4 ms·

I'm not a security guy, but isn't this just "cryptowashing" if there's a man from the NSA on the inside?

by Qworg 13y ago

fat0wl 13y ago
yeah thats why this stuff is all questionable... supposed good intentions. there was a good article recently that addresses this a bit better https://news.ycombinator.com/item?id=6833267 https://news.ycombinator.com/item?id=6833267 after a bit of reading about the topic you get more of a sense of how the PR machine is working since many big companies go the "no comment" route or just flat-out lie until they are finally caught red-handed. a statement from Microsoft (or anyone for that matter) doesn't really mean much unless they outline a technical methodology that can be thoroughly tested and verified by crypto experts/community. Some might argue that it weakens the system by open sourcing it, but that's sortof the only way IMHO to get to a system that is based on actual crypto and information transmission theory and not just companies obscuring data with methods that will eventually be cracked.
danbruc 13y ago
Not necessarily - if you do the encryption on the client and only ever transmit encrypted data, then even an insider can not learn much about your data. But this may be difficult and/or impractical. You can not easily search your emails if Microsoft only stores an encrypted copy. It might work better for storing your files on SkyDrive. What we really need is practical fully homomorphic encryption [1]. [1] http://en.wikipedia.org/wiki/Homomorphic_encryption http://en.wikipedia.org/wiki/Homomorphic_encryption
- RyanZAG 13y ago
  As long as the source is closed, you'd never know if the private key is transmitted or not to the server.
malandrew 13y ago
Yup. I'm trying to figure out if this PR move is for the sake of people like you and I, or if it is so salespeople have something they can point at when trying to sell licenses to foreign companies and governments.

I'm not a security guy, but isn't this just "cryptowashing" if there's a man from the NSA on the inside?

by Qworg 13y ago

I'm not a security guy, but isn't this just "cryptowashing" if there's a man from the NSA on the inside?

yeah thats why this stuff is all questionable... supposed good intentions. there was a good article recently that addresses this a bit better https://news.ycombinator.com/item?id=6833267 https://news.ycombinator.com/item?id=6833267 after a bit of reading about the topic you get more of a sense of how the PR machine is working since many big companies go the "no comment" route or just flat-out lie until they are finally caught red-handed. a statement from Microsoft (or anyone for that matter) doesn't really mean much unless they outline a technical methodology that can be thoroughly tested and verified by crypto experts/community. Some might argue that it weakens the system by open sourcing it, but that's sortof the only way IMHO to get to a system that is based on actual crypto and information transmission theory and not just companies obscuring data with methods that will eventually be cracked.

danbruc 13y ago

Not necessarily - if you do the encryption on the client and only ever transmit encrypted data, then even an insider can not learn much about your data. But this may be difficult and/or impractical. You can not easily search your emails if Microsoft only stores an encrypted copy. It might work better for storing your files on SkyDrive. What we really need is practical fully homomorphic encryption [1]. [1] http://en.wikipedia.org/wiki/Homomorphic_encryption http://en.wikipedia.org/wiki/Homomorphic_encryption

RyanZAG 13y ago
As long as the source is closed, you'd never know if the private key is transmitted or not to the server.

malandrew 13y ago

Yup. I'm trying to figure out if this PR move is for the sake of people like you and I, or if it is so salespeople have something they can point at when trying to sell licenses to foreign companies and governments.