Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Snowden leak: Cavium networking hardware may contain NSA backdoor

twitter.com

Post reply on HN
Print view View original

371–380 of 628 posts

Re: Snowden leak: Cavium networking hardware may contain NSA backdoor

#371

Post by throwawayq3423 »

the-dude wrote: post #114
hangonhn wrote: post #73

Earlier quoted context omitted.

It's quite a bit more subtle than that. News organization have their sources that are in the intelligence community. They use each other. Sometimes the journalist wants to use their sources for information. Other times their sources feed them disinformation disguised as information. Other times they want a back channel to leak some real information but can't be seem as coming from a government source. Being a good jo…

I have no sources at hand, but I understood the FBI/CIA is embedded within every major news org in the US.

We live in a world where people believe things with no proof (therefore with no reason), but a little humility and less certainty might benefit the conversation.

Re: Snowden leak: Cavium networking hardware may contain NSA backdoor

#372

Post by irreticent »

mk89 wrote: post #304
squarefoot wrote: post #60

When I buy something electronic, my approach is "everything that is closed and goes online will be used to spy on people". It may seem a stretch, but governments can't exercise power over something they cannot control, and truly private communications would take away some of that control. To me there are no conspiracy theories or other strange reasons for being able to decrypt any seemingly private information except…

If that is the case they are doing a pretty s** job spying on people, considering the amount of harm being done to children (and people in general).

I wouldn't say they are doing a bad job spying on people for that reason; I think it's more likely that the reason they are spying is not to help children/people but rather to strengthen their control over the people. Knowledge is power and they want to be more powerful than everyone else. I've always assumed that the spying wasn't altruistic but more for selfish reasons.

Re: Snowden leak: Cavium networking hardware may contain NSA backdoor

#373

Post by jazzyjackson »

ibejoeb wrote: post #221
hn_version_0023 wrote: post #118

Earlier quoted context omitted.

I always giggle a little when really smart people forget thugs exist and do what they’re told. If that includes breaking the knees of M people to get what they’re after, then M pairs of knees are gonna get destroyed. This isn’t hard to understand, but it’s easy to forget our civilization hangs by a thread more often than any of us care to admit.

I don't remember the provenance of the quip, but somewhere at a def con or a hope, I heard, "The point of cryptography is to force the government to torture you."

power in numbers

can't torture us all!

Re: Snowden leak: Cavium networking hardware may contain NSA backdoor

#374

Post by eastbound »

aborsy wrote: post #360
api wrote: post #70

Earlier quoted context omitted.

Literally hosed. There's a funny jargon term "rubber hose cryptography" that's used to refer to the cryptanalysis method where you beat someone with a rubber hose until they give you the key. It's 100% effective against all forms of cryptography including even post-quantum algorithms.

This would not work well, because you can’t do it in a secret manner. Overuse of the rubber hose cryptography will become known, and there will be public backlash.

Seems like the NSA is threatening everyone of arrest (=state-organized violence) if they don’t secretly give them keys, and Snowden revealed it, and there is no public backlash.

Re: Snowden leak: Cavium networking hardware may contain NSA backdoor

#375

Post by hammock »

kube-system wrote: post #120
hammock wrote: post #56

Earlier quoted context omitted.

>Law firms aren't terribly entrepreneurial. Personal injury guys are the most entrepreneurial people I know...

And they make money by going after low-hanging fruit. Ever wonder why they advertise 90%+ success rates and work on contingency? Because if your case isn't easy, you aren't their customer.

If you are injured in a car accident and the insurance company is trying to screw you over, they seem like an important advocate

Re: Snowden leak: Cavium networking hardware may contain NSA backdoor

#376

Post by theamk »

joezydeco wrote: post #66
zimmerfrei wrote: post #46

More interestingly, Cavium (now Marvell) also designed and manufactured the HSMs which are used by the top cloud providers (such as AWS, GCP, possibly Azure too), to hold the most critical private keys: https://www.prnewswire.com/news-releases/caviums-liquidsecur...

