Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

What the CIA WikiLeaks Dump Tells Us: Encryption Works

nytimes.com

Post reply on HN
Print view View original

121–130 of 270 posts

Re: What the CIA WikiLeaks Dump Tells Us: Encryption Works

#121

Post by chimeracoder »

xg15 wrote: post #68
MarkMc wrote: post #37

Earlier quoted context omitted.

I think you are being too strict in your definition of 'secure'. 99.99% of devices run Android, iOS or Windows which are closed source and therefore not 'secure'. To me, security is not a binary property but rather a sliding scale. WhatsApp say they use end-to-end encryption and they have a strong financial incentive to be telling the truth. No hacker has demonstrated that WhatsApp are lying and the Wikileaks dump su…

> WhatsApp say they use end-to-end encryption and they have a strong financial incentive to be telling the truth. I'm not giving much to the various "whatsapp backdoor" allegations but I'm curious to why they'd have financial incentive to provide privacy. Most of their userbase likely still doesn't care about security and they do belong to Facebook - so if anything, they'd have a financial incentive not to use effect…

Based on the behavior after these leaks, there's moderate evidence to suggest that users care somewhat about privacy if it can be accomplished without any sacrifices in existing ease-of-use.

Facebook cares mostly about penetration for Whatsapp, to ensure that no other messaging app takes over.

Re: What the CIA WikiLeaks Dump Tells Us: Encryption Works

#122

Post by jacquesm »

snakeanus wrote: post #119
andai wrote: post #67

I don't see any mention of quantum computers in here so I thought I'd mention: the NSA themselves are concerned that quantum computing will be a great threat to encryption in the near future. Keep in mind that the NSA and god knows who else are storing encrypted communications to break them later. Quantum computing will defeat RSA, DH, ECC, asymmetric crypto, but it will only weaken symmetric crypto (eg. AES) by a fa…

I find it weird that hash signatures are not commonly used since most asymmetric hash signature schemes (if not all) are provably safe as long as the hash function used is safe and they are also quantum-safe and very trivial to implement. It is also extremely annoying that programs like gpg do not support the generation of large RSA keysizes such as 15360 bits which would require many more qbits in order to break (an…

A signature is a trap-door, encryption is reversible. So they are two entirely different things, you can't use a signature hash for encryption.

Re: What the CIA WikiLeaks Dump Tells Us: Encryption Works

#123

Post by jacquesm »

shshhdhs wrote: post #111
praptak wrote: post #80

Earlier quoted context omitted.

One thing you could do is to exchange the keys in a nonstandard way. Phone or whatever. Obviously still breakable but at least not by a standard dragnet.

I wouldn't use the phone for exchanging plaintext keys. You're forgetting about ECHELON, wiretaps, and the dragnets where LEA are ignoring (or purposefully misinterpreting) the law. It's really cheap to store ALL phone calls these days, and just "playback" when you get the legal search warrant.

And it doesn't count as surveillance until someone looks at it...

Re: What the CIA WikiLeaks Dump Tells Us: Encryption Works

#124

Post by daxorid »

xg15 wrote: post #68
MarkMc wrote: post #37

Earlier quoted context omitted.

I think you are being too strict in your definition of 'secure'. 99.99% of devices run Android, iOS or Windows which are closed source and therefore not 'secure'. To me, security is not a binary property but rather a sliding scale. WhatsApp say they use end-to-end encryption and they have a strong financial incentive to be telling the truth. No hacker has demonstrated that WhatsApp are lying and the Wikileaks dump su…

> WhatsApp say they use end-to-end encryption and they have a strong financial incentive to be telling the truth. I'm not giving much to the various "whatsapp backdoor" allegations but I'm curious to why they'd have financial incentive to provide privacy. Most of their userbase likely still doesn't care about security and they do belong to Facebook - so if anything, they'd have a financial incentive not to use effect…

HN, CNET, Motherboard, Slashdot, Ars, TC, NYT tech etc.

