N.S.A. Foils Much Internet Encryption

Skripka said:
Bath Schools in Michigan 1927. Made huge news at the time.

You name it or can imagine it, it has happened somewhere. You just haven't read enough to know about it.

Not that I am in any way siding with the NSA in this, mind you.
Click to expand...

Suicidal Gay Dildo-ler. >.>

Anyway, Both sucks, but there is a difference when you give it up, and when it's taken. When it's taken, you can try to get it back or stop it. When you give it up, you chose to let it get taken.
 
So, what does this mean for American companies like Cisco? If I were a non-American company, I'd be looking to replace all that potentially compromised equipment ASAP. People are stuck using Windows and MacOS, of course.
 
Quartz-1 said:
So, what does this mean for American companies like Cisco? If I were a non-American company, I'd be looking to replace all that potentially compromised equipment ASAP. People are stuck using Windows and MacOS, of course.
Click to expand...

Isn't Ironic that Chinese Companies such as ZTE were accused of the same thing.. Lol. American Hypocracy know no bounds, ie Chemical Weapons use in Syria = Evil that must be stopped, yet Rumsfeld, Regan allowed the use of Chemical weapons in Iraq by Sadam again not only his own people but against a Sovereign Nation of Iran = Ok?

I hope that if USA attacks Syria I hope Russia atacks Saudi Arabia.Tit for Tat.
 
now wonder there was this big issue about some Chinese network-component manufacturer shipping parts to the USA... we probably been selling bugged network parts for decades.
 
Cerulean said:
I totally agree with you man. Legacy implementations (vendors need to get with the program and stop using antique configurations) and poor passwords.

Regarding poor passwords -- I think a new concept would have to be developed. Few will go as far as memorizing dynamic passwords composed of several parts, upper and lowercase, symbols, etcetera. Maybe that's why the average Joe Schmoe doesn't care about what the NSA is doing then? (Then it will be too late for Joe Schmoe to really make a difference; also, NSA probably has the upper hand in human intelligence with psychology and mathematics and infrastructural intel.)
Click to expand...

That's why there's LastPass, for the average Joe's of the world. It will generate the unmemorable passwords for you and insert them on the sites you need. I don't know any of my passwords by heart anymore, just my lastpass master password - which yes, needs to be quite strong, but at least its only one to have to remember.
 
fairlane said:
That's why there's LastPass, for the average Joe's of the world. It will generate the unmemorable passwords for you and insert them on the sites you need. I don't know any of my passwords by heart anymore, just my lastpass master password - which yes, needs to be quite strong, but at least its only one to have to remember.
Click to expand...

The problem fundamentally is that the entire password idea to validate accounts dates back to way back before we could computationally brute force or reverse look up via hash tables, and people were reduced to guessing by brain.

There's a great XKCD comic about password security that demonstrates this. https://xkcd.com/936/
 
Wrench00 said:
They don't have the cert keys if you are creating them on your own servers.

Most of my network have network wide encryption on the network layer anyway, so a packet snoop will still just get garbage.
Click to expand...

If your certs are self-signed, there are still ways around that. If your certs come from a third party CA, like Verisign or DigiCert, then yes, they would have those keys as well. As an update to all of this NSA encryption breaking news, Steve Gibson asserts that the NSA in fact does NOT have that capability. I've been tweeting with him today and he will be explaining his position on an upcoming podcast at twit.tv Also, read the article by Bruce Schneirer that Steve posted here today;
http://www.theguardian.com/commentisfree/2013/sep/05/government-betrayed-internet-nsa-spying
 
Skripka said:
The problem fundamentally is that the entire password idea to validate accounts dates back to way back before we could computationally brute force or reverse look up via hash tables, and people were reduced to guessing by brain.

There's a great XKCD comic about password security that demonstrates this. https://xkcd.com/936/
Click to expand...

That comic panel has been debunked by most of the security community. I wish it would die already. Even with our increasing computational power that occurs, its quite easy for the crypto to be just that more complex and be implemented to stay ahead of that computational curve, the fundamental problem is most of the Internet DOES NOT IMPLEMENT IT, especially on the server side, for either lack of knowledge, skill, inertia, etc.. E.g. when the AES cipher was pounded on a while back and erroneously reported that it was "cracked", the creators of the Rijndael algorithm just replied, "that's ok, we'll just up the rounding it performs by a factor of say, 4". Took care of that "crack" in a heartbeat.
 
fairlane said:
If your certs are self-signed, there are still ways around that. If your certs come from a third party CA, like Verisign or DigiCert, then yes, they would have those keys as well. As an update to all of this NSA encryption breaking news, Steve Gibson asserts that the NSA in fact does NOT have that capability. I've been tweeting with him today and he will be explaining his position on an upcoming podcast at twit.tv Also, read the article by Bruce Schneirer that Steve posted here today;
http://www.theguardian.com/commentisfree/2013/sep/05/government-betrayed-internet-nsa-spying
Click to expand...

