Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The NSA called me after midnight and requested my source code (2018)

medium.com

Post reply on HN
Print view View original

141–150 of 219 posts

Re: The NSA called me after midnight and requested my source code (2018)

#141

Post by vaguesortof »

lb1lf wrote: post #49

I drew the ire of our security services in a much dumber way sometime in the early nineties; after having seen Wargames, I set up my MicroVAX, rescued from a dumpster at the local bank, to ID as a DoD box whenever any of my friends dialled into it. A few weeks into this, I get a summons to get down to the local police station ASAP. The commissioner then gives me a good verbal beating for being such a stupid kid; appa…

What do you mean 'id as a DOD box'? Do you mean hostname/splash screen/ip .... I'm missing something

Re: The NSA called me after midnight and requested my source code (2018)

#142

Post by selykg »

rcoveson wrote: post #115
selykg wrote: post #85

Earlier quoted context omitted.

Being willing to provide source code is entirely different than inserting a backdoor or purposefully holding back security updates. One should have zero impact, as I said, modern crypto algorithms do not depend on keeping the algorithm secret to maintain security. Implementation can absolutely be full of bugs that are incorrectly using crypto primitives though. The other has a direct impact on security. I don't think…

Source availability helps in crafting successful exploits in the real world. Providing the source of a closed source project to an adversary so that they can break your software is nefarious. If the author's justification was... "My crypto implementation is perfect. There are no bugs in my code, so providing source code (which the user community does not have) to an adversary does not have any effect on any user's se…

So you’re saying open source projects are less secure than closed source.

You might be the only person around here to ever try that argument in public.

Re: The NSA called me after midnight and requested my source code (2018)

#143

Post by marcosdumay »

remcob wrote: post #139
MR4D wrote: post #47

If you read the article (you should - it's a good one and well written), then you should also read the comments. My favorite nugget from the comments: "I hope you’re keeping that mug in an opaque Faraday cage, well grounded."

I know it's a joke but: Mugs have a tendency to be put in microwaves, making them a dangerous place for electronics. If you find yourself receiving a questionable mug, time for a glass of warm milk.

Microwave ovens are not that horrible against bipolar transistors. They are completely lethal for MOS-FETs, but one can make electronics that survive it.

Re: The NSA called me after midnight and requested my source code (2018)

#144

Post by aspenmayer »

jaywalk wrote: post #87
jessaustin wrote: post #77

Earlier quoted context omitted.

I can see why that would have been intimidating. With the decades of experience you've had since, do you think he could have gotten your landline terminated? What would be the legal argument?

I can't even imagine there is a valid legal argument. If somebody calls me, I can say whatever I want. If I want to answer the phone by saying "Department of Defense, how can I help you?" the First Amendment guarantees me the right to do that. Now, I certainly could not call other people and claim to be the Department of Defense. That's fraud. The same applies if I had done something like put up flyers claiming my ph…

There are laws against representing yourself as military (active or former) when you are not a member; these laws are pretty narrow in scope and likely would not affect you answering the phone in this manner. Another concern is to avoid (mis)representing yourself as any kind of law enforcement or emergency services involved capacity, as I believe there are federal regulations forbidding this.

I'd be more concerned with making false statements to federal agents, which is a crime, when answering the phone using those words. At that point in the call, you are announcing yourself and making verifiable statements, although in jest. But if you're talking to someone who wants to ruin your weekend, they will find a way to do so.

Re: The NSA called me after midnight and requested my source code (2018)

#145

Post by mratsim »

hinkley wrote: post #50
stevep98 wrote: post #39

Earlier quoted context omitted.

At that time, if you made software available for export (and that included making a version freely downloadable), it was limited by law to 40 bits.

The practice of looking up algorithms by name dates back to that same time. The phrasing of the law, since they were treated as munitions, was that you couldn't even export something that was designed to have crypto bolted on. So you made it so anything could be bolted on and some of them just happened to be crypto. The legacy being things like the blacklist/whitelist discussion we had the other day about case sensit…

But books had exemptions and you could export crypto as long as it was printed on a book

Re: The NSA called me after midnight and requested my source code (2018)

#146

Post by mratsim »

ebg13 wrote: post #108
folli wrote: post #104

Earlier quoted context omitted.

Kerckhoff's principle applies. Nowadays, all the good encryption software is open source anyway. https://en.wikipedia.org/wiki/Kerckhoffs%27s_principle

> Kerckhoff's principle applies That's true and yet unhelpful because all software has errors, some obvious, some not.

Cryptographic software is at the very least audited, at the very best formally verified (i.e. proven bug-free).

And now you can use proof assistants that are used to prove mathematical formulas to generate crypto code: https://github.com/mit-plv/fiat-crypto

Re: The NSA called me after midnight and requested my source code (2018)

#148

Post by Libeste »

meowface wrote: post #75
code4tee wrote: post #13

Interesting story, but wouldn’t be surprised if the real play here was to get his source code so they could get some bad guys to use a modified version that the NSA could crack. Put a back door in and then intercept traffic trying to download the encryption app to download the back-doored version. The fact that the NSA has to call him in the middle of the night to learn that the free version didn’t use strong encrypt…

I doubt it. For one, how could they expect to distribute it in a way that a bad guy was more likely to download than by going to the official site? But also, if they did want to do that, they could probably backdoor it pretty easily just by patching the binary a bit. Reverse engineering and changing binaries is way easier than cracking encryption, and they probably have some of the world's top reverse engineers. The…

>For one, how could they expect to distribute it in a way that a bad guy was more likely to download than by going to the official site?

The original is both pay to own and not available outside of the US. So changing either of those things would work.

Re: The NSA called me after midnight and requested my source code (2018)

#149

Post by yakaccount4 »

ta1771 wrote: post #109
nemacol wrote: post #88

Earlier quoted context omitted.

There is no foil on my head, but ... it is very reasonable to be paranoid, right? They are not talking about the Office of Information and Regulatory Affairs or the Office of the Comptroller of the currency... It is a comment on the NSA. From what we know, everything they do is a bit creepy. Far from "All government is bad" ... The comment is about an agency that Snowden warned us about. Also, historically speaking t…

> There is no foil on my head, but Good thing, because this would amplify radio frequencies. This trope needs to die.

Doesn't that make the joke even better?

Re: The NSA called me after midnight and requested my source code (2018)

#150

Post by RandomBacon »

bayouborne wrote: post #56

My first job in the early '80's was for a phototypesetter manufacturer. Logically, the NSA had one of our machines for in-house use. Whenever there was a issue with the machine I flew up to Virginia to look at it. My experience was roughly the same as the article's, super-nice people, all of us immediately on a first name (only) basis. The two kind of uniquely funny things about those visits was 1) that the machine (…

Maybe it was just kept in that room while you worked on it. Perhaps that's the room where they move equipment that needs servicing so they only have to secure one route and room for technicians to use.
Post reply on HN