5 ms·

NSA proof So a system hacked together by a few clever people is somehow proof against an organization that owns more computer hardware and employs more Ph.D. m

NSA proof So a system hacked together by a few clever people is somehow proof against an organization that owns more computer hardware and employs more Ph.D. mathematicians than pretty much anyone else, and has access to most of the fibre through which most of the worlds' IP traffic flows? Sure. I am also interested in the bridge, the swamp, and helping you deposit those millions into my account, to whom should I post my most intimate personal details?

happimess 13y ago
The headline is over the top, but the article was pretty levelheaded. From the penultimate paragraph: "[...] Freitas points out that if someone is monitoring your internet traffic — or mass monitoring internet users — they’d still be able to find your IP address (Freitas suggests those looking for additional protection consider the Tor Project‘s anonmity software)."
Sanddancer 13y ago
The math for systems like this is pretty well vetted; considering that DHTs have been used in a number of projects for over a decade, any flaw that the NSA knows about almost certainly would have spilled out into the rest of the world by now. There are theoretical attacks against portions of this -- the 51% attack against the bittorrent protocol for signing IDs -- but in practice, they'd be very very difficult to actually pull off. Yes, a "few people" implemented it, but it's all pieces that have been vetted elsewhere.
- deleted 13y ago
  [deleted]
PeterWhittaker 13y ago
And just to forestall obvious retorts based on Bitcoin and any and all other brilliant, game changing systems conceived of and implemented by small teams: That such teams can change the game, can occasionally create things sui generis, does not in any way diminish the possibility of a large, well funded, well staffed, and incredibly well resourced organization like the NSA from either having access via a) other channels (all crypto runs on hardware eventually, and all hardware gives out heat and makes noise - even if our ears cannot hear it; learn enough about waste emissions from hardware and you figure out what's going inside - and that's just one vector in the compute channel, let's not forget there are socially engineerable and occasionally corruptible people involved too!) or b) direct attacks on the crypto and other masking technologies themselves, because these guys - the NSA, I mean, keep up :-> - may just know that much. I've never worked directly in areas that would give me first hand knowledge of any of the above (and I had, I would likely be committing a crime writing this) but I have worked long enough and deeply enough in adjacent areas to have an inkling of just how powerful an adversary (in the technical threat-risk-assessment sense) the NSA is. Or may be. So to say that your latest weekend project is somehow proof against them? Hmm, I tend to, uh, at least dubiousness ("Well, have you considered this vector, and this combination of catastrophic failures?"), if not directly to outright scoffing ("Mwa ha ha, you're so sweetly naive, have a biscuit"). I tend not to worry about the NSA and others of their ilk because none of my shit is worth enough or is interesting enough to be of value to them. In aggregate? Who knows, good question. I tend not to worry about that either, though, because I'm pretty sure that there are plenty of other more interesting fish. I do worry about the potential erosion of civil liberties, but so long as we have the EFF and Michael Geist, I tend to feel a bit better and worry less.
jokoon 13y ago
well it makes it much more difficult for the NSA to spy, those systems are much better than centralized ones. what are you complaining about ? at least there are ways to circumvent the NSA other than political ones.
eliteraspberrie 13y ago
The leaks show the NSA had a hard time exploiting the Tor network. It's much more thought-out than this project, but in the beginning it too was just hacked together by a few clever people.
- thirsteh 13y ago
  > The leaks show the NSA had a hard time exploiting the Tor network. It's much more thought-out than this project, but in the beginning it too was just hacked together by a few clever people. At the U.S. Naval Research Laboratory. (By any measure, most innovation is done by single persons or small teams, but Tor is an interesting example seeing as it was developed by the U.S. government itself.)
  - eliteraspberrie 13y ago
    Tor was not developed by the US government. Tor started as a student project of Matej Pfajfar at the University of Cambridge. Then Roger Dingledine joined in 2002, then Nick Mathewson, Mike Perry, and many, many others. The NRL was interested in onion routing and funded the project, as did DARPA, and now the State Department. For more history of onion routing and Tor, see section 5 of Systems for Anonymous Communication: http://www.syverson.org/anonsurvey-fc.pdf http://www.syverson.org/anonsurvey-fc.pdf
    - thirsteh 13y ago
      Yeah, I shouldn't have said "at the NRL." The U.S. government sponsored the development of Tor and created onion routing.

happimess 13y ago

The headline is over the top, but the article was pretty levelheaded. From the penultimate paragraph: "[...] Freitas points out that if someone is monitoring your internet traffic — or mass monitoring internet users — they’d still be able to find your IP address (Freitas suggests those looking for additional protection consider the Tor Project‘s anonmity software)."

