Category Archives: Cryptography

NSA Scandal: Anything is Plausible Now

CNET News, NSA disguised itself as Google to spy, say reports. It seems they are talking about a man-in-the-middle attack, based on a fake cryptographic certificate, which isn’t when you think about it so surprising. But when I read the headline, I imagined they’d run around with fake business cards impersonating Google staff.

And then there’s this one: Former Intelligence Analyst: Obama Was Wiretapped By NSA In 2004. I’d have marked this as ‘tinfoil’ a month ago. I still want to as the details seem pretty skimpy. But anything seems possible now.

Posted in Civil Liberties, Cryptography | 1 Comment

Their Lips Are Moving

6 Whopping Government Misstatements About NSA Spying | Threat Level | Wired.com

Posted in Civil Liberties, Cryptography | Leave a comment

A Fish Rots From the Head

The Cowboy of the NSA: Inside Gen. Keith Alexander’s all-out, barely-legal drive to build the ultimate spy machine (Foreign Policy):

Alexander was fond of building charts that showed how a suspected terrorist was connected to a much broader network of people via his communications or the contacts in his phone or email account.

“He had all these diagrams showing how this guy was connected to that guy and to that guy,” says a former NSA official who heard Alexander give briefings on the floor of the Information Dominance Center. “Some of my colleagues and I were skeptical. Later, we had a chance to review the information. It turns out that all [that] those guys were connected to were pizza shops.”

A retired military officer who worked with Alexander also describes a “massive network chart” that was purportedly about al Qaeda and its connections in Afghanistan. Upon closer examination, the retired officer says, “We found there was no data behind the links. No verifiable sources. We later found out that a quarter of the guys named on the chart had already been killed in Afghanistan.”

Those network charts have become more massive now that Alexander is running the NSA. When analysts try to determine if a particular person is engaged in terrorist activity, they may look at the communications of people who are as many as three steps, or “hops,” removed from the original target. This means that even when the NSA is focused on just one individual, the number of people who are being caught up in the agency’s electronic nets could easily be in the tens of millions.

We could debate that “barely legal” part. But then again, like the Daily Show said way back at the beginning of this long strange trip, the biggest scandal might be that all this spying is in fact legal.

Posted in Cryptography | Leave a comment

QOTD (NSA Fallout Edition)

Bruce Schneier, explaining to Financial Times why US tech companies will get hurt by news that NSA got some of them to put back doors into their products while others complied with the FISA court orders — even setting up automated systems transfer the data:

“How would it be if your doctor put rat poison in your medicine? Highly damaging,” said Bruce Schneier, a US computer security expert.

Might make you shop around a just a little bit. When the dust settles though, it’s not clear what other country’s tech providers will seem more trustworthy. China? Korea? UK? France? Unlikely all. Not Switzerland. Certainly not Russia. Who then? Can Iceland grow a big enough tech sector?

Posted in Cryptography | 8 Comments

Somewhere Tim May Is Laughing His A** Off

Dilbert today is rather timely.

(About Tim May.)

Posted in Civil Liberties, Cryptography | Leave a comment

Remember the _NSAKEY ?

In light of the revelations that the NSA has collaborated with — or if you prefer subverted — major technology manufacturers in order to get them to introduce NSA-friendly backdoors into their products, is it time to revisit the controversy over the _NSAKEY?

The _NSAKEY, you may recall, was a public key accidentally left in a Microsoft release of an update to Windows NT. It was discovered by 1999 by Andrew Fernandes. At the time Microsoft denied that the key had anything to do with the NSA, but was just a name they gave it as the product had to comply with export control law. And, at the time, the better view seemed to be that it was all just an accident of nomenclature, as there were much better ways to subvert the product.

Still, you gotta wonder.

Posted in Cryptography | Leave a comment

Encryption: The Sky *IS* Falliing

The latest revelations about the NSA’s ability to undermine most encryption used online dwarf anything we have learned previously. What is worse, the NSA has worked to insert weaknesses into products — backdoors.

the National Security Agency and its UK counterpart GCHQ have broadly compromised the guarantees that internet companies have given consumers to reassure them that their communications, online banking and medical records would be indecipherable to criminals or governments.

The agencies, the documents reveal, have adopted a battery of methods in their systematic and ongoing assault on what they see as one of the biggest threats to their ability to access huge swathes of internet traffic – “the use of ubiquitous encryption across the internet”.

Those methods include covert measures to ensure NSA control over setting of international encryption standards, the use of supercomputers to break encryption with “brute force”, and – the most closely guarded secret of all – collaboration with technology companies and internet service providers themselves.

Through these covert partnerships, the agencies have inserted secret vulnerabilities – known as backdoors or trapdoors – into commercial encryption software.

It’s everything, everything that Cypherpunks ever muttered about over their beer.

This is the secret that likely explains why the Obama and Cameron administrations were willing to do almost anything to try to get Snowden, the reporters he leaked to, and the anyone who touched their data.

This is the nuclear winter of data security.

What do we do?

I used to say, we don’t really care if the NSA is reading our traffic, because if they are, the secret is so valuable they won’t waste it on anything but the most important national security matters. The Snowden revelations suggest that wasn’t completely right — there was some information sharing with civilian domestic law enforcement, although it was obfuscated in ways that undermined the constitutional guarantee of the right to confront witnesses against you. More importantly, the fact of the Snowden revelations mean that the cat is out of the bag, so the disincentive to use the information will be greatly reduced.

Bruce Schneier has given this some thought — he had an advance look at the documents — and he says that the IETF and other engineers need to re-engineer the internet to make it safer from surveillance. Meanwhile, there are things we can do individually.

For now, however, it is not hyperbole to say, as Schneier does, that “[b]y subverting the internet at every level to make it a vast, multi-layered and robust surveillance platform, the NSA has undermined a fundamental social contract.” It’s going to be tough, hard work to rebuild the Internet, and even harder work afterwards to rebuild trust in systems not to mention both public and private institutions.

Are we up to either job?

Posted in Cryptography | 13 Comments