Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How the CIA used Crypto AG encryption devices to spy on countries for decades

washingtonpost.com

Post reply on HN
Print view View original

111–120 of 353 posts

Re: How the CIA used Crypto AG encryption devices to spy on countries for decades

#111

Post by paganel »

jhart99 wrote: post #100
Someone1234 wrote: post #32

Earlier quoted context omitted.

I'm sure they were pressured, but the USG has deep pockets if they wanted someone to stop doing something they just throw a few million at them and call it done, there's far less chance of PR blowback then. Even just reading this article should show you that they kill you with kindness when they want to keep things hush-hush. If someone is developing a free tool, and are offered a retirement-tier payoff to stop, they…

I always assumed that this is exactly what happened to Skype and Whatsapp.

I’m in the exact same boat as you. I’m on mobile and lazy to post links, but Whatsapp’s acquisition was carried through a boutique investment bank which had former CIA director George Tenet on its board of directors. Anyway, I found a quick link about the bank [1], it’s called Allen & Co. And also let’s not forget that the precursor of Google Maps was funded with CIA venture capital money. I’m stil curious why and how the Russians let the Google StreetView car do its thing on the roads of Russia.

[1] https://www.fnlondon.com/articles/facebook-whatsapp-puts-all...

Re: How the CIA used Crypto AG encryption devices to spy on countries for decades

#112

Post by dmix »

netsec_burn wrote: post #99
NamTaf wrote: post #2

Reading between the lines on this, it's plainly apparent why there's been repeated attacks on encrpytion by the US government. From this, through RSA's Dual_EC_DRBG, to the present day, it's obvious that the US highly values rigging the deck to aid their decryption, and that the current democratisation of encrpytion protocols is a threat to them. I mean, you only need to read their repeated admissions that without MI…

Putting my tinfoil hat on, after reading the Snowden disclosures I'm convinced that they do have limited means of attacking encrypted communication but they would rather rely on these (expendable) means. Once they lose their crypto vulnerabilities it will force them to be even more overt.

The key difference is that decrypting something would likely need to be targeted and on a case-by-case basis, as it would take specialized work, as opposed to these sorts of attacks (much like tapping all of the pipes which transit data underseas or elsewhere, which still goes on in every country or working directly with the ISPs and mobile operators which happens in most countries) which allows mass dragnet surveillance.

I think most of us would be fine with the NSA doing what they do if it was targeted, like the police getting warrants to break privacy only in important cases for public safety.

The problem will always be mass interception. Not only domestically either, as there is nothing protecting any foreign communications being intercepted in the US (and I'm sure Five eyes+ bypasses these legal roadblocks whenever needed). Which is why the push for encrypt-everything is so important. But as we've seen repeatedly, even when investigating the president and his people, even the allegedly "significant domestic protections" offered by FISA are a joke and basically rubber-stamp.

WhatsApp and iMessage and other non-SMS communication as well as email providers finally adopting proper transit encryption probably has reduced the amount of this sort of unfiltered "intelligence" gathering by 90%+. But I'm sure there's still tons of mobile apps and websites which aren't doing things properly and are filling up their databases.

Re: How the CIA used Crypto AG encryption devices to spy on countries for decades

#113

Post by JoeSmithson »

netsec_burn wrote: post #99
NamTaf wrote: post #2

Reading between the lines on this, it's plainly apparent why there's been repeated attacks on encrpytion by the US government. From this, through RSA's Dual_EC_DRBG, to the present day, it's obvious that the US highly values rigging the deck to aid their decryption, and that the current democratisation of encrpytion protocols is a threat to them. I mean, you only need to read their repeated admissions that without MI…

Putting my tinfoil hat on, after reading the Snowden disclosures I'm convinced that they do have limited means of attacking encrypted communication but they would rather rely on these (expendable) means. Once they lose their crypto vulnerabilities it will force them to be even more overt.

What documents from the Snowden leaks convinced you of that?

Re: How the CIA used Crypto AG encryption devices to spy on countries for decades

#114

Post by brightball »

NamTaf wrote: post #2

Reading between the lines on this, it's plainly apparent why there's been repeated attacks on encrpytion by the US government. From this, through RSA's Dual_EC_DRBG, to the present day, it's obvious that the US highly values rigging the deck to aid their decryption, and that the current democratisation of encrpytion protocols is a threat to them. I mean, you only need to read their repeated admissions that without MI…

That thought is one reason why I've always questioned this advice:

"Don't roll your own encryption."

