NSA has backdoors to all software

From the NYTimes:
Intelligence officials asked The Times and ProPublica not to publish this article, saying it might prompt foreign targets to switch to new forms of encryption or communications that would be harder to collect or read. The news organizations removed some specific facts but decided to publish the article because of the value of a public debate about government actions that weaken the most powerful privacy tools.

The files show that the agency is still stymied by some encryption, as Mr. Snowden suggested in a question-and-answer session on The Guardian’s Web site in June.

“Properly implemented strong crypto systems are one of the few things that you can rely on,” he said, though cautioning that the N.S.A. often bypasses the encryption altogether by targeting the computers at one end or the other and grabbing text before it is encrypted or after it is decrypted.
Click to expand...

I wish they would just say what standards have been compromised, but then the terrorists would win I guess.

Just dump the shit, wikileaks style.
 
This is why I try to avoid proprietary software now and my stuff is hosted in Canada. I'd be ignorant in saying I'm 100% safe, but I'd imagine I'm much safer than if I used proprietary software and cloud based services that are in the US.

The US government is one of the most criminal organizations and somehow need to be stopped but they're just too powerful. There needs to be a revolution. Freedom needs to be fought for, and returned. Blood must be shed.
 
Red Squirrel said:
This is why I try to avoid proprietary software now and my stuff is hosted in Canada.
Click to expand...


From what I've been gathering it isn't just proprietary software and willful corporations selling out to the Feds for profit, but the entire community as a whole. Recent articles stating how the U.S./UK spy agencies haven't been worried about SSL/TLS traffic because RC4 is already exploitable to them, yet may not be known to academia. Also some of the programs hint that the NSA has intentionally, since the late 90's when it lost its encryption cases for backdoors, been willfully infiltrating corporations and encryption standards groups around the world to intentionally weaken and or implement hidden backdoors into software/standards.


I've always lived under the guise of paranoia, but this is really starting to make me sick. Our government propagates from birth to death how bad the Communist and Nazi's were, relentlessly to its citizens. However, we are the ones implementing forceful terror on other nations under the banner of "pre-emptive" warfare. We remind people of the terror that the Gestapo/KGB reigned on their citizens, too afraid to speak, yet here we are. We have outdone ourselves and history, I think, will eventually expose the truth. I do believe we get the government we deserve and everything that comes with it no matter how bad it may get.

This is what we get for decades of living the good life on the backs of our [great] great grandmothers/grandfathers who built this baseline enjoyable society we know today. All the while deciding to ignore our responsibility as citizens to dutifully remind the government who is in-charge.
 
This is why you dont go with microsoft software or anything installs on to windows go linux there is no backdoor on linux software...
 
I'm not sure what to believe on all this NSA stuff. I don't if people are being over sensational or if there is something to this. I find it hard to believe they have that many backdoors and can that "easily" break SSL, but then again maybe they do...

Who knows what to believe.
 
I dont have anything that the NSA would care about anyhow, so I dont really worry about it.

They already can figure out my SSN or Bank Account balance via other channels I am sure, and what does that even matter?
 
Grentz said:
I dont have anything that the NSA would care about anyhow, so I dont really worry about it.

They already can figure out my SSN or Bank Account balance via other channels I am sure, and what does that even matter?
Click to expand...
Even if you buy into the " nothing to hide, nothing to fear" propaganda, it matters because they have little reason to ensure the back doors can't be exploited by others for more "nefarious" reasons. Especially if its entirely rouge they can't even work with developers and distributors to publish a fix.

Same reason all cars don't come equipped with remote shutdown , even if it could be useful to law enforcement in some situations. Unless you own a GM with onstar of course , then it's a "feature" that your car can be shutdown remotely by a private company (or hacker).
 
Grentz said:
I dont have anything that the NSA would care about anyhow, so I dont really worry about it.

They already can figure out my SSN or Bank Account balance via other channels I am sure, and what does that even matter?
Click to expand...

You keep telling your self that.. Then what happens when your gov passes a law that you may have it will not be hard to find you and take those rights/properties away from you.

Governments are just like women give them an inch they will take a mile.
 
Aren't you glad your obesity diabetes treatment is paid by someone else? Do you miss the privilege of waving your credit card as the first gesture after being hospitalized after an accident?

