Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The NSA called me after midnight and requested my source code (2018)

medium.com

Post reply on HN
Print view View original

81–90 of 219 posts

Re: The NSA called me after midnight and requested my source code (2018)

#81

Post by andrewflnr »

lb1lf wrote: post #49

I drew the ire of our security services in a much dumber way sometime in the early nineties; after having seen Wargames, I set up my MicroVAX, rescued from a dumpster at the local bank, to ID as a DoD box whenever any of my friends dialled into it. A few weeks into this, I get a summons to get down to the local police station ASAP. The commissioner then gives me a good verbal beating for being such a stupid kid; appa…

It's a shame the commissioner couldn't have had a bit more of a sense of humor about it. Except for him being a jerk the story is pretty much pure slapstick.

Re: The NSA called me after midnight and requested my source code (2018)

#82

Post by danilocesar »

burrows wrote: post #4
webmobdev wrote: post #3

Interesting read. I wonder whether this was an attempt at social engineering†? While we tend to think of the NSA (or other foreign agencies in this field) working on intercepting information only through electronic means, sometimes a direct approach is often easier (obligatory - xkcd: https://xkcd.com/538/ ). Perhaps all they wanted was the source code of his application to repackage (after introducing a backdoor) an…

Only works if the 411 call was MiTMd. edit I was confused and my reply is confusing. I was trying to say that a third party could have stolen the source code by MiTMing the 411 call.

it doesn't need to be a MITM.

He was called in a land line. The caller could just have pretended to hangout and faked tones when the author called back.

I'm not saying that is what happened, but it's way easier than a real 411 MITM.

Re: The NSA called me after midnight and requested my source code (2018)

#83

Post by leetcrew »

bsamuels wrote: post #62
ebg13 wrote: post #52

I can't help but feel like the author sounds excessively credulous. I had to stop reading after he wrote "I could tell something big was up and there simply wasn’t time to debate the merits of handing over my source code to the NSA", because at that point my eyes rolled so hard they fell right out the back of my head. After I put them back in, I skipped down to the comments. I have a hard time not agreeing vehemently…

I'm sorry but if you think the NSA is the shadiest government agency on the planet, then you live in an information bubble. Do you think the NSA is shadier than the KGB? What about the Iranian Revolutionary Guard? Or even the CIA? I know people are upset about the Snowden revelations but there are much graver sins that have been committed by other agencies.

how would you even know? you can only judge them by what they mess up and get caught doing.

Re: The NSA called me after midnight and requested my source code (2018)

#84

Post by rakoo »

bsamuels wrote: post #62
ebg13 wrote: post #52

I can't help but feel like the author sounds excessively credulous. I had to stop reading after he wrote "I could tell something big was up and there simply wasn’t time to debate the merits of handing over my source code to the NSA", because at that point my eyes rolled so hard they fell right out the back of my head. After I put them back in, I skipped down to the comments. I have a hard time not agreeing vehemently…

I'm sorry but if you think the NSA is the shadiest government agency on the planet, then you live in an information bubble. Do you think the NSA is shadier than the KGB? What about the Iranian Revolutionary Guard? Or even the CIA? I know people are upset about the Snowden revelations but there are much graver sins that have been committed by other agencies.

NSA might not be the shadiest, but it's definitely one of the shadiest. Doesn't change a thing about GP's comment.

Re: The NSA called me after midnight and requested my source code (2018)

#85

Post by selykg »

rcoveson wrote: post #41
selykg wrote: post #27

Earlier quoted context omitted.

Curious why... Your security should never depend upon security of your source code. If you're doing things correctly, then the source code doesn't change anything about the security of the data that is encrypted. Perhaps you mean that he chose to use 40-bit keys instead of 256-bit keys in the free version? I mean, I guess. But that's just a matter of better understanding the details. It sounds like he outlined this c…

> Your security should never depend upon security of your source code. For sure. I don't think it's about that, though. Even if the application in question were open source, if the project lead is willing to cooperate in any way their government asks, they could probable ensure the existence of a back door. For this reason, where possible, I would prefer to use encryption software written by people who are principled…

Being willing to provide source code is entirely different than inserting a backdoor or purposefully holding back security updates.

One should have zero impact, as I said, modern crypto algorithms do not depend on keeping the algorithm secret to maintain security. Implementation can absolutely be full of bugs that are incorrectly using crypto primitives though.

The other has a direct impact on security.

I don't think one blurs the line to the other, they're fundamentally different things.

If anything, this is further proof that you need to use crypto properly because it literally means someone with code in hands won't have any advantages in attempting to break that encryption.

To me anyway, someone willing to give source code to the NSA doesn't imply they'd be willing to do nefarious things. There's nothing inherently nefarious about giving the NSA source code.

That said, I can understand being skeptical, but people love to talk about how open source is more secure because it has eyeballs on it. But now we try to pull the "it's not secure because the source was given to the NSA"

It can't be both ways.

Re: The NSA called me after midnight and requested my source code (2018)

#86

Post by gist »

> But seriously, this laptop idiot was planning to blow up a building, or something equally as bad, but wasn’t smart enough or flush enough to pop for the $39.99 to step up to the maximum-strength encryption?

Says the developer who could have been social engineered to give away what he had done by being rushed in a way that others would perhaps call 'not smart enough'.

And where does the skill set of knowing about encryption come close to what someone needs to know in order to 'blow up a building'? Why would you expect that someone understands the difference or the risk? Or should? After all it's risky to begin with what they are doing. This is just another and different risk.

