9 ms·
Where there are security vulnerabilities, I'd rather it be the NSA exploiting them than someone else. The fact that Huawei support engineers have so much power
by paul 13y ago
Where there are security vulnerabilities, I'd rather it be the NSA exploiting them than someone else. The fact that Huawei support engineers have so much power is much more troubling.
- Nacraile 13y agoI think it's naive to assume that the NSA is the only entity that is likely to be able to exploit vulnerabilities. This is the crux of the controversy around NSA's attacks on web security. I only see a difference between an opaque, unaccountable organization in the USA and an opaque, unaccountable organization in China when I look through a nationalistic lens.
- deleted 13y ago[deleted]
- lukeschlather 13y agoQualitatively speaking, I think as opaque as the NSA and CIA are, they're more accountable to the average US Citizen than their Chinese equivalents are to the average Chinese citizen. They're less accountable than I would like, but they are accountable for their actions.
- insuffi 13y agoCan you point to that quantitative evidence and where NSA has been held accountable? I smell propaganda in the air.
- JumpCrisscross 13y agoFISA Courts. Senate Intelligence Committee. Yes, sometimes they have been ignored, and yes, sometimes they have been rubber-stampers. But presently both are, in some capacity, rebelling and, in some capacity, angling to reign in the intelligence bureaus. Nothing similar exists in, for example, France, Russia, China, or India.
- rhizome 13y agoWhat of any of that speaks to "accountability to the average US citizen?"
- insuffi 13y agoI thought we were speaking quantitatively. Where's that quantitative evidence? EDIT: No offense, peterwwillis, but I tend to take arguments such as those from Americans with a grain of salt. Americans like to think that they are better than those nasty commies, but history says otherwise, what with the CIA transporting cocaine and overthrowing foreign governments, and the nsa actively carrying out MITM attacks.
- peterwwillis 13y agoNo, he said Qualitatively. He doesn't need numbers, only the subjective property of the NSA or CIA's character versus similar agencies in China. I would probably also wager that we have more accountability over our intelligence agencies than Chinese people have over their intelligence agencies.
- insuffi 13y agoSorry, my bad. Qualitatively, it is. But qualitative statements are of literally no value. It's all gut instinct. Of course you'd like to think that the US can take moral high ground over the Chinese.
- richardw 13y agoTry to get a Chinese security researcher to expose a hack by a Chinese security agency, on their own blog hosted in China. Don't need numbers to know I wouldn't do it. And I'm not American.
- insuffi 13y agoI don't see how this is relevant. What we're discussing is the subjective perception of both agencies. NSA has most of their programs exposed, as opposed to the PLA, and yet the public still gives NSA the benefit of the doubt. Now that's what I call freedom.
- belorn 13y agoIf they are accountable, where can this company send the bill for the break-in? Going around like thieves in the night and breaking into places and steal stuff like common criminals is not exactly the conduct of someone accountable for their actions. I would actually say its the opposite behavior.
- Perdition 13y agoNot everyone here is American. The US is just as much a direct threat to my countries economic interests as China. A pity my countries politicians are in Washington's pockets and are silent now when only two years ago they were yammering about the threat from Chinese government hackers and Huawei.
- insuffi 13y agoWhy would you prefer NSA exploiting them?
- bpodgursky 13y agoBecause I'm American, and while I'm not really a fan of most of the shit they're pulling, it's still more likely to be in my interest (or less against my interests) than whatever the PLA has in mind.
- lawnchair_larry 13y agoWere you somehow under the impression that you need special American keyboards to type in these support logins and passwords? Everybody is hacking these. You should not feel comfortable.
- insuffi 13y agoWhy? is the PLA more widely known for hacking individuals, especially American citizens?
- jauer 13y agoIn general, yes. PLA Unit 61398: http://en.wikipedia.org/wiki/PLA_Unit_61398 http://en.wikipedia.org/wiki/PLA_Unit_61398 Hacking the Dali Lama: http://www.telegraph.co.uk/news/worldnews/asia/china/7559103/Chinese-hackers-steal-Dalai-Lamas-emails.html http://www.telegraph.co.uk/news/worldnews/asia/china/7559103... and http://www.reuters.com/article/2013/08/12/net-us-tibet-cyberattack-idUSBRE97B0QU20130812 http://www.reuters.com/article/2013/08/12/net-us-tibet-cyber...
