- Site menu:
- Latest Discussions
- Latest Newswire
- Archives
- Submit Story
- Story HOWTO
- Syndicate
- E-mail Alerts
N.S.A. Able to Foil Basic Safeguards of Privacy on Web
|
|
|
Comments (26)
6 earlier comments in the full thread.
And anything and everything by James Bamford, including the one I mention often, "The Puzzle Palace". It was his article last year on the Utah datacenter that started this latest round of interest in the NSA's activities.
One should perhaps verify such allegations. The simplest way is to encrypt some data made available on a website, and the NSA should post back the decrypted content. They would then be credible and we would know it's not FUD. Any volunteer ?
Quoting:I didn't know that closed source Intel code was sitting in our linux kernel doing random number generation.
Neither did I. Thanks for the link. As for the rest, the American public is largely apathetic. In addition, I believe it would take a huge public groundswell against Congress for those critters to even consider taking any real actions.
However, the second link from Bruce Schneier that krinpaus posted gives one some hope. If anyone knows about digital security, it's Bruce. And, I tend to believe that some of what the NSA is claiming is not really true. After all, you have to take anything government entities say with a grain of salt. I'll just quote a portion from a newsletter I received today.
Quoting:I have to tell you, though, I'm deeply suspicious some of the NSA's assertions.
They seem to be claiming that they have cracked nearly everything, and that they have backdoor access to privacy software. But this is practically impossible.
A lot of encryption software used today is actually 'open source'. This means that the software code is freely available to anyone.
GNU Privacy Guard (GPG) is a great example. GPG is an open-source, free alternative version of Phil Zimmerman's original PGP software. And it's widely used to encrypt files and emails.
But because GPG is open-source, the software code is available for anyone to view, inspect, and modify. If there were any backdoor access for the NSA, thousands of people would see this.
Not to mention, to penetrate a single 2048-bit encryption key can take anywhere from thousands of years to tens of millions of years, even with the fastest supercomputers.
Consequently, it's IMPOSSIBLE for the NSA to have cracked everything. And my assessment is that this is an intimidation campaign.
The NSA wants people to think that they have this capability.
And if everyone thinks that the NSA is Big Brother's Big Brother, all-seeing and all-knowing, then not only will everyone be terrified, but everyone will simply stop using encryption.
After all, why bother going through the hassle of encrypting/decrypting if the NSA can still read the contents of your email?
It's in the NSA's interest for people to think that the agency is almighty. I don't buy it. These people are seriously vile. But they don't have superpowers.
When done properly, email encryption is still a good option. And there are a number of open-source tools out there to consider using.
> After all, you have to take anything government entities say with a grain of salt.
They lie. Institutionally, chronically, about everything no matter how trivial.
And to admit that there are things they can't break would be just as destructive to their cause as publishing a list of the things they can break. So of course they're going to claim that nothing is beyond their power.
It's called "covering fire", so that no one knows exactly what they can do.
They lie. Institutionally, chronically, about everything no matter how trivial.
And to admit that there are things they can't break would be just as destructive to their cause as publishing a list of the things they can break. So of course they're going to claim that nothing is beyond their power.
It's called "covering fire", so that no one knows exactly what they can do.
This whole issue seems to be about cheating with encryption rather than breaking codes. There are well known mathematical theorems on how long it takes to break encryption of a certain key length. The NSA cannot get round those fundamental limits despite their massive resources. What they can do however is insert backdoors in proprietary code which is hidden from public view. Open source is a harder proposition and I would guess PGP is still safe but that is a guess given how devious the NSA is.
If you are paranoid I suggest the following:
1) Read up on encryption. You need math skills.
2) Code up your favourite algorithm with a long key on a machine not connected to the internet
3) Exchange keys with your recipient via a trusted and non suspect third party in person only and in a national park
;-) Edit: One flaw here is if they have inserted backdoors into the gcc compiler....
If you are paranoid I suggest the following:
1) Read up on encryption. You need math skills.