I've always understood the arguments for it but that the advice is so widespread seemed a little counter intuitive. It always seemed, to me at least, that having millions of encryption algorithms out there would be inherently more secure than a lot of people standardized on one because the risk to any one would be so compartmentalized by comparison.

Re: How the CIA used Crypto AG encryption devices to spy on countries for decades

#115

Post by smolder »

noelsusman wrote: post #95
apexalpha wrote: post #8

What a treat to read a well written piece based on decent research. It's a long read but well worth your time. Kudo's to the journalists who helped uncover it. And the 'coup of the century' is far from clickbait, it's definitionally warranted for what the CIA and BND did here. It's a little ironic as well, especially since the US is so keen on blocking Huawei over espionage concerns.

There's nothing ironic, weird, or surprising about the US wanting to stop other countries from doing to them what they do to other countries. It's hypocritical in some sense, mostly because the US tries to project itself as the good guys, but it's just basic international relations. That's how every country has always operated and will always operate.

People seem to take for granted that things like that will never change, but always is a very long time --much longer than modern history. I hope you don't just expect/accept that we should kill ourselves off as opposed to reaching some kind of sustainability.

Re: How the CIA used Crypto AG encryption devices to spy on countries for decades

#116

Post by thrwowman1 »

snowwrestler wrote: post #19

Gives you a sense of why the U.S. intelligence community is so nervous about having Huawei at the core of the domestic 5G network. Would not be fun for the U.S. to have done to them what they've done to others. And as a U.S. resident, even as I acknowledge and deplore what the U.S. intelligence services have done to others, I still don't want China to do that to me. This is not an area where equitable (but bad) treat…

Or maybe simply because the US intelligence not having a backdoor is why the're demonizing Huawei in Europe for example. That doesn't imply that Huawei does have a backdoor, simply that they'd not be able to spy anymore...

Re: How the CIA used Crypto AG encryption devices to spy on countries for decades

#117

Post by paulryanrogers »

RcouF1uZ4gsC wrote: post #80
edm0nd wrote: post #17

Earlier quoted context omitted.

I'm pretty sure the US government is why the TrueCrypt devs stopped all work. They got hit with a national security letter (NSL) or heavily leaned on and pressured to stop making their product so awesome and un-breakable.

From the TrueCrypt webpage: http://truecrypt.sourceforge.net/ > WARNING: Using TrueCrypt is not secure as it may contain unfixed security issues The fact that they use awkward wording that contains words whose first letters that start with NSA (not secure as) is pretty suggestive that you are right.

Indeed, a great call out. Props also to the French company sponsoring the Veracrypt fork.

Re: How the CIA used Crypto AG encryption devices to spy on countries for decades

#118

Post by saber6 »

tptacek wrote: post #28
apexalpha wrote: post #8

What a treat to read a well written piece based on decent research. It's a long read but well worth your time. Kudo's to the journalists who helped uncover it. And the 'coup of the century' is far from clickbait, it's definitionally warranted for what the CIA and BND did here. It's a little ironic as well, especially since the US is so keen on blocking Huawei over espionage concerns.

The fact that the US has repeatedly succeeded in SIGINT capers like this makes their concern about Huawei kind of un-ironic, right?

On the contrary. When you are a master of the dark arts, you can't help but see other practitioners around every corner.

Re: How the CIA used Crypto AG encryption devices to spy on countries for decades

#119

Post by kube-system »

criddell wrote: post #37
rebuilder wrote: post #35

Earlier quoted context omitted.

I'm not sure that makes sense. The US could compel the devs to compromise their product but not keep them from issuing a cryptic statement and stopping work on the product?

It doesn't make sense for two reasons to me. For one, the government can't compel you to do work. That's slavery. Also, it's open source software. TrueCrypt going down didn't change the security landscape at all.

> For one, the government can't compel you to do work. That's slavery.

That may be your personal opinion, but legally speaking, it is not true in any sense.

Re: How the CIA used Crypto AG encryption devices to spy on countries for decades

#120

Post by pjc50 »

OBFUSCATED wrote: post #83
pjc50 wrote: post #43

Earlier quoted context omitted.

Well, yes, but for third parties like the UK it makes it much more explicit that the choice is between the system that might be compromised by Huawei and the system that might be compromised by the US. Except the UK has its own little joint venture of security inspection of Huawei systems ...

please expand..

It's not a secret: https://www.gov.uk/government/publications/huawei-cyber-secu...

(On the other hand, it's not a very positive report! Lots of basic issues with build reproducibility and updates)

Post reply on HN