Schneirer looses credibility when he says this:

Gaurdian said:
Your employer obligations don't cover illegal or unethical activity. If you work with classified data and are truly brave, expose what you know. We need whistleblowers.
Click to expand...

Because he clearly does not understand the EXTREMELY limited scope legally of who a whistleblower is...nor does he not understand the overwhelming problem here. Most of what the NSA is doing is not illegal.

Hint: EVERYONE who actually knows first hand about this NSA shit does not legally qualify for whistleblower status....no matter what other NDA or contractual obligations they signed away with their contractor-company or the government, it doesn't matter. None pass even the most basic "do you qualify for whistleblower protections" quiz.
 
vengence said:
You have no idea how the real world works, do you? In the real world, people who are competent enough to plan and carry out terrorist attacks, do it. I mean lets face it, all of their spying totally kept us safe from the boston marthon bombing didn't it? Oh wait... that's right.. it didn't.
Click to expand...

One would think, even when the FBI/CIA?NSA was given intelligence on the brothers BEFORE they came back into the country, which showed they had visited terrorist training camps, that maybe, just maybe, if the goal of the NSA was to prevent terrorism, that they would have been flagged. Obvioopusly, that was NOT the case, as the flag was removed from their records BY the NSA. (Funny that never caught much traction in the news).

So, I completely agree with you: Current NSA internet spying has more to do with political control of US citizens than prevention of terrorism.
 
NSA.. the original internet virus. It spreads, replicates, infiltrates, and infects like the best of em' I wonder how many room 641a's are now in use. Probably thousands.
 
fairlane said:
If your certs are self-signed, there are still ways around that. If your certs come from a third party CA, like Verisign or DigiCert, then yes, they would have those keys as well. As an update to all of this NSA encryption breaking news, Steve Gibson asserts that the NSA in fact does NOT have that capability. I've been tweeting with him today and he will be explaining his position on an upcoming podcast at twit.tv Also, read the article by Bruce Schneirer that Steve posted here today;
http://www.theguardian.com/commentisfree/2013/sep/05/government-betrayed-internet-nsa-spying
Click to expand...

Exactly.

People should realize that if they are not generating their own encryption keys, they are depending on certs from a third party.

In short, unless you exchange key pairs YOU generate to do your own secure messages, and share the keys with trusted parties, someone else, who is not a trusted party, has the encryption key your SSL communications are using for encryption. This is where the NSA comes in...
 
BBA said:
Exactly.

People should realize that if they are not generating their own encryption keys, they are depending on certs from a third party.

In short, unless you exchange key pairs YOU generate to do your own secure messages, and share the keys with trusted parties, someone else, who is not a trusted party, has the encryption key your SSL communications are using for encryption. This is where the NSA comes in...
Click to expand...

But BBA, do you think a user is going to trust your ability to secure your own keys from breaches than a CA? Granted, the model in general is broken, since it has been reported that several CA's have been breached, so what makes you think you are any safer than they are?

No offense meant...
 
Skripka said:
Schneirer looses credibility when he says this:



Because he clearly does not understand the EXTREMELY limited scope legally of who a whistleblower is...nor does he not understand the overwhelming problem here. Most of what the NSA is doing is not illegal.

Hint: EVERYONE who actually knows first hand about this NSA shit does not legally qualify for whistleblower status....no matter what other NDA or contractual obligations they signed away with their contractor-company or the government, it doesn't matter. None pass even the most basic "do you qualify for whistleblower protections" quiz.
Click to expand...


Skripka, I do not agree with you at all. What the NSA has done is in fact, illegal, at least according to what their own FISA court has stated. The agency has indeed overstepped their bounds... I don't understand how anyone can think it is legal for the agency to spy on all Americans and think "it's their job". In fact, their Charter is to protect American citizens from FOREIGN communications, it doesn't in fact, cover domestic surveillance, whith the NSA has repeatedly denied doing, and has in fact, done. The FISA Court clearly stated that their purview was not to extend to domestic spying (e.g. phone calls, emails, text messages etc). Clapper lied to Senator Wyden, so yes, according to select officials, the government's own agency was spying on its own people, and deemed illegal. If anyone doesn't think there is going to be a Supreme Court case coming, you better just stop now and unplug yourself ;)

At the very least, the FISA opinions on the NSA hearings being kept from the public should get the public outraged.