Sanddancer 13y ago

The math for systems like this is pretty well vetted; considering that DHTs have been used in a number of projects for over a decade, any flaw that the NSA knows about almost certainly would have spilled out into the rest of the world by now. There are theoretical attacks against portions of this -- the 51% attack against the bittorrent protocol for signing IDs -- but in practice, they'd be very very difficult to actually pull off. Yes, a "few people" implemented it, but it's all pieces that have been vetted elsewhere.

deleted 13y ago
[deleted]

PeterWhittaker 13y ago

And just to forestall obvious retorts based on Bitcoin and any and all other brilliant, game changing systems conceived of and implemented by small teams: That such teams can change the game, can occasionally create things sui generis, does not in any way diminish the possibility of a large, well funded, well staffed, and incredibly well resourced organization like the NSA from either having access via a) other channels (all crypto runs on hardware eventually, and all hardware gives out heat and makes noise - even if our ears cannot hear it; learn enough about waste emissions from hardware and you figure out what's going inside - and that's just one vector in the compute channel, let's not forget there are socially engineerable and occasionally corruptible people involved too!) or b) direct attacks on the crypto and other masking technologies themselves, because these guys - the NSA, I mean, keep up :-> - may just know that much. I've never worked directly in areas that would give me first hand knowledge of any of the above (and I had, I would likely be committing a crime writing this) but I have worked long enough and deeply enough in adjacent areas to have an inkling of just how powerful an adversary (in the technical threat-risk-assessment sense) the NSA is. Or may be. So to say that your latest weekend project is somehow proof against them? Hmm, I tend to, uh, at least dubiousness ("Well, have you considered this vector, and this combination of catastrophic failures?"), if not directly to outright scoffing ("Mwa ha ha, you're so sweetly naive, have a biscuit"). I tend not to worry about the NSA and others of their ilk because none of my shit is worth enough or is interesting enough to be of value to them. In aggregate? Who knows, good question. I tend not to worry about that either, though, because I'm pretty sure that there are plenty of other more interesting fish. I do worry about the potential erosion of civil liberties, but so long as we have the EFF and Michael Geist, I tend to feel a bit better and worry less.

jokoon 13y ago

well it makes it much more difficult for the NSA to spy, those systems are much better than centralized ones. what are you complaining about ? at least there are ways to circumvent the NSA other than political ones.

eliteraspberrie 13y ago

The leaks show the NSA had a hard time exploiting the Tor network. It's much more thought-out than this project, but in the beginning it too was just hacked together by a few clever people.

thirsteh 13y ago
> The leaks show the NSA had a hard time exploiting the Tor network. It's much more thought-out than this project, but in the beginning it too was just hacked together by a few clever people. At the U.S. Naval Research Laboratory. (By any measure, most innovation is done by single persons or small teams, but Tor is an interesting example seeing as it was developed by the U.S. government itself.)
- eliteraspberrie 13y ago
  Tor was not developed by the US government. Tor started as a student project of Matej Pfajfar at the University of Cambridge. Then Roger Dingledine joined in 2002, then Nick Mathewson, Mike Perry, and many, many others. The NRL was interested in onion routing and funded the project, as did DARPA, and now the State Department. For more history of onion routing and Tor, see section 5 of Systems for Anonymous Communication: http://www.syverson.org/anonsurvey-fc.pdf http://www.syverson.org/anonsurvey-fc.pdf
  - thirsteh 13y ago
    Yeah, I shouldn't have said "at the NRL." The U.S. government sponsored the development of Tor and created onion routing.