Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

_NSAKEY

en.wikipedia.org

Post reply on HN
Print view View original

101–110 of 118 posts

Re: _NSAKEY

#101

Post by [deleted] »

clachance wrote: post #77
zelon88 wrote: post #46

Earlier quoted context omitted.

Relevant... [1] > Ken describes how he injected a virus into a compiler. Not only did his compiler know it was compiling the login function and inject a backdoor, but it also knew when it was compiling itself and injected the backdoor generator into the compiler it was creating. The source code for the compiler thereafter contains no evidence of either virus. [1] https://wiki.c2.com/?TheKenThompsonHack

This has always impressed me, I'd love to peek the code and try to read it but I highly doubt I'd be proficient enough to understand it.

[deleted]

Re: _NSAKEY

#102

Post by ta999999171 »

mlyle wrote: post #87
tribaal wrote: post #70

Earlier quoted context omitted.

I think that's the point the comment you are replying to made: if it was legitimately a microsoft key that just serves a different purpose, it would be trivial for microsoft to prove it by just signing a message or anything with the corresponding private key. The fact that they haven't reinforces the argument that they don't own the private key (likely, the NSA does as the conspiracy goes)

> it would be trivial for microsoft to prove it by just signing a message or anything with the corresponding private key. It would also be trivial for Microsoft to call up the NSA and say "they're ON TO US and it looks bad to our customers, can you please sign this message?" That is, the test you suggest proves nothing-- you can't prove that only you hold a private key.

FISA orders only work one way.

Re: _NSAKEY

#104

Post by ta999999171 »

jki275 wrote: post #95
mrguyorama wrote: post #92

Earlier quoted context omitted.

The NSA has built absolutely fuck off massive datacenters in multiple places in the United States. The parent is suggesting the telemetry from Windows 10 is mostly getting passed off to the NSA

That's a nice conspiracy theory, but that doesn't make it any less absurd.

^Willful ignorance.

Sorry, but if you've been reading, there's just no other explanation.

Re: _NSAKEY

#105

Post by ta999999171 »

jki275 wrote: post #95
mrguyorama wrote: post #92

Earlier quoted context omitted.

The NSA has built absolutely fuck off massive datacenters in multiple places in the United States. The parent is suggesting the telemetry from Windows 10 is mostly getting passed off to the NSA

That's a nice conspiracy theory, but that doesn't make it any less absurd.

Props for at least knowing the difference between a conspiracy and a conspiracy theory, though, unlike half of the internet.

Re: _NSAKEY

#106

Post by an_d_rew »

One thing to remember is the fear that surrounded the export of cryptographic technology from the US and ITAR and all the rest of it at the time. And then there was the whole key escrow fiasco with Lotus Notes.

So just be careful viewing the incident from 2020 with the purported benefit of decades of hindsight.

Disclaimer: I’m the guy who first found it and announced it at the rump session of the Crypto conference in Santa Barbara that year...

Re: _NSAKEY

#107

Post by Sean1708 »

peter_d_sherman wrote: post #86
Sean1708 wrote: post #20

Earlier quoted context omitted.

That's a seperate key, which doesn't seem to have an interesting name, not _NSAKEY: > In addition, Dr. Nicko van Someren found a third key in Windows 2000, which he doubted had a legitimate purpose, and declared that "It looks more fishy".

https://en.wikipedia.org/wiki/Nicko_van_Someren Excerpt: "Van Someren has published numerous papers in the field of computer security. In 1998 he co-authored a paper[13] with Adi Shamir introducing the concept of key finding attacks. A statistical key finding attack was used by van Someren to locate the signature verification keys used by Microsoft to validate the signatures on MS-CAPI plug-ins. One of these key was…

I'm not entirely sure what your point is here, but the fact of the matter remains that the key that is being referred to in ryanlol's quote is not _NSAKEY.

Re: _NSAKEY

#108

Post by mtgx »

jki275 wrote: post #95
mrguyorama wrote: post #92

Earlier quoted context omitted.

The NSA has built absolutely fuck off massive datacenters in multiple places in the United States. The parent is suggesting the telemetry from Windows 10 is mostly getting passed off to the NSA

That's a nice conspiracy theory, but that doesn't make it any less absurd.

You mean just like the carriers passing the data through their cables to specially made "NSA forts" is absurd?

https://theintercept.com/2018/06/25/att-internet-nsa-spy-hub...

I actually didn't say that Microsoft is directly passing all the data to NSA, just that the NSA (and FBI, and DEA, and IRS, etc) can request that data on anyone at anytime, and it's half of the time a secret request with a gag order.

But now that you mention it, there is a non-zero chance that Microsoft could pass some of the data directly to the US government, too, but maybe just for some services, like Skype.

Also "all that telemetry data" is probably counted in tens or hundreds of TBs a year, which is nothing for a company like MS or an agency like the NSA. Telemetry doesn't take that much space, just a few strings for each event.

Are you completely unaware of the fact that Microsoft does collect telemetry on every app you open, every file you have on your PC, every search you do (locally), and other stuff like that? Because that's exactly what they're doing -- Bing it, if you will. Do you think they're tracking all that data without actually storing it and analyzing it?

Re: _NSAKEY

#109

Post by arminiusreturns »

wahern wrote: post #100
arminiusreturns wrote: post #54

Earlier quoted context omitted.

Coincidence theories tend to hinge on the idea that everyone is incompetent and that nobody could ever collude together in secret for any sort of malicious or self interested purpose.

They hinge on the idea that the greater the value of T or N, the less likely a conspiracy will remain a secret, where T is time and N is the number of conspirators. N is usually the dominate factor.

I think there are many obvious weaknesses to this line of logic. There is some merit there, but it oversimplifies the subject in the extreme.

Re: _NSAKEY

#110

Post by xg15 »

CrazyStat wrote: post #26
xg15 wrote: post #12

Earlier quoted context omitted.

But if it's really the key to a backdoor, it has to be used somewhere in the code. E.g., some part of Windows had to check something signed with the key or encrypt something with it.

Windows used _NSAKEY (and another key) to check that Cryptographic Service Providers are signed. Otherwise it wouldn't allow them to be used. This was explained in the article.

Ah, apologies. I didn't catch that part.
Post reply on HN