3 ms·
This raises a lot of questions about Ubuntu if a government that wants to tap everything has no problem and is "indirectly" recommending it for security.
by theboywho 13y ago
This raises a lot of questions about Ubuntu if a government that wants to tap everything has no problem and is "indirectly" recommending it for security.
- jlgaddis 13y agoIt was apparently written by a Canonical employee, FWIW.
- theboywho 13y agoThe article was written by a Canonical employee but not the study. If I were Canonical I would avoid writing/publishing such an article, as anything that the government recommends for security is probably seen by many as potentially backdoored.
- tych0 13y agoDon't be ridiculous. Most crypto algorithms that back major standards today have been approved by the NSA, and to date no backdoors have been found. For example, the change to NSA suggested for DES s-boxes _strengthened_ the standard. [Disclaimer: I am a Canonical employee, but I had nothing to do with this.]
- 6d0debc071 13y agoThe A5/1-encryption standard was artificially weakened - short key length with padding of zeros - to make mobile phones easier to eavesdrop on. http://www.aftenposten.no/nyheter/uriks/Sources-We-were-pressured-to-weaken-the-mobile-security-in-the-80s-7413285.html http://www.aftenposten.no/nyheter/uriks/Sources-We-were-pres... Given their past behaviour with respect to weakening security, why ought someone to trust them now?
- free652 13y agoI don't see where it says NSA weakened the GSM standard in Europe?
- 6d0debc071 13y agoIt doesn't. If you want NSA stuff, here you go: http://www.heise.de/tp/artikel/5/5263/1.html http://www.heise.de/tp/artikel/5/5263/1.html Short version: ADVAPI.DLL contains - or contained - keys, one controls the implementation of crypto to help with US export regs. The NSA looks highly likely to own the second key (MS devs failed to remove the debugging information in NT4 Service Pack 5 and it was labelled as 'NSAKEY'.) The third key was supposedly a surprise to the MS folks. # That said, I'm not sure why you'd want me to respond along those lines given that we're talking about a UK Gov report.
- tych0 13y agoADVAPI.DLL is a microsoft thing. It's not a crypto standards thing, so my point still stands. (Restated: it is easier to attack implementations than standards.)
- moomin 13y agoI think you might need to distinguish between the old, secretive, possibly creepy NSA and the current slurp the world volcano lair NSA.
- rakoo 13y agoI believe the CESG has done this study to see how other goverment and industrial branches can least be tapped, not to see how it can best tap everyon.