The NSA called me after midnight and requested my source code (2018) • Hacker News Board

Re: The NSA called me after midnight and requested my source code (2018)

#131

Post by kyuudou » Tue, Apr 21, 2020, 9:12 PM UTC

StillBored wrote: post #20

Well they do have mugs in the gift store, and the one in the third picture [1] from the end looks like a nice one, although not exactly the same. Of course the picture there is 16 years later. Sounds like a fun social engineering trick though, if you can subvert the local phone switch. Probably would make more of an impression if the FBI/etc knocked on your door and handed you the phone... [1] https://www.businessins…

I think I'd say "oh wow, gift exchange!" and hand them this: https://www.zazzle.com/the_nsa_parody_shirt-2357202944443361...

Re: The NSA called me after midnight and requested my source code (2018)

#132

Post by _not_the_nsa_ » Tue, Apr 21, 2020, 9:13 PM UTC

GlenTheMachine wrote: post #44

I have been to the NSA gift shop, and they do sell the blue mugs there. But you have to have the right clearances to even get to where the gift shop is...

This isn't true, unless it's changed in recent years. There's a gift shop at the Cryptologic museum on Ft. Meade. I've taken my folks there before, although I haven't worked there in almost a decade, so maybe it's not there anymore. There are gift shops inside the buildings though, but they sell the same stuff as the other one. You don't necessarily have to be cleared to get to those, you just have to have a reason to be in the building (i.e. interviewing)

Now the CIA has a gift shop you can't get to without being able to get into the building. ;)

Re: The NSA called me after midnight and requested my source code (2018)

#133

Post by jacobush » Tue, Apr 21, 2020, 9:15 PM UTC

secfirstmd wrote: post #43

partiallypro wrote: post #9

Earlier quoted context omitted.

I guess to be fair, this was in 2000. Before we knew the Snowden revelations, etc. I also wonder if he handed over just the source code to the shareware version or the full version? Also, nearly everything is open sourced now...so I guess it isn't the biggest boundary to cross?

We knew about Crypto AG and Echelon at this point though.

I knew about Echelon in 1998, but nobody I talked to would believe a word of it. (Or rather, I "knew" what other people ranted about on web pages with badly scanned photos of satellite dishes. But still.)

Re: The NSA called me after midnight and requested my source code (2018)

#134

Post by xenocyon » Tue, Apr 21, 2020, 9:15 PM UTC

superhuzza wrote: post #2

Certainly doesn't make me want to use any software made by this guy.

As others have pointed out, the source code isn't endangering the user(s).

Nonetheless, I agree with you. The writer appears emotionally swayed and flattered by the request, like a protagonist in a WWII-era young-adult novel ("Your country needs you!"), and is eager to satisfy the ask immediately without the slightest bit of skepticism or diligence. That's not the kind of temperament one would want an encryption software dev to have.

Re: The NSA called me after midnight and requested my source code (2018)

#135

Post by LatteLazy » Tue, Apr 21, 2020, 9:15 PM UTC

code4tee wrote: post #13

Interesting story, but wouldn’t be surprised if the real play here was to get his source code so they could get some bad guys to use a modified version that the NSA could crack. Put a back door in and then intercept traffic trying to download the encryption app to download the back-doored version. The fact that the NSA has to call him in the middle of the night to learn that the free version didn’t use strong encrypt…

Or some good guys to use that version...

Re: The NSA called me after midnight and requested my source code (2018)

#136

Post by tinus_hn » Tue, Apr 21, 2020, 9:19 PM UTC

superhuzza wrote: post #2

Certainly doesn't make me want to use any software made by this guy.

Better not use any software by Microsoft then. Also definitely none of that scary open source stuff by people who’ll just hand over the code to anyone who asks.

Re: The NSA called me after midnight and requested my source code (2018)

#137

Post by AmericanChopper » Tue, Apr 21, 2020, 9:21 PM UTC

TomMckenny wrote: post #96

Since the source code could not help with decryption and the file was trivial to decrypt anyway, the NSA was either playing four dimensional chess that requires making a pointless midnight phone call or it's actually fallible. Rather than fairly justified suspicion of the NSA, we might want to apply Hanlon's razor in this case.

I’ve had the pleasure of working in some organisations that had mountains of legacy applications that didn’t always have any source code. When I’ve had to fix bugs that involved those apps, reverse engineering them was always tedious and time consuming, and having the original engineers on hand to answer questions always sped things up. Regardless of the NSAs technical capabilities, it seems all he helped them do was something they could have done without his help, only faster.

Re: The NSA called me after midnight and requested my source code (2018)

#138

Post by rcoveson » Tue, Apr 21, 2020, 9:21 PM UTC

burrows wrote: post #127

rcoveson wrote: post #125

Earlier quoted context omitted.

If I ran an neighborhood ISP, and the cops asked me to spy on a neighbor (for reasons they wouldn't even provide), then I'd shut down first. If they just wanted to search _my_ stuff, sure. But if the only reason that I'm even capable of assisting the government in spying on somebody is that they are my customer, neighbor, friend, or user then I will not offer that assistance. That would be evil. Don't be evil.

The cops plant CP your servers. Help them spy on Joey Beer or they'll pursue criminal charges against you. Now what?

Gun to my head, would I still do the right thing?

Of course I'll say yes, and I hope it's true. Thankfully, I probably won't ever have to find out. But if it does come to that, and I choose wrong, I know I won't write a blog post about it.

Re: The NSA called me after midnight and requested my source code (2018)

#139

Post by remcob » Tue, Apr 21, 2020, 9:24 PM UTC

MR4D wrote: post #47

If you read the article (you should - it's a good one and well written), then you should also read the comments. My favorite nugget from the comments: "I hope you’re keeping that mug in an opaque Faraday cage, well grounded."

I know it's a joke but: Mugs have a tendency to be put in microwaves, making them a dangerous place for electronics.

If you find yourself receiving a questionable mug, time for a glass of warm milk.

Re: The NSA called me after midnight and requested my source code (2018)

#140

Post by rcoveson » Tue, Apr 21, 2020, 9:25 PM UTC

MichaelBurge wrote: post #126

rcoveson wrote: post #115

Earlier quoted context omitted.

Source availability helps in crafting successful exploits in the real world. Providing the source of a closed source project to an adversary so that they can break your software is nefarious. If the author's justification was... "My crypto implementation is perfect. There are no bugs in my code, so providing source code (which the user community does not have) to an adversary does not have any effect on any user's se…

Your argument is that withholding source code raises the cost of attack for the NSA. They'll have to buy expensive decompilers, hire competent assembly/C programmers, it'll take longer, etc. Seems like it would similarly be unethical for a local bakery to give the NSA a discount on cheesecake.

The NSA does a lot of things. A lot of them are good. Some of them are bad.

When the NSA asks you to help them do bad things, you say no. If you feel inspired to give them a cheesecake discount because of the good things they do, that is fine.