6 ms·

How would they do this, assuming they wanted to? If they built their tools correctly, nobody knows how to comply with such a request. Or are you suggesting th

How would they do this, assuming they wanted to? If they built their tools correctly, nobody knows how to comply with such a request. Or are you suggesting that they maintain a secret list of unknown vulnerabilities in their own code, just so they can help people spy on their own users?

enraged_camel 12y ago
Consider this a response to both your comment and tptacek's (rather rude) comment. >>How would they do this, assuming they wanted to? If they built their tools correctly If they built their tools correctly. I think that's a big assumption. We know for a fact that the NSA has infiltrated and/or influenced various organizations to knowingly implement vulnerabilities in commonly used protocols so that systems that use those protocols can be exploited later. This was all over the news. Some experts even speculate that this may be how the Heartbleed bug originated. Considering the fact that OpenSSL has been around for a long time and no one discovered the vulnerability until very recently seriously brings to question how much faith can be placed in systems like GnuPG and OTR. Again, consider who you are up against: the NSA has the capability to tap underwater cables, intercept shipments of routers to plant bugs on them, to force airplanes of foreign presidents to land on allied territory so they can be searched for a fugitive, and who knows what else. And that is the "who knows what else" part that should worry you. We are against an enemy of unknown power and influence, and it is silly to expect technology -- any technology -- to provide sufficient protection. Suggesting that "[GnuPG and OTR] don't end up in the news because they work" is asinine.
- tptacek 12y ago
  The NSA can tap all the cables they want, intercept all the router shipments they want, detour every plane they want; that won't make the discrete log problem any easier for them to solve.
  - enraged_camel 12y ago
    Thomas, you're still stuck in the technical mindset. This is not a technical issue. Forget about the discrete log problem. The NSA can frisk you away tonight to Gitmo and torture you until you spill all your secrets. Before you say I'm being dramatic, consider the fact that this is a government that extra-judiciously assassinates its own citizens and then shamelessly defends it. If you think your shiny protocols are secure, you may want to rethink your entire perspective. At the end of the day, humans can be compromised, which makes all systems designed and developed by humans inherently risky regardless of implementation detail or operation. Any time the NSA really wants to gain a piece of information, the discrete log problem is at best a short delay. A minor inconvenience. A drop in the bucket in terms of the resources needed to go around it, since solving it is not necessary if the system is poorly implemented or has other, undocumented vulnerabilities. edit: downvotes are expected. This is a techie forum and techies don't like it when someone points out that technology can't solve every problem.
    - akproxy 12y ago
      I am using my throwaway to post this. HN user virtuabhi had sometimes ago put this very clearly[1] what tptacek exactly is beneath all his blabber. [1] https://news.ycombinator.com/item?id=7431307 https://news.ycombinator.com/item?id=7431307
      - tptacek 12y ago
        "Hi, I'm a coward, and here's what I think of someone on HN."
        akproxy 12y ago
        Circlejerk is high on you. To be fair you do not seem to be a retard otherwise I would have called you so, but talking about cowardice on a (largely) anonymous forum you are indicating you might be one. Carry on.
    - aptwebapps 12y ago
      > edit: downvotes are expected. This is a techie forum and techies don't like it when someone points out that technology can't solve every problem. If your original comment had made the point that we don't know what we don't know with respect to the NSA's capabilities, rather than impugning people like Moxie Marlinspike, you probably would have fared better.

enraged_camel 12y ago

Consider this a response to both your comment and tptacek's (rather rude) comment. >>How would they do this, assuming they wanted to? If they built their tools correctly If they built their tools correctly. I think that's a big assumption. We know for a fact that the NSA has infiltrated and/or influenced various organizations to knowingly implement vulnerabilities in commonly used protocols so that systems that use those protocols can be exploited later. This was all over the news. Some experts even speculate that this may be how the Heartbleed bug originated. Considering the fact that OpenSSL has been around for a long time and no one discovered the vulnerability until very recently seriously brings to question how much faith can be placed in systems like GnuPG and OTR. Again, consider who you are up against: the NSA has the capability to tap underwater cables, intercept shipments of routers to plant bugs on them, to force airplanes of foreign presidents to land on allied territory so they can be searched for a fugitive, and who knows what else. And that is the "who knows what else" part that should worry you. We are against an enemy of unknown power and influence, and it is silly to expect technology -- any technology -- to provide sufficient protection. Suggesting that "[GnuPG and OTR] don't end up in the news because they work" is asinine.

tptacek 12y ago
The NSA can tap all the cables they want, intercept all the router shipments they want, detour every plane they want; that won't make the discrete log problem any easier for them to solve.
- enraged_camel 12y ago
  Thomas, you're still stuck in the technical mindset. This is not a technical issue. Forget about the discrete log problem. The NSA can frisk you away tonight to Gitmo and torture you until you spill all your secrets. Before you say I'm being dramatic, consider the fact that this is a government that extra-judiciously assassinates its own citizens and then shamelessly defends it. If you think your shiny protocols are secure, you may want to rethink your entire perspective. At the end of the day, humans can be compromised, which makes all systems designed and developed by humans inherently risky regardless of implementation detail or operation. Any time the NSA really wants to gain a piece of information, the discrete log problem is at best a short delay. A minor inconvenience. A drop in the bucket in terms of the resources needed to go around it, since solving it is not necessary if the system is poorly implemented or has other, undocumented vulnerabilities. edit: downvotes are expected. This is a techie forum and techies don't like it when someone points out that technology can't solve every problem.
  - akproxy 12y ago
    I am using my throwaway to post this. HN user virtuabhi had sometimes ago put this very clearly[1] what tptacek exactly is beneath all his blabber. [1] https://news.ycombinator.com/item?id=7431307 https://news.ycombinator.com/item?id=7431307
    - tptacek 12y ago
      "Hi, I'm a coward, and here's what I think of someone on HN."
      - akproxy 12y ago
        Circlejerk is high on you. To be fair you do not seem to be a retard otherwise I would have called you so, but talking about cowardice on a (largely) anonymous forum you are indicating you might be one. Carry on.
  - aptwebapps 12y ago
    > edit: downvotes are expected. This is a techie forum and techies don't like it when someone points out that technology can't solve every problem. If your original comment had made the point that we don't know what we don't know with respect to the NSA's capabilities, rather than impugning people like Moxie Marlinspike, you probably would have fared better.