Why is the USA rejecting civilization so bad? Scary.
 
TCM said:
Aren't you glad your obesity diabetes treatment is paid by someone else? Do you miss the privilege of waving your credit card as the first gesture after being hospitalized after an accident?

Why is the USA rejecting civilization so bad? Scary.
Click to expand...

Americans would rather starve, die, and be ignorant knuckle-dragging, mouth-breathing ignorami than welcome socialism or fascism or communism, or what-the-fuck-everism-it-is-this-week.
 
mwarps said:
Americans would rather starve, die, and be ignorant knuckle-dragging, mouth-breathing ignorami than welcome socialism or fascism or communism, or what-the-fuck-everism-it-is-this-week.
Click to expand...

Umm, they don't seem to have any problem with fascism. You're being unfair.
 
QFT

[QUOTEThis is what we get for decades of living the good life on the backs of our [great] great grandmothers/grandfathers who built this baseline enjoyable society we know today. All the while deciding to ignore our responsibility as citizens to dutifully remind the government who is in-charge.[/QUOTE]

If only we could get the masses to think this way, then revolution might be possible.
 
Makes me curious as to why there isn't someone selling "safe internet access"

albeit, real, or fake (IE; LifeLock) where they prey on peoples emotions/rumor mill.....
 
JPF_ said:
Makes me curious as to why there isn't someone selling "safe internet access"

albeit, real, or fake (IE; LifeLock) where they prey on peoples emotions/rumor mill.....
Click to expand...

There are a lot of VPN companies doing just that.
 
Gomar said:
http://www.theinquirer.net/inquirer/news/2102435/aes-encryption-cracked

"the number of steps required to crack AES-128 is an 8 followed by 37 zeroes...
it would take more than two billion years to recover an AES-128 key,"

That's why I use Winrar(128-bit AES).
Click to expand...

Just use AES 512. They can't break that yet.

...Of course, that's also why you're not allowed to use AES 512 for most things...The government will get mad at you, because they can't crack it. Also because the standard doesn't exact exist, per se.
 
Dogs said:
Just use AES 512. They can't break that yet.

...Of course, that's also why you're not allowed to use AES 512 for most things...The government will get mad at you, because they can't crack it. Also because the standard doesn't exact exist, per se.
Click to expand...

Also, someone writing an unrar command that handles WinRAR's crypto discovered that WinRAR uses AES in ECB mode which a pretty big implementation flaw.

http://blog.zorinaq.com/?e=15

Once again showing that you should never try to create your own crypto systems. TLS for data in transit, PGP for data at rest.
 
devman said:
Also, someone writing an unrar command that handles WinRAR's crypto discovered that WinRAR uses AES in ECB mode which a pretty big implementation flaw.

http://blog.zorinaq.com/?e=15

Once again showing that you should never try to create your own crypto systems. TLS for data in transit, PGP for data at rest.
Click to expand...

Is that a flaw in the WinRAR software, or a flaw in the actual RAR file format? Based on that article, it looks to be the latter.

But if it's the former, well that's just one more reason why nobody should ever use WinRAR for any reason. (another good reason is the fact that 7zip exists, is superior, and is FOSS)
 
From what I've heard WinRAR has since fixed a lot of previous problems which lead to encrypted files being easy to moderately crackable. Now if you use a decent passphrase over 12 characters it's as strong as many other softwares offering encryption. I don't know if that's still the case or not, but for the past few years that's what I've heard. I still wouldn't trust WinRAR or any compression specific package to properly encrypt your data. They all have had sketchy pasts and are strongly targeted by cracking tools. Not to mention compressing and encrypting is not trivial and without precise programming it can lead to devastating flaws.

When it comes to storing something in a compressed archive I've always gone the route of AxCrypt (only AES-128) as it has a solid history and does compression automatically. Then just wrap the archive in a WinRAR or whatever wrapper you wish without any compression.
 
The fixing of the problems was switching to a standard cipher instead of an unproven proprietary one. The implementation apparently is still flawed. I don't blame them though, developers who write compression archives probably are not experts at designing crypto systems, and even experts get it wrong (case in point, predictable IVs used with CBC in TLS1.0).

