Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

What the CIA WikiLeaks Dump Tells Us: Encryption Works

nytimes.com

Post reply on HN
Print view View original

101–110 of 270 posts

Re: What the CIA WikiLeaks Dump Tells Us: Encryption Works

#101

Post by codedokode »

FreeFull wrote: post #38
MarkMc wrote: post #37

Earlier quoted context omitted.

I think you are being too strict in your definition of 'secure'. 99.99% of devices run Android, iOS or Windows which are closed source and therefore not 'secure'. To me, security is not a binary property but rather a sliding scale. WhatsApp say they use end-to-end encryption and they have a strong financial incentive to be telling the truth. No hacker has demonstrated that WhatsApp are lying and the Wikileaks dump su…

https://source.android.com/ The source code for Android is open under the Apache 2.0 license. Of course, iOS and Windows are closed source.

This is only the base code. The manufacturer modifies this code when building a ROM and can add anything. It should provide the modified sources but many chinese vendors do not do it.

Even if manufacturer provides the code, it can preinstall additional closed source programs. For example, Facebook app or some "telemetry" app that are closed source. My chinese noname phone contained an app that was trying to send my phone number and other identifiers to China as a part of a "sales report" (exact URL was http://bigdata.adfuture.cn /reboot/salesCountInterface.do ). And one can only guess how many data does Facebook collect.

What the end user gets is a phone with a binary blob inside.

I think there should be a strict requirement banning collecting any data without consent from user. No "anonymous" "analytics" and telemetry, no crash reporting, no advertising ids, no checkboxes checked by default. There can be only legal solution to the problem of mass surveillance by software companies. Every byte your device sends to network can end up in the hands of the hackers from developing countries or NSA.

Re: What the CIA WikiLeaks Dump Tells Us: Encryption Works

#102

Post by adventured »

alister wrote: post #3

What a welcome shift in public sentiment. Mainstream media is starting to recommend end-to-end encryption, without back doors, for everybody. (Though the New York Times might represent the leading edge of the change in popular opinion.)

You tend to see that sort of change every eight years or so. The fake liberals come back around to pretending to support all civil liberties again.

Ashcroft does X, it's evil and given intense scrutiny. Holder does X, it's mostly given a pass by the msm.

Bush does X, it's evil. Obama does X (eg regime change in Syria; what, no million person protests?), it's mostly given a pass by the msm.

That's how the media has functioned for decades. They'll get extremely loud during Trump's Presidency about domestic spying abuses, after eight years of giving the Obama Admin a sizable pass. The same will hold true about the egregious abuses directed at the press under Obama, when Trump does the same thing it'll be the end of the world.

Re: What the CIA WikiLeaks Dump Tells Us: Encryption Works

#105

Post by john61 »

homakov wrote: post #53
john61 wrote: post #23

Earlier quoted context omitted.

You rely on a net of diverse independent reviewers instead of a single entity with a particular interest. A peer reviewed distributed trust net is much more trustworthy.

There's no such net, nobody is signing the binaries.

Signing is not necessary. Only a comprehensible bug report or patch.

Re: What the CIA WikiLeaks Dump Tells Us: Encryption Works

#106

Post by JshWright »

kevincox wrote: post #84
andai wrote: post #75

Earlier quoted context omitted.

I'm thinking about giving both machines a little speaker and microphone and using high frequency pulses to transfer the text. (modem) I don't know enough about computer security to understand whether a specially crafted piece of morse code audio (transferred through actual sound waves) could be used as an exploit, but I'm leaning towards "implausible".

Airgapped means it has no communication. But yes, in practice it is often useful to move data to and from. In a "perfect" airgap this would probably be you typing and reading the screen. However this isn't the most convient but the more things automatically accessing it the less security you will have. If you are going to connect it I won't bother maknig your own system and just use something standard (like ethernet)…

There are plenty of (proximity dependent) attacks that could leverage the monitor or keyboard you're using to passively collect information from the system.

The only completely secure airgapped system is the one that's never powered on ;) (and kept physically safe).

Re: What the CIA WikiLeaks Dump Tells Us: Encryption Works

#107

Post by MichaelMoser123 »

andai wrote: post #67

I don't see any mention of quantum computers in here so I thought I'd mention: the NSA themselves are concerned that quantum computing will be a great threat to encryption in the near future. Keep in mind that the NSA and god knows who else are storing encrypted communications to break them later. Quantum computing will defeat RSA, DH, ECC, asymmetric crypto, but it will only weaken symmetric crypto (eg. AES) by a fa…

Its more of a problem if you have key exchange (like RSA); here [1] it says that with AES is supposedly secure against quantum computers with 'sufficiently sized key sizes'; For key exchange they are trying to adapt elliptic curves.

[1] https://en.wikipedia.org/wiki/Post-quantum_cryptography .

Re: What the CIA WikiLeaks Dump Tells Us: Encryption Works

#108

Post by JshWright »

andyjohnson0 wrote: post #83
andai wrote: post #75

Earlier quoted context omitted.

I'm thinking about giving both machines a little speaker and microphone and using high frequency pulses to transfer the text. (modem) I don't know enough about computer security to understand whether a specially crafted piece of morse code audio (transferred through actual sound waves) could be used as an exploit, but I'm leaning towards "implausible".

Peer-to-peer IrLAN [1] is less prone to interference then sound, and being directional is harder to attack if the air-gap is small. Nowadays its probably obscure enough to make creating an exploit prohibitively expensive, even more so if you write your own drivers. With some electronics knowledge you could probably build your own simple transceivers too.

How does an obscure transport help you if it's still just a LAN connection?

Re: What the CIA WikiLeaks Dump Tells Us: Encryption Works

#109

Post by ycmbntrthrwaway »

andai wrote: post #67

I don't see any mention of quantum computers in here so I thought I'd mention: the NSA themselves are concerned that quantum computing will be a great threat to encryption in the near future. Keep in mind that the NSA and god knows who else are storing encrypted communications to break them later. Quantum computing will defeat RSA, DH, ECC, asymmetric crypto, but it will only weaken symmetric crypto (eg. AES) by a fa…

> So according to my Internet research: if your symmetric crypto is twice as secure (key size) as needs be, it is future proof.

New attacks are discovered from time to time. It is unlikely someone will try to bruteforce your encrypted data. Much more likely that some vulnerability will be discovered in AES or the way you generate keys for it.

Re: What the CIA WikiLeaks Dump Tells Us: Encryption Works

#110

Post by y7 »

hendzen wrote: post #79
andai wrote: post #67

I don't see any mention of quantum computers in here so I thought I'd mention: the NSA themselves are concerned that quantum computing will be a great threat to encryption in the near future. Keep in mind that the NSA and god knows who else are storing encrypted communications to break them later. Quantum computing will defeat RSA, DH, ECC, asymmetric crypto, but it will only weaken symmetric crypto (eg. AES) by a fa…

Symmetric encryption not being broken doesn't really help you if the encryption key has been exchanged using a (presumably quantum-breakable) form of asymmetric encryption. Most encryption in the wild works this way.

True. Note that some "post-quantum" key exchange schemes already exist (based on lattice cryptography, for which there are no known poly-time quantum attacks), e.g. https://eprint.iacr.org/2015/1092 . But I haven't heard of it being used anywhere.
Post reply on HN