Ayup. We use AWS CloudHSM to hold our private signing keys for deploying field upgrades to our hardware. And when we break the CI scripts I see Cavium in the AWS logs. Now I gotta take this to our security team and figure out what to do.

Nothing?

I mean, you are already in US-based cloud, so if NSA is interested, they will just request information directly, no backdoors needed.

(This is a good test for your security team, btw: if they say anything other that "we do nothing", you know its all security theater)

Re: Snowden leak: Cavium networking hardware may contain NSA backdoor

#377

Post by throwawayq3423 »

Clubber wrote: post #157
the-dude wrote: post #114

Earlier quoted context omitted.

I have no sources at hand, but I understood the FBI/CIA is embedded within every major news org in the US.

The twitter files showed government agencies were coercing Twitter into suppressing information. I would find it hard to believe they don't also coerce at newspapers, particularly with the cozy relationship they already have with "anonymous sources" from said agencies.

> The twitter files showed government agencies were coercing Twitter into suppressing information.

They very much did not. Twitter's own lawyers when pressed in court (the place where there are consequences for lying) admitted that nothing in the "Twitter Files" cited by Donald Trump actually show that the social media platform was a tool of government censorship.

https://storage.courtlistener.com/recap/gov.uscourts.cand.38...

Re: Snowden leak: Cavium networking hardware may contain NSA backdoor

#378

Post by anderiv »

sneak wrote: post #352
JanSolo wrote: post #6

The tweet seems to imply that the entire Ubiquiti Networks line of network hardware could be compromised. That's a shame; I was thinking of installing some in my house. I'm sure that Ubiquiti's customers will not be happy if they find out that the US Govt can access their private data.

Ubiquiti is all cloud based. If the government wants in to your auto-updating ubnt hardware, it's just a simple court order away. They don't need a backdoor.

It may be auto-updating by default, but that can be trivially disabled. Likewise, their cloud connectivity/management is optional. I'm running without issue multiple air-gapped Ubnt networks using their self-hosted controller software.

Re: Snowden leak: Cavium networking hardware may contain NSA backdoor

#379

Post by b112 »

jhallenworld wrote: post #339
amluto wrote: post #285

Earlier quoted context omitted.

…which is really weird. At least Google and Microsoft are quite outspoken about their in-house secure element technology. If nothing else, at Google/Amazon scale, I’d be concerned about a third-party HSM losing data.

It's not surprising because who wants to make their own FIPS 140-2 level 3 compliant key store device? Also, the Cavium one was the fastest one on the market the last time I looked at this. Thales, Safenet and IBM also had them..

Gotta be better than Utimaco HSM cards. I've worked with them, and have issues with them throwing false low power alarms, and wiping for no reason.

And tech support is horrible, incompetent.

Re: Snowden leak: Cavium networking hardware may contain NSA backdoor

#380

Post by IntelMiner »

baz00 wrote: post #143
joezydeco wrote: post #100

Earlier quoted context omitted.

We've had other issues with our CloudHSM instance, especially with the PKCS1.5 deprecation on January 1. And their support has been pretty dismal. Not expecting much from them at this point.

AWS support is pretty fucking terrible generally. We’re a very high rolling enterprise customer and it’s pretty obvious that some of their shit is being managed by two guys in a shed somewhere who don’t talk to each other.

As someone who was IN AWS premium support, I got the distinct impression they had no idea what they're doing

I was a Linux Sysadmin for a decade. They initially hired me to work on the "BigData" support team

Then after hiring threw me into CI/CD instead. I told them I don't know python or ruby and would be a terrible fit

I asked if I can join the Linux team. EC2 is bread and butter, that's easy stuff

"Oh we're actually shutting that team down soon. I'll move you into containers instead"

Spoiler: they didn't "shut down" the Linux group

Post reply on HN