Free product advertising worth $N targeted to the more influential product adopters, who will then amplify said advertisements.

That's my guess, anyway.

Re: What the CIA WikiLeaks Dump Tells Us: Encryption Works

#125

Post by fiatjaf »

andai wrote: post #67

I don't see any mention of quantum computers in here so I thought I'd mention: the NSA themselves are concerned that quantum computing will be a great threat to encryption in the near future. Keep in mind that the NSA and god knows who else are storing encrypted communications to break them later. Quantum computing will defeat RSA, DH, ECC, asymmetric crypto, but it will only weaken symmetric crypto (eg. AES) by a fa…

You seen to be so sure quantum computing will actually be done.

Re: What the CIA WikiLeaks Dump Tells Us: Encryption Works

#126

Post by snakeanus »

jacquesm wrote: post #122
snakeanus wrote: post #119

Earlier quoted context omitted.

I find it weird that hash signatures are not commonly used since most asymmetric hash signature schemes (if not all) are provably safe as long as the hash function used is safe and they are also quantum-safe and very trivial to implement. It is also extremely annoying that programs like gpg do not support the generation of large RSA keysizes such as 15360 bits which would require many more qbits in order to break (an…

A signature is a trap-door, encryption is reversible. So they are two entirely different things, you can't use a signature hash for encryption.

I am not claiming that you can though.

Re: What the CIA WikiLeaks Dump Tells Us: Encryption Works

#127

Post by Cyph0n »

hendzen wrote: post #79
andai wrote: post #67

I don't see any mention of quantum computers in here so I thought I'd mention: the NSA themselves are concerned that quantum computing will be a great threat to encryption in the near future. Keep in mind that the NSA and god knows who else are storing encrypted communications to break them later. Quantum computing will defeat RSA, DH, ECC, asymmetric crypto, but it will only weaken symmetric crypto (eg. AES) by a fa…

Symmetric encryption not being broken doesn't really help you if the encryption key has been exchanged using a (presumably quantum-breakable) form of asymmetric encryption. Most encryption in the wild works this way.

TLS implements PFS (perfect forward secrecy) by generating an ephemeral asymmetric key pair for the session, usually through DH. In other words, breaking the session key pair will only reveal the plaintext of the current session for the current client. No previous communication is broken, so the NSA would have to traverse the history for each client.

Re: What the CIA WikiLeaks Dump Tells Us: Encryption Works

#128

Post by praptak »

shshhdhs wrote: post #111
praptak wrote: post #80

Earlier quoted context omitted.

One thing you could do is to exchange the keys in a nonstandard way. Phone or whatever. Obviously still breakable but at least not by a standard dragnet.

I wouldn't use the phone for exchanging plaintext keys. You're forgetting about ECHELON, wiretaps, and the dragnets where LEA are ignoring (or purposefully misinterpreting) the law. It's really cheap to store ALL phone calls these days, and just "playback" when you get the legal search warrant.

It's only about avoiding automatic dragnet, so making a person listen to the conversation and figure out the key counts as success.

Re: What the CIA WikiLeaks Dump Tells Us: Encryption Works

#129

Post by Retric »

chimeracoder wrote: post #116
Retric wrote: post #95

Earlier quoted context omitted.

There is someone evidence that QM will result in weaker signals to the point where you can't use it to break real world crypto. It's something of an open question at this point.

Could you elaborate? I'm not sure I follow. It's been a while since my CS Theory classes.

Basically, you can do 64 bit calculations on a 16 bit traditional computer, it just takes more steps and some RAM. However, to do 64 bit quantum calculations you need a 64 quibit quantum computer. Now, we may be able to build a 64 QC, bout even that is useless for real world encryption. Further, it while it does not take more time to run a 64vs 4096 quibit QC, it does become exponentially harder to build.

Sort of like trying to measure a building to the nearest inch is harder than nearest foot, and every added digit of accuracy is even harder.

Post reply on HN