- insuffi 13y agoWanna try again? http://www.spiegel.de/international/world/nsa-hacked-email-account-of-mexican-president-a-928817.html#ref=rss http://www.spiegel.de/international/world/nsa-hacked-email-a... http://www.spiegel.de/international/world/the-nsa-uses-powerful-toolbox-in-effort-to-spy-on-global-networks-a-940969.html http://www.spiegel.de/international/world/the-nsa-uses-power...
- robertgraham 13y agoNo. It was a username/password assigned to Huawei tech support.
- tptacek 13y agoThis is so obviously true that I found the tone of the post confusing. It's similar to people's reaction to the comparative threat of keeping their email on Google Mail or some random webmail provider that's likely to lose their mail spool to SQL injection. I'm not arguing that the NSA threat isn't worrisome; it is. But other threats are in fact even worse!
- rhizome 13y agoI'm not arguing that the NSA threat isn't worrisome; it is. But other threats are in fact even worse! As HN's possibly-most strident torchbearer for the measurement of organizational dynamics, can you quantify this statement? How are your ranking?
- tptacek 13y agoThat what with the who now where? Rob is saying that Huawei retains the commercial ability to log directly into their customer's equipment. That's the lede, not NSA!
- robertgraham 13y agoActually, it's not just Huawei, it's pretty much all everything. Pretty much every router, telcom switch, storage system, etc. sold outside the United States comes with a support contract whereby the vendor's engineers can connect and manage the device. Indeed, there's a recent legal case of a company selling stuff to Iran. The company said they weren't responsible, because it was resold by intermediaries. Yet, their support engineers were connecting in to manage the box. The lede was really "here's what we saw", at least to the extent that we can reveal anything being bound by customer confidentiality agreements (which, frankly, isn't much, which kinda sucks for the reasder).
- robertgraham 13y agoThere was no "tone" to the post. It's not pro or anti NSA. Something was in the news. I saw something related to that. So I reported it.
- monkeynotes 13y agoYou are assuming that an NSA employee is more responsible than a Huawei employee. I am equally uncomfortable with either.
- peterwwillis 13y agoProbability dictates it's more likely Huawei will abuse its power than the NSA will abuse Huawei's power. So be equally uncomfortable if you want, but it's Huawei you should be scared of (in this case).
- insuffi 13y agoWhat probability? Can you people cut the fucking bullshit? Everyone here is speaking either "quantitatively" or in "probabilistic" terms, but I have yet to see research or actual discourse backing it up. You're saying Huawei is more power hungry than the NSA? EDIT:I'm sorry for being so abrasive.
- peterwwillis 13y agoAccording to probability theory, if you have A (one single condition), and A+B (two different conditions), A will always be more probable to occur than A+B. Not seeing this is called conjunction fallacy, typically elucidated as the Linda problem. In this case, though, we have one known thing (Huawei has tech support accounts), and one unknown thing (the NSA have access to Huawei's tech support accounts). Huawei accounts alone are already at risk of being abused by Huawei. We don't know if NSA has access to the accounts. But even if they did, it would still be more probable that Huawei's access would be abused than the NSA using Huawei's access. (edited a few times for clarity)
- insuffi 13y agoI appreciate the thorough explanation. http://www.spiegel.de/international/world/nsa-spied-on-chinese-government-and-networking-firm-huawei-a-960199.html http://www.spiegel.de/international/world/nsa-spied-on-chine... 1)We can assume NSA has access. 2)Is it not the NSA that wants to actively penetrate every single device in existence? https://firstlook.org/theintercept/document/2014/03/20/hunt-sys-admins/ https://firstlook.org/theintercept/document/2014/03/20/hunt-... 3)Is there any evidence that Huawei abuses their customers? Like, evidence, not CNN talking points.
- ohwp 13y agoThere will always be a person with top level access. In networking these people are chosen by trust. For example. You can become a Juniper Networks Certified Internet Expert but that doesn't mean you can get a job. People still need to trust you. And a good spy is someone people trust.
- fit2rule 13y agoIsn't this a little bit like being glad that American phone records aren't being processed in Israel?