As far as crypto protocols go, TLS for transit, PGP for storage, both have many implementations and have been subjected to tons of scrutiny.
 
jojo69 said:
don't read the news much 'eh?
Click to expand...
Oh please. I have a special brand of tinfoil for you, extra heavyduty.

Unless you are planning a nuclear attack against the US, you really have nothing to worry about. The NSA won't be wasting their full resources on you.

Source: The government gets told of two suspicious muslims, ignores them, and they successfully carry out an attack on a major public sporting event in Boston. Do you really think they are going to pull out their "How to quickly backdoor AES" books on your Truecrypt stash? HAH, not unless they suspect something far more devious than an IED and not a full blown nuclear device. You and your banking website login information stored in your excel spreadsheet that you keep password protected and further stored in a Truecrypt partition which is further hidden with-in another partition aren't worth their collective time. Get over yourselves, stop the Left vs. Right game and vote the current idiots in CONgress out of office. Problem solved!
 
Liger88 said:
From what I've heard WinRAR has since fixed a lot of previous problems which lead to encrypted files being easy to moderately crackable. Now if you use a decent passphrase over 12 characters it's as strong as many other softwares offering encryption. I don't know if that's still the case or not, but for the past few years that's what I've heard. I still wouldn't trust WinRAR or any compression specific package to properly encrypt your data. They all have had sketchy pasts and are strongly targeted by cracking tools. Not to mention compressing and encrypting is not trivial and without precise programming it can lead to devastating flaws.

When it comes to storing something in a compressed archive I've always gone the route of AxCrypt (only AES-128) as it has a solid history and does compression automatically. Then just wrap the archive in a WinRAR or whatever wrapper you wish without any compression.
Click to expand...

AES has been "successfully attacked" in the sense that it has a known weakness that effectively reduces the key length. It's not substantial, but the point is that if one weakness exists then.......


Our attacks work in the classical single-key setting and, thus, apply in every context, however, with huge complexities so far. The practical consequence is that the effective key length of AES is about 2 bits shorter than expected - it is more like AES-126, AES-190, and AES-254 instead of AES-128, AES-192, and AES-256. We think it is a significant step toward the understanding of the real security of AES."
Click to expand...

http://www.theinquirer.net/inquirer/news/2102435/aes-encryption-cracked
 
canna said:
AES has been "successfully attacked" in the sense that it has a known weakness that effectively reduces the key length. It's not substantial, but the point is that if one weakness exists then.......




http://www.theinquirer.net/inquirer/news/2102435/aes-encryption-cracked
Click to expand...


Anything that reduces search space below "brute-force" is considered a break in the crypto world so don't read to much in to that. You are right though in that attacks only get better and never worse.

AES has a handful of attacks, probably the most serious being related key attacks against reduced round variants of AES-192 and AES-256 that exploit their key schedule.

None of these attacks are yet practical, so for the time being I wouldn't worry about AES. RC4 on the other hand :rolleyes:.
 
mwarps said:
Americans would rather starve, die, and be ignorant knuckle-dragging, mouth-breathing ignorami than welcome socialism
Click to expand...

Correct! Despite that most of Europe, Asia is Socialist in some way.
Even Japan has Socialist policies.

Ifcouse, in America there is welfare, foodstamps, medicaid, social security, public schools, public libraries, and many other programs.
 
Liger88 said:
lead to encrypted files being easy to moderately crackable. Now if you use a decent passphrase over 12 characters
Click to expand...

made up of what? All lower case? Upper, lower, numbers, symbols?
All numbers is still: 999,999,999,999.
Bank ATM pins are only 4 digits; as well as cell phone pins, home security access pins, etc.
 
Gomar said:
above page proves AES is not hackable.
Click to expand...

Everything is hackable, especially by an organization with unlimited funds and resources.


"NNN is not hackable" has been a statement often proven false. Wep was "not hackable" at one point.
 
I work for a call recording company. Call centers, banks, all kinds of shit....

The software we use is developed by a company called NICE which is based in Israel. It wouldnt be far fetched to think the NSA could get into anyone's application. Especially considering the default password to log into the application is the most insecure thing you could possibly imagine.

Considering NICE has a market share of over 75% and handles almost all of the FORTUNE500 companies its a little concerning.
 
You must log in or register to reply here.
Back
Top