Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The NSA called me after midnight and requested my source code (2018)

medium.com

Post reply on HN
Print view View original

111–120 of 219 posts

Re: The NSA called me after midnight and requested my source code (2018)

#111

Post by ebg13 »

DennisP wrote: post #106
willvarfar wrote: post #101

Earlier quoted context omitted.

Encryption as he implemented it does not rely on the secrecy of the algorithm. It relies on the secrecy of the key. This is why he was asking about their ability to break 256 or 40 bit encryption. So there was no trust broken in sharing the source code.

Assuming he implemented the cryptography correctly, but if he didn't then his users weren't secure anyway, and the source code would have just saved the NSA a little time.

That may depend on some specific knowledge of the code, which is of course why they were asking for it.

Re: The NSA called me after midnight and requested my source code (2018)

#112

Post by vl »

thisisnico wrote: post #61
kapitalx wrote: post #25

Earlier quoted context omitted.

From the story, I didn't get the sense that Dave didn't know that the shareware version used 40-bit encryption. But that it was a revelation for the author. Sounded like Dave didn't give up any information, other than the relevant version.

I see so many tactics of an expert negotiator here. Being incredibly nice and respectful. They were able to get what they wanted. They were able to convince you of an issue, with urgency, without any evidence of the use of your code other than the words of the officer. The story could have absolutely been fabricated to obtain access to the source code per an initiative to have access to cryptographic software, or it…

Being NSA they could have easily have gotten source code in the covert way - one of the employees had copy at home, they emailed it around! But for encryption software there is no value in source code in the first place - algorithms are standard, and software can be disassembled anyway. All access to the source code does is allows them to save time on disassembly. Author knew all this and this is why he gave them source code in the first place.

Basically fabricating this story and risking exposure just wasn’t necessary.

Re: The NSA called me after midnight and requested my source code (2018)

#113

Post by ebg13 »

bsamuels wrote: post #62
ebg13 wrote: post #52

I can't help but feel like the author sounds excessively credulous. I had to stop reading after he wrote "I could tell something big was up and there simply wasn’t time to debate the merits of handing over my source code to the NSA", because at that point my eyes rolled so hard they fell right out the back of my head. After I put them back in, I skipped down to the comments. I have a hard time not agreeing vehemently…

I'm sorry but if you think the NSA is the shadiest government agency on the planet, then you live in an information bubble. Do you think the NSA is shadier than the KGB? What about the Iranian Revolutionary Guard? Or even the CIA? I know people are upset about the Snowden revelations but there are much graver sins that have been committed by other agencies.

> I'm sorry but if you think the NSA is the shadiest

You're right about the detail (probably) and also very wrong to be focusing on that particular detail instead of interpreting it as just barely mild hyperbole.

You've gone to "it's not the absolute worst, therefore I dismiss the statement" instead of "it's not the absolute worst, but it's still really fucking bad so I'm going to recognize the premise and move on".

Re: The NSA called me after midnight and requested my source code (2018)

#114

Post by tehjoker »

bsamuels wrote: post #62
ebg13 wrote: post #52

I can't help but feel like the author sounds excessively credulous. I had to stop reading after he wrote "I could tell something big was up and there simply wasn’t time to debate the merits of handing over my source code to the NSA", because at that point my eyes rolled so hard they fell right out the back of my head. After I put them back in, I skipped down to the comments. I have a hard time not agreeing vehemently…

I'm sorry but if you think the NSA is the shadiest government agency on the planet, then you live in an information bubble. Do you think the NSA is shadier than the KGB? What about the Iranian Revolutionary Guard? Or even the CIA? I know people are upset about the Snowden revelations but there are much graver sins that have been committed by other agencies.

You might be able to point to a regional power and say yes, these guys are pretty shady. What you have to remember though, is that the USA is a global power with global reach, so any shadiness is more scalable. Also, don't forget that the US often does stuff like hand people over to another agency knowing they'll be tortured.

https://theintercept.com/2017/07/20/cameroonian-troops-tortu...

EDIT: Don't forget that NSA acquires data to create actionable intelligence that can be passed onto another actor. Whatever you think about them, their work is being used in many cases ultimately by another agency or government.

Re: The NSA called me after midnight and requested my source code (2018)

#115

Post by rcoveson »

selykg wrote: post #85
rcoveson wrote: post #41

Earlier quoted context omitted.

