you've changed, you're nice, and you want to contribute to this community in a positive way, then I assume you'd be welcome back. So make a new account. [1] https://news.ycombinator.com/item?id=4965082 https://news.ycombinator.com/item?id=4965082 [2] https://news.ycombinator.com/item?id=4988839 https://news.ycombinator.com/item?id=4988839 [3] https://news.ycombinator.com/item?id=4993462 https://news.ycombinator.com/item?id=4993462 EDIT: Actually, this[4] is almost certainly what pissed off a mod enough to ban you, and rightfully so: if you still feel that way, then you deserve to remain banned. But I'm optimistic about people's ability to change (I myself was quite a different person 249 days ago). If you still enjoy writing comments that attack people personally, even if the attack is deserved, then you will make me sad, since that will mean I've hurt the community by informing you of your status. So please don't make me regret sticking my neck out for you. Besides, it's much more satisfying to write comments that uplift people rather than tearing them down. [4] https://news.ycombinator.com/item?id=4993757 https://news.ycombinator.com/item?id=4993757

sillysaurus2 13y ago
WARNING: Shortly after I posted this, HN no longer loads for my IP address: http://screencast.com/t/J0FIYAhn http://screencast.com/t/J0FIYAhn It may just be coincidence. But that's quite a coincidence. HN completely doesn't load for me, with "No Data Received," meaning the Arc process running HN is specifically deciding not to send any data to my specific IP address (since Tor still works). Meaning my IP got banned. And just before that, I started receiving the message "We've limited requests for this url" for everyone's comment page: http://screencast.com/t/h0n0HjTcM http://screencast.com/t/h0n0HjTcM ... so it does appear that my IP has been singled out for some special reason, possibly for this comment. (I'm not sharing my connection with anybody, so it was definitely something I did.) So until I verify what's going on, don't risk your account by making comments telling hellbanned people that they've been banned. There may be consequences. (If that's the case, then I wish they would've just deleted my comment and told me not to do that... I didn't mean to cause problems. Sorry.) EDIT: The error has changed to "This webpage is not found." http://screencast.com/t/NcFgfnQ3p4 http://screencast.com/t/NcFgfnQ3p4 Still not loading. Other websites load fine. EDIT2: Back to "no data received." Definitely not loading for my IP address. EDIT3: Attempting to unban my IP using the method described at https://news.ycombinator.com/item?id=5631364 https://news.ycombinator.com/item?id=5631364 didn't work. The Arc process really doesn't like my IP address. EDIT4: HN now loads, but https://news.ycombinator.com/user?id=trysomething https://news.ycombinator.com/user?id=trysomething is still returning "We've limited requests for this url." I get that error message for all profile URLs, e.g. https://news.ycombinator.com/user?id=pg https://news.ycombinator.com/user?id=pg EDIT5: Aaand my IP is back to being banned.