4 ms·
If you are trying to NSA-proof a service, obfuscation is not going to cut it. At best you could have a client maintain its own index locally, I suppose.
by einhverfr 13y ago
If you are trying to NSA-proof a service, obfuscation is not going to cut it. At best you could have a client maintain its own index locally, I suppose.
- vidarh 13y ago"obfuscation" here is anything from leaking so little data that you could compensate by "just" going a step up in key length for the encrypted data, and ranging down to so poorly hidden a bored teenager could break it depending on how many bits you effectively "chop off", and other trickery. Frankly I think the problem with NSA-proofing it, though, is that while you can certainly take pleasure in driving up their costs, if you make it impossible for them to simply eavesdrop or break your encryption, the only thing you've really achieved is to make them prioritise other attacks, like capturing copies of all the mail before it reaches your servers. Large amounts of that traffic will be entirely unencrypted anyway, since many of the sites people exchange e-mail with still don't support SSL/TLS.