Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

What the CIA WikiLeaks Dump Tells Us: Encryption Works

nytimes.com

Post reply on HN
Print view View original

191–200 of 270 posts

Re: What the CIA WikiLeaks Dump Tells Us: Encryption Works

#191

Post by BinaryWaves »

andai wrote: post #67

I don't see any mention of quantum computers in here so I thought I'd mention: the NSA themselves are concerned that quantum computing will be a great threat to encryption in the near future. Keep in mind that the NSA and god knows who else are storing encrypted communications to break them later. Quantum computing will defeat RSA, DH, ECC, asymmetric crypto, but it will only weaken symmetric crypto (eg. AES) by a fa…

Maybe it's a lesson that security itself is a flawed approach and we need a fundamentally different system

Re: What the CIA WikiLeaks Dump Tells Us: Encryption Works

#192

Post by mikepurvis »

smaddox wrote: post #150
Laforet wrote: post #148

Earlier quoted context omitted.

Dropbox is known to have intergration with PhotoDNA, a state program that matches file signature with a database of known illicit images. This would be impossible if the encryption used is irreversible and as far as I know dropbox never claimed otherwise.

I'm not claiming it is end-to-end, nor did I expect it to be, but perhaps some people would assume that. I thought you were claiming they don't use encryption at all.

It's effectively nothing when Dropbox themselves have access to all your files whenever they want.

Re: What the CIA WikiLeaks Dump Tells Us: Encryption Works

#193

Post by [deleted] »

caustiko wrote: post #19
colordrops wrote: post #10

Earlier quoted context omitted.

It seems that most people are completely in the dark when it comes to security, including myself, but there are some principles that should be unwavering that regularly get ignored again with every new iteration of "secure" software: * If there is a weak layer in the stack, from the physical layer to to UI, then the system is not secure. Even if your messaging app is secure, your messages are not secure if your OS is…

This post is grey, and I'm not quite sure why. It's a bit on the "pessimistic" side, but... that philosophy is actually spot on IMO when it comes to security. So why downvote this? I'm honestly a bit new to this community but to me this sceptic perspective as it pertains to software security is ... well, actually it isn't even enough. Is this a weakness w/HN where even justified pessimism is eschewed?

[deleted]

Re: What the CIA WikiLeaks Dump Tells Us: Encryption Works

#194

Post by CiPHPerCoder »

dromenkoning wrote: post #6

The article mentions WhatsApp multiple times as a service that successfully made the transition to end-to-end encryption, but it always seemed to me that this claim is rather meaningless when we don't have the possibility of auditing their source code.

We don't need to audit the source code. Just grab the binary, reverse engineer it, and study that.

There's an entire industry dedicated to reverse engineering software and studying its security properties. We call it the security industry. (Not every gig is white-box!)

Re: What the CIA WikiLeaks Dump Tells Us: Encryption Works

#195

Post by xapata »

john61 wrote: post #187
xapata wrote: post #159

Earlier quoted context omitted.

In that sense, no one is independent. We've all got friends and family, or at least people we know. By definition, if you've heard of someone else's software, that person had a social network by which they distributed the software to you.

Social dependency is not binary. Developers in a company a much more dependent from each other and the boss, than reviewers of free software.

Very true. Maybe I misread your previous comment as being more binary than you intended.

Keep in mind that reviewers of free software are also often employees and may have some agenda beyond pure altruism, even if the software isn't copyright of the employer. Open source is big business these days.

Re: What the CIA WikiLeaks Dump Tells Us: Encryption Works

#196

Post by wyager »

jacquesm wrote: post #122
snakeanus wrote: post #119

Earlier quoted context omitted.

I find it weird that hash signatures are not commonly used since most asymmetric hash signature schemes (if not all) are provably safe as long as the hash function used is safe and they are also quantum-safe and very trivial to implement. It is also extremely annoying that programs like gpg do not support the generation of large RSA keysizes such as 15360 bits which would require many more qbits in order to break (an…

A signature is a trap-door, encryption is reversible. So they are two entirely different things, you can't use a signature hash for encryption.

You are correct, but we're talking about asymmetric key crypto in general, not just encryption. Presumably the GP is referring to quantum-resistant hash-based signature schemes such as https://en.wikipedia.org/wiki/Merkle_signature_scheme

Re: What the CIA WikiLeaks Dump Tells Us: Encryption Works

#197

Post by wyager »

fiatjaf wrote: post #125
andai wrote: post #67

I don't see any mention of quantum computers in here so I thought I'd mention: the NSA themselves are concerned that quantum computing will be a great threat to encryption in the near future. Keep in mind that the NSA and god knows who else are storing encrypted communications to break them later. Quantum computing will defeat RSA, DH, ECC, asymmetric crypto, but it will only weaken symmetric crypto (eg. AES) by a fa…

You seen to be so sure quantum computing will actually be done.

It's already been done, just not on very many qubits. Scaling up to more qubits is a tractable engineering challenge, and there's plenty of money on the table, so we have every reason to expect that practical quantum computers will emerge in the near future.

Re: What the CIA WikiLeaks Dump Tells Us: Encryption Works

#198

Post by wyager »

espeed wrote: post #17
colordrops wrote: post #10

Earlier quoted context omitted.

It seems that most people are completely in the dark when it comes to security, including myself, but there are some principles that should be unwavering that regularly get ignored again with every new iteration of "secure" software: * If there is a weak layer in the stack, from the physical layer to to UI, then the system is not secure. Even if your messaging app is secure, your messages are not secure if your OS is…

The Signal protocol ( https://en.wikipedia.org/wiki/Signal_Protocol ) has been vetted, and the code is online available to be audited: - Signal code: https://github.com/whispersystems/ Telegram has had known flaws, which have been discussed in part here: - Telegram protocol defeated. Authors are going to modify crypto-algorithm https://news.ycombinator.com/item?id=6948742 - A Crypto Challenge For The Telegram Develop…

The protocol is secure, but we have no idea if the implementations are secure (except Signal itself), because we can't audit them.

In fact, Facebook Messenger's implementation of Signal has very questionable security right out of the box, because if one party "reports" an encrypted conversation, the whole thing is decrypted and sent to facebook support staff.

Re: What the CIA WikiLeaks Dump Tells Us: Encryption Works

#199

Post by jacquesm »

mikepurvis wrote: post #192
smaddox wrote: post #150

Earlier quoted context omitted.

I'm not claiming it is end-to-end, nor did I expect it to be, but perhaps some people would assume that. I thought you were claiming they don't use encryption at all.

It's effectively nothing when Dropbox themselves have access to all your files whenever they want.

And whoever hacks dropbox, yours or all of them.

Re: What the CIA WikiLeaks Dump Tells Us: Encryption Works

#200

Post by mcbits »

espeed wrote: post #40
developer2 wrote: post #35

This world we live in... the Associated Press permeates through nearly all of the US's media. They are the same reason you can find newscasts about some random throwaway story being repeated word-for-word verbatim. When you have dozens of news anchors across the country reading the exact same words from a teleprompter to push a story, something is very very wrong. I mean, it's nice that the NY Times specifies "By THE…

The Associated Press is a wire service [1] -- writing and distributing articles to other news papers is what it does: [1] https://en.wikipedia.org/wiki/News_agency

In blog spammer terminology, the AP is a shallow content farm that subscribers can either copy verbatim or spin into new articles to avoid duplicate content filters, as long as they provide credit/backlinks.
Post reply on HN