How the CIA used Crypto AG encryption devices to spy on countries for decades

Post by einpoklum » Wed, Feb 12, 2020, 9:07 PM UTC

dsl wrote: post #236

friendly_fren wrote: post #198

Earlier quoted context omitted.

A spy agency is necessary for the USA to compete on the world stage. Though, it's operations should be significantly limited. The CIA is a disaster that needs to be dismantled.

> The CIA is a disaster that needs to be dismantled. Working for the CIA is like being a sysadmin. The world only knows you exist when you fuck up. There was a great CCC talk recently that showed how one of the Vault 7 tools wasn't a remote assassination boogieman drone tool like Wikileaks framed it, but actually a control the CIA developed that allowed them to give anti-air weapons to friendlies in Syria and Ukraine…

Post by tptacek » Wed, Feb 12, 2020, 9:40 PM UTC

maqp wrote: post #333

tptacek wrote: post #179

Earlier quoted context omitted.

Lavabit was a service that effectively held keys for its users and was compelled to disclose them. If we were discussing whether a vulnerable service was somehow compelled by the USG, I wouldn't argue. I doubt you'd even need an NSL compromise Lavabit; you might even be able to do it with routine civil litigation. Don't ever use things like Lavabit. That's why we talk about "end to end encryption", as opposed to the…

Lavabit also sent the private keys from their servers to clients using TLS that utilized RSA for key exchange. Levison was to put it into a word, a fool, for letting that happen. Once he had to submit the private RSA-key for the certificate, FBI could decrypt every past session, and every private key of every user. IMO he'd have to put a hell of a lot of effort if I'm ever going to look at his creations again.

Post by shalmanese » Thu, Feb 13, 2020, 3:02 AM UTC

est31 wrote: post #109

jonathanpierre wrote: post #97

Earlier quoted context omitted.

Again: why do you use such belittling words like "conspiracy theory"? We know that the services interfere. We know that they interfered with vendors of cryptography products. And we know that National Security Letters exist, as do other – legal – means to pressure such vendors. There is no conspiracy needed for them to try to pressure someone by, say, threatening them with denial of a entry visa. Or they could have s…

> what would they have done if the suspect hadn't used his laptop in a public place? Screw open his laptop when it's turned off and he's away from home, install a keylogger into the bios. Put a camera onto the shelf to film which keys he types to log in. If he puts a blanket over his head: solely rely on the sound each key makes. Hack his computer remotely using one of the government owned 0days and dump the keys. Us…

Post by totalZero » Thu, Feb 13, 2020, 8:05 AM UTC

netsec_burn wrote: post #99

NamTaf wrote: post #2

Reading between the lines on this, it's plainly apparent why there's been repeated attacks on encrpytion by the US government. From this, through RSA's Dual_EC_DRBG, to the present day, it's obvious that the US highly values rigging the deck to aid their decryption, and that the current democratisation of encrpytion protocols is a threat to them. I mean, you only need to read their repeated admissions that without MI…

Putting my tinfoil hat on, after reading the Snowden disclosures I'm convinced that they do have limited means of attacking encrypted communication but they would rather rely on these (expendable) means. Once they lose their crypto vulnerabilities it will force them to be even more overt.

Post by Allower » Thu, Feb 13, 2020, 1:55 PM UTC