> Your security should never depend upon security of your source code. For sure. I don't think it's about that, though. Even if the application in question were open source, if the project lead is willing to cooperate in any way their government asks, they could probable ensure the existence of a back door. For this reason, where possible, I would prefer to use encryption software written by people who are principled…

Being willing to provide source code is entirely different than inserting a backdoor or purposefully holding back security updates. One should have zero impact, as I said, modern crypto algorithms do not depend on keeping the algorithm secret to maintain security. Implementation can absolutely be full of bugs that are incorrectly using crypto primitives though. The other has a direct impact on security. I don't think…

Source availability helps in crafting successful exploits in the real world.

Providing the source of a closed source project to an adversary so that they can break your software is nefarious.

If the author's justification was...

"My crypto implementation is perfect. There are no bugs in my code, so providing source code (which the user community does not have) to an adversary does not have any effect on any user's security."

...then the author is simply incompetent, not malicious. But I am not inclined to accuse the author of such incompetence.

Re: The NSA called me after midnight and requested my source code (2018)

#116

Post by jaywalk »

lb1lf wrote: post #103
jaywalk wrote: post #87

Earlier quoted context omitted.

I can't even imagine there is a valid legal argument. If somebody calls me, I can say whatever I want. If I want to answer the phone by saying "Department of Defense, how can I help you?" the First Amendment guarantees me the right to do that. Now, I certainly could not call other people and claim to be the Department of Defense. That's fraud. The same applies if I had done something like put up flyers claiming my ph…

I am in Norway, so the First Amendment carries little weight around here; our equivalent is 'Article 100' (of the Constitution) stating pretty much the same thing as the First Amendment. (This is hardly relevant; I just grasped the opportunity to stress that the HN crowd resides in the most peculiar places...)

Ah, I just assumed you were in the US because we actually have a Department of Defense.

Re: The NSA called me after midnight and requested my source code (2018)

#117

Post by Talanes »

TomMckenny wrote: post #96

Since the source code could not help with decryption and the file was trivial to decrypt anyway, the NSA was either playing four dimensional chess that requires making a pointless midnight phone call or it's actually fallible. Rather than fairly justified suspicion of the NSA, we might want to apply Hanlon's razor in this case.

Agreed, the NSA is a large organization with many moving parts. If the guys who suddenly find themselves needing to break encryption have natural talents that lend themselves more toward tracking people down and talking things out of them, it makes perfect sense for them to start chasing some weird leads.

Re: The NSA called me after midnight and requested my source code (2018)

#118

Post by lakkal »

frollo wrote: post #36

This sounds like spy training from Burn Notice. Like, you have to get the source code of this program, from a guy who isn't at home right now and the whole budget of the operation is a just enough to buy a mug from our gift shop. Good luck Dave!

I bought an NSA mug at the National Cryptologic Museum in 2000 or so. I was amused when it developed cracks and started leaking around the time Snowden was just getting into the news.

Re: The NSA called me after midnight and requested my source code (2018)

#119

Post by burrows »

danilocesar wrote: post #82
burrows wrote: post #4

Earlier quoted context omitted.

Only works if the 411 call was MiTMd. edit I was confused and my reply is confusing. I was trying to say that a third party could have stolen the source code by MiTMing the 411 call.

it doesn't need to be a MITM. He was called in a land line. The caller could just have pretended to hangout and faked tones when the author called back. I'm not saying that is what happened, but it's way easier than a real 411 MITM.

This doesn't explain getting a fake NSA number from 411.

Re: The NSA called me after midnight and requested my source code (2018)

#120

Post by rcoveson »

meowface wrote: post #76
rcoveson wrote: post #41

Earlier quoted context omitted.

> Your security should never depend upon security of your source code. For sure. I don't think it's about that, though. Even if the application in question were open source, if the project lead is willing to cooperate in any way their government asks, they could probable ensure the existence of a back door. For this reason, where possible, I would prefer to use encryption software written by people who are principled…

I'm pretty sure if the NSA asked him to add a backdoor, he wouldn't do it. (They already asked if he had an existing one, and he clearly realized how bad that would be if there was.)

That may well be true. But still, this story influences my _guess at the likelihood_ that this author would do so in the direction of "more likely."

Likelihood that the authors/owners of software are willing to cooperate, and capable of cooperating, with adversaries is an important metric for comparing options. Very high profile open source maintainers are less capable, due to the oversight of the community. Anarchist- or security-absolutist type personalities are less likely. The author and his project don't fit either bill.

I'm not arguing that this is the only metric that matters when considering one's options. But it does matter.

Post reply on HN