Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Mythology About Security

gettys.wordpress.com

Post reply on HN
Print view View original

21–30 of 45 posts

Re: Mythology About Security

#21

Post by mashedvikings »

lordofmoria wrote: post #12
euske wrote: post #6

Does this matter? We (not just IT people, everyone in the world) always lack the imagination of what could happen, and every time we're caught off guard by the creativity of malicious people. Sometimes a government is to blame, but eventually it's just us. Again, security is a process and a never-ending game of arms race. When you stop playing, they'll get the best of you. (Disclaimer: this is for the sake of argumen…

I would argue that usually it doesn’t matter because of the reasons you mentioned, but in this particular case it really did. The US government, and the NSA in particular, made it a matter of explicit policy to delay and discourage commercial crypto research and development in the US. Off hand, I’d guess this delayed crypto by 10 years. Imagine if 10 years ago, we had today’s understanding of crypto. I’d wager TLS wo…

One of the greatest heroes we have to thank are Diffie and Hellman who put up a fight when US government went against their research on public key cryptography.

But I suppose the reason NSA was delaying was they had to develop a workaround for the encryption. Remember, while public key crypto got strong in 1996 when the key lengths ended Tailored Access Operations (NSA's hacking team) was created in 1998, before DES was replaced with AES in 2001.

Now obviously it's not that simple. Phasing out weak standards has taken very long. Personally, I would love to understand what goes on in the heads of developers who still use age old primitives like MD5 and RSA-1280 (iMessage).

Re: Mythology About Security

#22

Post by acqq »

lordofmoria wrote: post #12
euske wrote: post #6

Does this matter? We (not just IT people, everyone in the world) always lack the imagination of what could happen, and every time we're caught off guard by the creativity of malicious people. Sometimes a government is to blame, but eventually it's just us. Again, security is a process and a never-ending game of arms race. When you stop playing, they'll get the best of you. (Disclaimer: this is for the sake of argumen…

I would argue that usually it doesn’t matter because of the reasons you mentioned, but in this particular case it really did. The US government, and the NSA in particular, made it a matter of explicit policy to delay and discourage commercial crypto research and development in the US. Off hand, I’d guess this delayed crypto by 10 years. Imagine if 10 years ago, we had today’s understanding of crypto. I’d wager TLS wo…

To help other possible readers: it's "Crypto: How the Code Rebels Beat the Government -- Saving Privacy in the Digital Age" by Steven Levy, from 2001.

Re: Mythology About Security

#23

Post by acqq »

mashedvikings wrote: post #21
lordofmoria wrote: post #12

Earlier quoted context omitted.

I would argue that usually it doesn’t matter because of the reasons you mentioned, but in this particular case it really did. The US government, and the NSA in particular, made it a matter of explicit policy to delay and discourage commercial crypto research and development in the US. Off hand, I’d guess this delayed crypto by 10 years. Imagine if 10 years ago, we had today’s understanding of crypto. I’d wager TLS wo…

One of the greatest heroes we have to thank are Diffie and Hellman who put up a fight when US government went against their research on public key cryptography. But I suppose the reason NSA was delaying was they had to develop a workaround for the encryption. Remember, while public key crypto got strong in 1996 when the key lengths ended Tailored Access Operations (NSA's hacking team) was created in 1998, before DES…

> I suppose the reason NSA was delaying was they had to develop a workaround for the encryption

No. Their primary purpose was never to protect anybody else but their own operations (the concept "Nobody but us" is older and broader than Wikipedia currently knows https://en.wikipedia.org/wiki/NOBUS ) especially not "common citizens". The NSA is mainly a military institution. Had they been able to get by with nobody being allowed to use crypto but they, they would have done that and continue doing.

Bonus: this is directly from the NSA:

https://www.nsa.gov/resources/everyone/digital-media-center/...

Covered here:

https://www.dailydot.com/layer8/cryptokids-nsa-foia/

Re: Mythology About Security

#24

Post by adrianratnapala »

wmf wrote: post #13
GuB-42 wrote: post #7

Earlier quoted context omitted.