Now the question is if you were the NSA and of course I have no clue how they operate but maybe it would have made more sense to send the local police to a house to deliver the message AND the other part 'call this number' etc. And who knows how that could have been fake for that matter (it all hinged on calling 411 as being definitive and/or someone not intercepting a legit call). Sure someone could social engineer the local police to show up (I would think that would be easy for someone who knows how they operate or with whoever is on shift at that time).

Also the coffee cup is strange. Secretive agency but they send a gift as a thank you with their name so you have some kind of proof that allows you to detail how they operate and that they did this? Would make more sense that they got you to agree to not reveal they had requested the info not that they gave you some kind of bragging rights and story.

Re: The NSA called me after midnight and requested my source code (2018)

#87

Post by jaywalk »

jessaustin wrote: post #77
lb1lf wrote: post #49

I drew the ire of our security services in a much dumber way sometime in the early nineties; after having seen Wargames, I set up my MicroVAX, rescued from a dumpster at the local bank, to ID as a DoD box whenever any of my friends dialled into it. A few weeks into this, I get a summons to get down to the local police station ASAP. The commissioner then gives me a good verbal beating for being such a stupid kid; appa…

I can see why that would have been intimidating. With the decades of experience you've had since, do you think he could have gotten your landline terminated? What would be the legal argument?

I can't even imagine there is a valid legal argument.

If somebody calls me, I can say whatever I want. If I want to answer the phone by saying "Department of Defense, how can I help you?" the First Amendment guarantees me the right to do that.

Now, I certainly could not call other people and claim to be the Department of Defense. That's fraud. The same applies if I had done something like put up flyers claiming my phone number was related to the DoD or something like that.

I'm not a lawyer, but that's how I see it.

Re: The NSA called me after midnight and requested my source code (2018)

#88

Post by nemacol »

starpilot wrote: post #58
ebg13 wrote: post #52

I can't help but feel like the author sounds excessively credulous. I had to stop reading after he wrote "I could tell something big was up and there simply wasn’t time to debate the merits of handing over my source code to the NSA", because at that point my eyes rolled so hard they fell right out the back of my head. After I put them back in, I skipped down to the comments. I have a hard time not agreeing vehemently…

HN is so paranoid. All government is bad, anyone from a spy agency is some double/triple/quadruple agent who's actually a terrorist child soldier working for Facebook on the side.

There is no foil on my head, but ... it is very reasonable to be paranoid, right?

They are not talking about the Office of Information and Regulatory Affairs or the Office of the Comptroller of the currency... It is a comment on the NSA. From what we know, everything they do is a bit creepy. Far from "All government is bad" ... The comment is about an agency that Snowden warned us about.

Also, historically speaking the US government (various departments) has done a lot of really shady things.

"They" are not going to let us know all of the shenanigans they are up to. The list of mischievous things we are aware of surely isn't everything. Are we aware of 70%? 60%? I'm going to bet lower.

So you have a opaque organization with a fairly long list of misdeeds and (this is just my sense of things) a growing boldness. NSA programs, patriot act, etc - those are bold programs they have in place. Those are not the "top secret" things we don't get to know about.

It does not take a lot of imagination to make that leap.

Re: The NSA called me after midnight and requested my source code (2018)

#89

Post by leggomylibro »

bsamuels wrote: post #62
ebg13 wrote: post #52

I can't help but feel like the author sounds excessively credulous. I had to stop reading after he wrote "I could tell something big was up and there simply wasn’t time to debate the merits of handing over my source code to the NSA", because at that point my eyes rolled so hard they fell right out the back of my head. After I put them back in, I skipped down to the comments. I have a hard time not agreeing vehemently…

I'm sorry but if you think the NSA is the shadiest government agency on the planet, then you live in an information bubble. Do you think the NSA is shadier than the KGB? What about the Iranian Revolutionary Guard? Or even the CIA? I know people are upset about the Snowden revelations but there are much graver sins that have been committed by other agencies.

KGB doesn't exist anymore - you might mean the FSB or GRU?

Anyways, plenty of countries have security agencies whose main job is to violently protect the local kleptocrats these days. China might be a better example to point to for even worse behavior, with their balkanized net and mass surveillance being used to carry out the mass internment and repression of ethnic minorities in regions like Xinjiang.

Re: The NSA called me after midnight and requested my source code (2018)

#90

Post by lb1lf »

jessaustin wrote: post #77
lb1lf wrote: post #49

I drew the ire of our security services in a much dumber way sometime in the early nineties; after having seen Wargames, I set up my MicroVAX, rescued from a dumpster at the local bank, to ID as a DoD box whenever any of my friends dialled into it. A few weeks into this, I get a summons to get down to the local police station ASAP. The commissioner then gives me a good verbal beating for being such a stupid kid; appa…

I can see why that would have been intimidating. With the decades of experience you've had since, do you think he could have gotten your landline terminated? What would be the legal argument?

-I am quite convinced it was just meant to drive home the point that they were being serious about me changing the welcome message.

I do not think there is any legal way they could have severed my (well, my parents') phone service over such an issue - but then again, I had no desire to have to explain to my parents why the phone was dead, and promptly replaced the welcome with something along the lines of "This computer is so secret the DoD told the op not to ID it!" (Which, while rather flippant, was definitely true... Ah, the joys of being fifteen!)

Post reply on HN