Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A brief history of the U.S. trying to add backdoors into encrypted data (2016)

atlasobscura.com

Post reply on HN
Print view View original

41–50 of 207 posts

Re: A brief history of the U.S. trying to add backdoors into encrypted data (2016)

#41

Post by charcircuit »

loughnane wrote: post #2

This topic comes up a bunch still. Someone please correct me, but as I understand it anyone using new chips that use Intel ME (or AMD's equivalent) have a gaping hole in their security that no OS can patch. I know puri.sm[0] takes some steps to try to plug the hole, but haven't read up to see if it's effective or no. [0] https://puri.sm/learn/intel-me/

>but as I understand it anyone using new chips that use Intel ME (or AMD's equivalent) have a gaping hole in their security that no OS can patch.

The existence of security coprocessors is not a security hole and firmware updates to these processors can be released if a security issue was found.

Re: A brief history of the U.S. trying to add backdoors into encrypted data (2016)

#43

Post by mmaunder »

Honorable mention for the ITAR regs that prevented Phil Zimmerman from exporting PGP 128 bit encryption until Zimmerman and MIT press printed the source as a book protected by the first amendment, exported it, and this enabled others to OCR it, and recompile it offshore.

Also that ITAR enabled Thawte in South Africa (where I’m from) as a business to completely dominate sales for 128 bit SSL certs outside the US. Thawte was eventually acquired by Verizon for $600 million and the founder Mark Shuttleworth used the cash to become an astronaut and then founded Ubuntu.

Re: A brief history of the U.S. trying to add backdoors into encrypted data (2016)

#44

Post by Onavo »

loughnane wrote: post #2

This topic comes up a bunch still. Someone please correct me, but as I understand it anyone using new chips that use Intel ME (or AMD's equivalent) have a gaping hole in their security that no OS can patch. I know puri.sm[0] takes some steps to try to plug the hole, but haven't read up to see if it's effective or no. [0] https://puri.sm/learn/intel-me/

Does Apple have a warranty canary? How do we know that the M series of chips haven't been compromised?

Re: A brief history of the U.S. trying to add backdoors into encrypted data (2016)

#45

Post by meroes »

xyst wrote: post #31

for a long time, the US considered cryptography algos as a munition. Needed some arms license to export. Also, US tried to convince the world only 56 bits of encryption was sufficient. As SSL (I don’t think TLS was a thing back then) was becoming more mainstream, US govt only permitted banks and other entities to use DES [1] to “secure” their communications. Using anything more than 56 bits was considered illegal. ht…

Do you have more on the legality aspect? I knew NSA pressured for a weaker key but what aspect could be made illegal? I had to write an undergrad paper on the original DES and I never saw an outright illegality aspect but wouldn’t be surprised. They also put in their own substitution boxes which I surprisingly never found much info on how exactly NSA could use them. So much speculation but why no detailed post mortems in the modern age?

Re: A brief history of the U.S. trying to add backdoors into encrypted data (2016)

#46

Post by wtallis »

loughnane wrote: post #38
wtallis wrote: post #29

Earlier quoted context omitted.

Most consumer products (as opposed to some of those marketed to businesses) don't have enough of the components in place for the ME to accomplish anything, good or bad.

What do you mean? What sort of components?

For starters, few consumer systems have the ME wired up to a supported Intel NIC to provide the remote access functionality that is usually seen as the scariest feature among those related to the ME. The processors are usually not vPro-enabled models so the firwmare will refuse to enable those features due to Intel's product segmentation strategy. And even if all the right hardware is in place, I think a system still needs to be provisioned by someone with physical access to turn on those features.

For most consumers, the main valid complaint about the ME is that it's a huge pile of unnecessary complexity operating at low levels of their system with minimal documentation. Anything fitting that description is a bit of a security risk, but the ME is merely one of many of those closed firmware blobs.

Re: A brief history of the U.S. trying to add backdoors into encrypted data (2016)

#47

Post by lkdfjlkdfjlg »

mmaunder wrote: post #43

Honorable mention for the ITAR regs that prevented Phil Zimmerman from exporting PGP 128 bit encryption until Zimmerman and MIT press printed the source as a book protected by the first amendment, exported it, and this enabled others to OCR it, and recompile it offshore. Also that ITAR enabled Thawte in South Africa (where I’m from) as a business to completely dominate sales for 128 bit SSL certs outside the US. Thaw…

[flagged]

Re: A brief history of the U.S. trying to add backdoors into encrypted data (2016)

#48

Post by pgeorgi »

progbits wrote: post #19

As this is from 2016 it doesn't include this new fun revelation: > On 11 February 2020, The Washington Post, ZDF and SRF revealed that Crypto AG was secretly owned by the CIA in a highly classified partnership with West German intelligence, and the spy agencies could easily break the codes used to send encrypted messages. https://en.m.wikipedia.org/wiki/Crypto_AG

The CIA/BND connection wasn't known, but the collusion with certain agencies was known to different degrees for decades: https://en.wikipedia.org/w/index.php?title=Crypto_AG&oldid=7...

Re: A brief history of the U.S. trying to add backdoors into encrypted data (2016)

#49

Post by ETH_start »

For financial encryption, so essential is warrantless surveillance to their control of finance, that they've successfully argued that a neutral and immutable protocol instantiating open source code on a distributed public blockchain is property of a sanctionable entity, and thus within their authority to prohibit Americans from using:

https://cases.justia.com/federal/district-courts/texas/txwdc...

Re: A brief history of the U.S. trying to add backdoors into encrypted data (2016)

#50

Post by Hikikomori »

coppsilgold wrote: post #4

FBI director James Comey have publicly lobbied for the insertion of cryptographic “backdoors” into software and hardware to allow law enforcement agencies to bypass authentication and access a suspect’s data surreptitiously. Cybersecurity experts have unanimously condemned the idea, pointing out that such backdoors would fundamentally undermine encryption and could exploited by criminals, among other issues. "could e…

Are they lobbying for this because they can't access stuff today and "need" it or is just a psyop so we believe what that they cannot access it today.
Post reply on HN