Did they really have to include strong crypto? Most secure protocols negotiate a cipher suite. They just had to add the ability to do so, and maybe some placeholder algorithm using the maximum allowed strength at the time.

The flip side is: Just imagine if Kerberos 1.0 with 40-bit DES was baked into X11 or even IPv4. We'd still be fighting those downgrade attacks. Or maybe we'd be layering real encryption over the broken-but-unremovable encryption, with all the overhead that entails.

True enough, but unless there is some way humanity is going to jump immediately to perfect protocols, then then the tradeoff between backwards-compatibility and downgrade attacks was always going to be with us.

The mere lack of any kind of encryption in our basic protocols can be considered the most important "downgrade attack" around since we never are quite sure when something is going to leak out into the huge background of plaintext.

Re: Mythology About Security

#25

Post by educar »

bitwize wrote: post #3

So uh, why did you design X in such a manner that any client could sniff any other client's events and windows by default, and only later add a (quite inadequate) SECURITY extension? This is what we mean when we say that the security model of X is obsolete, and an afterthought besides. The threat model was completely different back then: every griefer, troll, thief, and state actor didn't have a pipe straight into yo…

> Wayland, by contrast, has a security model for the modern, hostile internet built in from the start.

And yet basic video and screen capture is not working for years now. Arbitrary rectangle capture still doesn't work on Ubuntu 16.04 in any tool I know of.

So they made it so secure to make basic features not work.

Re: Mythology About Security

#26

Post by adrianratnapala »

euske wrote: post #6

Does this matter? We (not just IT people, everyone in the world) always lack the imagination of what could happen, and every time we're caught off guard by the creativity of malicious people. Sometimes a government is to blame, but eventually it's just us. Again, security is a process and a never-ending game of arms race. When you stop playing, they'll get the best of you. (Disclaimer: this is for the sake of argumen…

> Sometimes a government is to blame, but eventually it's just us.

What do you mean? The tendency for bad guys to exploit bugs is really important. But the fact that a government deliberately broke security for everyone is an additional thing, not a special case.

And its worthwhile noting that it is a failure mode we can expect from governments. The US had a realistic concern that opposing nations would use strong crypto against them. The trouble was that they put that concern above all the other consequences that followed from their laws. The policy makers probably couldn't even imagine most of those consequences.

It is in the nature of legislation that it can amplify whatever particular concern captures the political imagination without having to consider the broader picture.

Re: Mythology About Security

#27

Post by Valmar »

educar wrote: post #25
bitwize wrote: post #3

So uh, why did you design X in such a manner that any client could sniff any other client's events and windows by default, and only later add a (quite inadequate) SECURITY extension? This is what we mean when we say that the security model of X is obsolete, and an afterthought besides. The threat model was completely different back then: every griefer, troll, thief, and state actor didn't have a pipe straight into yo…

> Wayland, by contrast, has a security model for the modern, hostile internet built in from the start. And yet basic video and screen capture is not working for years now. Arbitrary rectangle capture still doesn't work on Ubuntu 16.04 in any tool I know of. So they made it so secure to make basic features not work.

I wonder if there will be a successor to Wayland and X11 that learns from the mistakes of both?

Can't always make wise improvements if you don't first make awful mistakes that weren't properly considered in practice.

Re: Mythology About Security

#28

Post by colorincorrect »

I often hear that (quote the article) "Government export controls crippled Internet security and the design of Internet protocols from the very beginning"

Can anyone give me examples of which a design flaw in the protocol results directly in poorer security, and how it could have been better designed?

Not that I doubt the claim but I am not literate in this area.

Re: Mythology About Security

#29

Post by roel_v »

colorincorrect wrote: post #28

I often hear that (quote the article) "Government export controls crippled Internet security and the design of Internet protocols from the very beginning" Can anyone give me examples of which a design flaw in the protocol results directly in poorer security, and how it could have been better designed? Not that I doubt the claim but I am not literate in this area.

According to this article, without export controls, X would have had strong crypto baked in. So the 'flaw' is that it was designed, well, without crypto.
Post reply on HN