Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Snowden leak: Cavium networking hardware may contain NSA backdoor

twitter.com

Post reply on HN
Print view View original

311–320 of 628 posts

Re: Snowden leak: Cavium networking hardware may contain NSA backdoor

#311

Post by slt2021 »

drexlspivey wrote: post #196
JanSolo wrote: post #6

The tweet seems to imply that the entire Ubiquiti Networks line of network hardware could be compromised. That's a shame; I was thinking of installing some in my house. I'm sure that Ubiquiti's customers will not be happy if they find out that the US Govt can access their private data.

Trying to understand what crypto is the network hardware itself performing? TLS is end to end, even if you run a VPN on the router the keys were not generated there probably

crypto doesn't matter if chip itself has backdoor that will grant root access on some "magic" packet

Re: Snowden leak: Cavium networking hardware may contain NSA backdoor

#312

Post by hiatus »

TheRealDunkirk wrote: post #258
api wrote: post #52

Earlier quoted context omitted.

Is there anyone here who actually thought cloud provider HSMs were secure against the provider itself or whatever nation state(s) have jurisdiction over it? It would never occur to me to even suspect that. I assume that anything I do in the cloud is absolutely transparent to the cloud provider unless it's running homomorphic encryption, which is still too slow and limited to do much that is useful. I would trust them…

> If your threat model includes... At my Fortune 250, our threat model apparently includes -- rather conveniently and coincidentally -- everything! Well, everything they make an off-the-shelf product for, anyway. It makes new purchasing decisions easy: "Does your product make any thing, in any way, more secure?" "Uh... Yes?" "You son of a bitch. We're in. Roll it out everywhere. Now."

There's no thought given to if the cost to secure the thing outweighs the risk of exposure?

Re: Snowden leak: Cavium networking hardware may contain NSA backdoor

#313

Post by hammock »

acdha wrote: post #103
hammock wrote: post #34

Earlier this year, a man was sentenced to prison for six years for stealing Ubiquiti data that the NSA also apparently can steal. https://www.justice.gov/usao-sdny/pr/former-employee-technol...

Leaving out the extortion part makes it very hard to read your comment as being made in good faith.

Learn about Qwest if you think NSA doesn't also extort to get what they want: https://www.eff.org/deeplinks/2007/10/qwest-ceo-nsa-punished...

Re: Snowden leak: Cavium networking hardware may contain NSA backdoor

#314

Post by dizhn »

13of40 wrote: post #217
squarefoot wrote: post #60

When I buy something electronic, my approach is "everything that is closed and goes online will be used to spy on people". It may seem a stretch, but governments can't exercise power over something they cannot control, and truly private communications would take away some of that control. To me there are no conspiracy theories or other strange reasons for being able to decrypt any seemingly private information except…

"If it's technically possible, they're doing it." It's their job.

If it exists, they're buying it. (States)

Re: Snowden leak: Cavium networking hardware may contain NSA backdoor

#315

Post by SamPatt »

archontes wrote: post #253
squarefoot wrote: post #60

When I buy something electronic, my approach is "everything that is closed and goes online will be used to spy on people". It may seem a stretch, but governments can't exercise power over something they cannot control, and truly private communications would take away some of that control. To me there are no conspiracy theories or other strange reasons for being able to decrypt any seemingly private information except…

It's clear that they feel that way also. The engineer Andreas Spiess recently appeared in a briefing on dangerous, anarchy-enabling technologies simply for making a youtube video on an encrypted messaging protocol over lora mesh networking. They're carefully watching and cataloging any communications technology they can't compromise.

The guy with the Swiss accent?

What's your source on this?

Re: Snowden leak: Cavium networking hardware may contain NSA backdoor

#316

Post by theropost »

perihelions wrote: post #2

How the NSA successfully manage to prevent the Washington Post and friends from discovering and reporting on this malicious backdoor? They've been sitting on these documents for a decade. Are the journalists just that *uncurious* about the deep contents of the documents they hold exclusive access to? Was this some kind of organizational failing?

Lack of real journalistic resources - Meta has more "journalists" then the Washington Post.

Re: Snowden leak: Cavium networking hardware may contain NSA backdoor

#318

Post by jacquesm »

outworlder wrote: post #193
enkid wrote: post #65

Earlier quoted context omitted.

If your threat model includes the nation state where you physical infrastructure is, you're hosed.

> If your threat model includes the nation state where you physical infrastructure is, you're hosed. True. But even if you trust your nation state 100%, having a backdoor means you now have to worry about it falling into the wrong hands.

Even if you trust your nation state 100% having a backdoor means it has already fallen into the wrong hands. That's because 'nation state' is not synonymous with 'people running the nation state'.

Re: Snowden leak: Cavium networking hardware may contain NSA backdoor

#319

Post by jacquesm »

ipaddr wrote: post #213
api wrote: post #70

Earlier quoted context omitted.

Literally hosed. There's a funny jargon term "rubber hose cryptography" that's used to refer to the cryptanalysis method where you beat someone with a rubber hose until they give you the key. It's 100% effective against all forms of cryptography including even post-quantum algorithms.

You would be surprised that for a percent this would not work. Some even like it. Some have a deathwish and want to be a martyr. Some people blow themselves up to further a cause. Also put under heavy stress memories of keys cannot be recalled at times. It's probably slightly less effective than threatening to kill family members but probably more than threat of jail time. Either way you require someone alive and wit…

We're talking about normal people, not psychopaths.

Re: Snowden leak: Cavium networking hardware may contain NSA backdoor

#320

Post by jacquesm »

ibejoeb wrote: post #221
hn_version_0023 wrote: post #118

Earlier quoted context omitted.

I always giggle a little when really smart people forget thugs exist and do what they’re told. If that includes breaking the knees of M people to get what they’re after, then M pairs of knees are gonna get destroyed. This isn’t hard to understand, but it’s easy to forget our civilization hangs by a thread more often than any of us care to admit.

I don't remember the provenance of the quip, but somewhere at a def con or a hope, I heard, "The point of cryptography is to force the government to torture you."

They're perfectly ok with that, and depending on where you live this may happen in more or less overt ways. If the government wants your information, they will get your information. Your very best outcome is to simply rot in detention until you cough up your keys.
Post reply on HN