Schneirers article succinctly reflects what needs to be done to take back what was 'stolen' from us. I wonder how many will actually stand up.

I don't think ANYONE knows ANYTHING about what the NSA is actually doing...BUT the NSA.
 
Wrench00 said:
Isn't Ironic that Chinese Companies such as ZTE were accused of the same thing.. Lol. American Hypocracy know no bounds, ie Chemical Weapons use in Syria = Evil that must be stopped, yet Rumsfeld, Regan allowed the use of Chemical weapons in Iraq by Sadam again not only his own people but against a Sovereign Nation of Iran = Ok?

I hope that if USA attacks Syria I hope Russia atacks Saudi Arabia.Tit for Tat.
Click to expand...

US used chemical weapons in Vietnam, leaving a few hundred thousands maimed.

The reason they are asking Congress for approval (both US and UK leaders), is because they know how bad this will turn, so they probably want to be as "little" responsible as they can be.
 
fairlane said:
Skripka, I do not agree with you at all. What the NSA has done is in fact, illegal, at least according to what their own FISA court has stated. The agency has indeed overstepped their bounds... I don't understand how anyone can think it is legal for the agency to spy on all Americans and think "it's their job". In fact, their Charter is to protect American citizens from FOREIGN communications, it doesn't in fact, cover domestic surveillance, whith the NSA has repeatedly denied doing, and has in fact, done. The FISA Court clearly stated that their purview was not to extend to domestic spying (e.g. phone calls, emails, text messages etc). Clapper lied to Senator Wyden, so yes, according to select officials, the government's own agency was spying on its own people, and deemed illegal. If anyone doesn't think there is going to be a Supreme Court case coming, you better just stop now and unplug yourself

At the very least, the FISA opinions on the NSA hearings being kept from the public should get the public outraged.

Schneirers article succinctly reflects what needs to be done to take back what was 'stolen' from us. I wonder how many will actually stand up.

I don't think ANYONE knows ANYTHING about what the NSA is actually doing...BUT the NSA.
Click to expand...

What are their bounds, what laws have they violated? They have toed a very fine line of statutory and case law that lets them do what they do. I'm not saying it is right by any means nor am I saying it should be construed as legal...our laws both statutory and case stem from decades and centuries before the electronic age's ethical/moral problems of what constitutes "unreasonable search". Further it gets more hairy with the VPN and proxy games people play combined with communication now being a global act.

All that being said it doesn't change the fact that NO NSA insider with first hand knowledge of any of this is a whistleblower legally. And anyone stupid enough to come forward would be criminally charged, or else face life on the run a la Snowden. To be a whistleblower, any uncovered wrongdoing must not be your primary job. Edward Snowden, love him or hate him, is a great example of this. He in no way is legally allowed to claim whistleblower status, whether what he did was classified or Top Secret or not...because what he mouthed off about was his primary job responsibility.
 
lol if you only knew the technology they use, you would get all [H]ard
just use your imagination at what a couple billion here and there would buy with technology decades more advanced than seen by civilians. They are spending a half trillion a year so imagine the toys they buy and then write off in the budget. That poor accountant going how do I write off billions of dollars spent on classified shit hmmm... $10,000 hammer x 15 = $1.5 mil... gotta start somewhere...

In January 2011, while soaking in the new-year at a Los Angeles hotel, the Air Force announced that it's unmanned craft had returned from 7 months in space
Click to expand...
2011-Secret-Military-Technology
The rabbit hole goes pretty deep, and you are still arguing about privacy over darpane...errr I mean the 'world wide web'???
 
canna said:
For the same reason I lock my car or house door. My property is my property. it's not for public use. Intellectual Property rights have defined data as property and as such I consider my data my property. My property is mine, so I lock it up, data inclusive.
Click to expand...

Locks only keep out the honest people.
 
FiveFig said:
lol if you only knew the technology they use, you would get all [H]ard
just use your imagination at what a couple billion here and there would buy with technology decades more advanced than seen by civilians. They are spending a half trillion a year so imagine the toys they buy and then write off in the budget. That poor accountant going how do I write off billions of dollars spent on classified shit hmmm... $10,000 hammer x 15 = $1.5 mil... gotta start somewhere...


2011-Secret-Military-Technology
The rabbit hole goes pretty deep, and you are still arguing about privacy over darpane...errr I mean the 'world wide web'???
Click to expand...
I'm not sure if this error was intentional or unintentional, but it's far more funny this way.
 
You must log in or register to reply here.
Back
Top