2) Code up your favourite algorithm with a long key on a machine not connected to the internet
3) Exchange keys with your recipient via a trusted and non suspect third party in person only and in a national park
;-) Edit: One flaw here is if they have inserted backdoors into the gcc compiler....
Off topic, but what the hey...
'Hello, NSA? I have lost an email, can you help me find it?'--Dutch-Iranian filmmaker trolls NSA
http://boingboing.net/2013/09/01/hello-nsa-i-have-lost-an-e....
(It's a sad thing, when this sort of thing seems like our best (only) realistic counter-measure...)
'Hello, NSA? I have lost an email, can you help me find it?'--Dutch-Iranian filmmaker trolls NSA
http://boingboing.net/2013/09/01/hello-nsa-i-have-lost-an-e....
(It's a sad thing, when this sort of thing seems like our best (only) realistic counter-measure...)
[tinfoil-hat]
But! How many of us are compiling and installing everything from source‽‽‽
(Edit to add: And how many of us reviews and understands the source-code, before compiling it ourselves...)
[/tinfoil-hat] ;)
djohnston wrote:But because GPG is open-source, the software code is available for anyone to view, inspect, and modify. If there were any backdoor access for the NSA, thousands of people would see this.
But! How many of us are compiling and installing everything from source‽‽‽
(Edit to add: And how many of us reviews and understands the source-code, before compiling it ourselves...)
[/tinfoil-hat] ;)
The last time I read, understood, and compiled from source anything to do with encryption beyond my own trivial implementation of RSA in BASIC from a Byte article in 1983, was PGP 2.6.2.
> The last time I read, understood, and compiled from source anything to do with encryption beyond my own trivial implementation of RSA in BASIC,,,
I thought I was the only one who did that. :)
I thought I was the only one who did that. :)
Maybe Bob_Robertson and jdixon are the same person.
I live in West Virginia, I think Bob lives in North Carolina. :)
But we all know you are hust trying to throw the NSA off by living in 2 places at the same time.
> ...by living in 2 places at the same time.
Gee, and there goes my cover. Thanks. :)
Gee, and there goes my cover. Thanks. :)
While JD and I have certainly chewed over much of the same philosophical ground, we are certainly not the same person.
Indeed, I did live in NC, until the vindictive harpy stole my children and prosecuted me into insolvency for daring to take better care of those children than she. I am now in New Hampshire with the Free State Project.
Indeed, I did live in NC, until the vindictive harpy stole my children and prosecuted me into insolvency for daring to take better care of those children than she. I am now in New Hampshire with the Free State Project.
> ...until the vindictive harpy stole my children and prosecuted me into insolvency for daring to take better care of those children than she.
I'm sorry to hear that. :(
I'm sorry to hear that. :(
Live free or die in NH eh Bob? ;-)
LOL I am not either Bob or jdixon. Instead I am a raging liberal from NYC. Linux sure is diverse.
LOL I am not either Bob or jdixon. Instead I am a raging liberal from NYC. Linux sure is diverse.
Voluntary interaction is very inclusive. :^)
Quoting: ...until the vindictive harpy stole my children and prosecuted me into insolvency for daring to take better care of those children than she.
Same thing happening here... She must've gone to vindictive harpy school with my ex...
> Same thing happening here... She must've gone to vindictive harpy school with my ex...
It's called high school and/or college around here. And if you think it's not being deliberately taught, then I have a bridge to sell you.
It's called high school and/or college around here. And if you think it's not being deliberately taught, then I have a bridge to sell you.
> And if you think it's not being deliberately taught....
Oh it certainly is, and by repetition gets ingrained even in those who think they reject it.
Oh it certainly is, and by repetition gets ingrained even in those who think they reject it.
Post a comment
A free account is needed to post. Write your comment here first: your text is kept in this browser while you sign up or log in, and is waiting for you when you come back.
Your message:Markdown: **bold**, *italic*, [text](https://link), - lists, > quotes, $x^2$ for math. Formatting help
Sign up and post (it is free) or Log in and post