Live data from Hacker News

How to Protect Yourself from NSA Attacks on 1024-bit DH

eff.org

91–100 of 140 posts

Re: How to Protect Yourself from NSA Attacks on 1024-bit DH

#91

Earlier quoted context omitted.

And? They ought to be exposed and opposed. They serve at our pleasure, not the other way around.

> they serve at our pleasure No it actually doesn't and shouldn't. It would create a tyranny of the majority.

That my friend is called Democracy. When a majority rules..

Re: How to Protect Yourself from NSA Attacks on 1024-bit DH

#92

Earlier quoted context omitted.

That was the argument before Snowden, but we now know that the government passively records and stores as much information as possible on anyone. So they can build a secret file on anyone should they feel like it. And they'll use every piece of information at their disposal (private family life, shopping and travel habits, what websites you browse, what media you consume, etc.) to profile you. Ever download a copyrig…

> we now know that the government passively records and stores as much information as possible on anyone That's highly impratical. NSA's budget isn't infinite and they have many other operations that would also require funding.

Snowden demonstrates the way NSA and the British equivalent operate on demand* at the documentary film 'Snowden'. You should really skim through it at least, you will be surprised to what their finite budget can do.

* they collect bulk data, then develop the tools to sort them out

Re: How to Protect Yourself from NSA Attacks on 1024-bit DH

#93
post #3

The OpenVPN section is misleading. The dh option is only supported on the server side. If you try to use it on the client side (which is what this guide appears to be tailored towards) it will be ignored and you'll use whatever DH parameters the server provides.

It may be misleading but also in the sense that there's no recommendation to just drop VPN altogether. How about we just stop relying on terribly over-designed protocols such as VPN and IPSec? Complexity is the enemy of security.

Re: How to Protect Yourself from NSA Attacks on 1024-bit DH

#94
post #41
post #37

Earlier quoted context omitted.

> We don't know the NSA is doing this. There's no evidence whatsoever beyond conspiracy theory stuff. We don't know the NSA is not doing this. There is ample evidence that they do a lot more than we conspired about.

"We don't know the NSA is not doing this." Please look at what you wrote! Am I dreaming? This is the level of argument that is being used?

I'm assuming you believe in the passive intercept so this will focus on the 1024-bit prime. It is crackable with the NSA's leaked budget and it fits their mission. If you had the NSA's leaked budget, you could crack this. I could crack this. The budget is not astronomical and it could be cracked by dozens of governments your country doesn't get along with.

That's why it's important to defend against it because even if you trust the NSA, the attack is equally available to Russia / China / North Korea / your country's boogeyman-of-the-day. The whole global internet is under threat along with billions of dollars of eCommerce GDP.

Re: How to Protect Yourself from NSA Attacks on 1024-bit DH

#95
post #38

I get that NSA snooping is abusive if it's the norm. But who exactly would really want to protect themselves from the NSA? I mean ultimately, isn't the problem the NSA is snooping on people who aren't aware of it ? Why would someone try to hide itself from the NSA ? Is it just because it's a political principle or to just annoy the NSA and discourage them ? I mean wouldn't this help the bad guys more ?

People who know they are being watched change their thoughts and behavior either consciously or subconsciously.

If the government had cameras inside your house set to record 24x7 would you act any differently than you do today? Are you breaking any laws inside your home, if not, what are you trying to protect yourself from by refusing access?

Have you ever avoided visiting a website, searching for information on certain subjects, or held back writing something online that you felt strongly about because you were afraid of possible repercussions in the future?

If yes, then that is an example of the government eroding our rights which are protected by the first and fourth amendments. The right to privacy online is just as important as the privacy you enjoy (take for granted?) within your own home.

Re: How to Protect Yourself from NSA Attacks on 1024-bit DH

#96
post #37
post #31

Earlier quoted context omitted.

"If we all use a single "strong" prime number with our crypto then the NSA has a huge incentive to pre-compute results from that single strong number. Now that we know that the NSA is doing this" We don't know the NSA is doing this. There's no evidence whatsoever beyond conspiracy theory stuff.

> We don't know the NSA is doing this. There's no evidence whatsoever beyond conspiracy theory stuff. We don't know the NSA is not doing this. There is ample evidence that they do a lot more than we conspired about.

[deleted]

Re: How to Protect Yourself from NSA Attacks on 1024-bit DH

#97
post #33
post #7

Earlier quoted context omitted.

FWIU of the situation, we have reason to suspect the government has 'cracked' the default large primes that are commonly used by a bunch of different software packages, including web servers. Assuming they have, the challenge is then defined as determining which applications and sites tend to use these standardized or hard-coded primes. > Breaking a second 1024-bit prime would allow passive eavesdropping on connectio…

"FWIU of the situation, we have reason to suspect the government has 'cracked' the default large primes that are commonly used by a bunch of different software packages, including web servers." This is just nonsense. Am I the only sane one here? Can no-one else see that the response is hysterical? There's no evidence whatsover that any of this has happened. It's conspiracy conjecture. Look, I know the cultural narrat…

> nonsense ... the only sane one here ... hysterical ... conspiracy conjecture ... the cultural narrative ... all-seeing eye ... sensible ... conspiracy

Nearly this entire comment is name-calling in the sense of the HN guidelines when they say: When disagreeing, please reply to the argument instead of calling names. E.g. "That is idiotic; 1 + 1 is 2, not 3" can be shortened to "1 + 1 is 2, not 3."

When posting to HN, please edit that out and stick to the substance.

https://news.ycombinator.com/newsguidelines.html

Re: How to Protect Yourself from NSA Attacks on 1024-bit DH

#98
post #11

Anyone have a way to fix up Safari on OS X 10.11?

You can't fix this on the client side, but on the server side.

I'm confused. They included instructions for updating Firefox and Chrome (web browser clients) to remove support for the older cipher suites. I was asking if there was a way to do the same for Safari.

Re: How to Protect Yourself from NSA Attacks on 1024-bit DH

#100
post #19

If you use "Chromium" on linux instead of "Chrome" you can do this; (create a shortcut with this command) chromium --cipher-suite-blacklist=0x0033,0x0039,0x009E,0xcc15 Also if you use Nginx web browser; (read this article) https://raymii.org/s/tutorials/Strong_SSL_Security_On_nginx....

Nginx is a server, not a browser.
Post reply on HN