Snowden Disclosures Finally Hit 12 on a Scale of 1 to 10

http://www.motherjones.com/kevin-drum/2013/09/snowden-disclosures-nsa-bombshell-decryption

by nkurz • 13 years ago

216 115 13 years ago

soora• 13 years ago

What does a 12 on a scale of 1 to 10 even mean? What criteria are they judging damages on?

So far, I do not think the NSA has lost any of the capabilities it previously had. I have not heard of any NSA backdoors being removed from existing software.

nonchalance• 13 years ago

Read the article:

Nonetheless, this is truly information that plenty of bad guys probably didn't know, and probably didn't have much of an inkling about. It's likely that many or most of them figured that ordinary commercial crypto provided sufficient protection ...
Now every bad guy in the world knows for a fact that commercial crypto won't help them, and the ones with even modest smarts will switch to strong crypto techniques that remain unbreakable.

If you accept that most bad guys were using commercial crypto and not strong crypto, NSA may have been tapping communications but now won't be able to

toyg4• 13 years ago

I wouldn't be surprised if it turned out that this switch will actually weaken opponents. Criminal masterminds are often not uber-hackers who can reliably roll their own encryption scheme, so to speak.

toyg4• 13 years ago

They're losing a lot of political capital, which should limit their ability to further expand their reach in the immediate future.

They're also an item of debate now, which could potentially result in loss of capability further on. At the next round of elections, Democratic candidates will likely have to defend an unpopular intervention in Syria, they'd rather not add to that pile a defence of some invented Federal right to unwarranted spying on everyone's communications; and it's a potentially easy target for small-government Republicans.

jes5199• 13 years ago

Republicans have, so far, not been willing to use the "big government" label to attack anything to do with military, police, or espionage - their "law and order" platform trumps their "small government" one.

In the bizarre logic of American politics, Republicans and Democrats are both pro-NSA, while the Greens and Libertarians are anti-NSA.

ensmotko• 13 years ago

I think the former employee just wanted to stress how this is way worse for the NSA than their worst case scenario. It's just to draw attention, nothing else really...

mc32• 13 years ago

I think it means that while those weaknesses capabilities have not gone away, the data exposed to such, might evaporate (be moved away) from such exposure. Example, the claim that FSB is moving to typewriters.[1] Or criminals moving to other methods of communication, if they perceive the internet as inherently insecure.

[1]http://www.globalpost.com/dispatch/news/afp/130711/kremlin-t...

contextual• 13 years ago

A writer's job (among other things) is to get and keep your attention. This article did that very well using hyperbole (i.e. 12 on the scale of 10).

I think the rest of the article is hyperbole too, but not much more than that.

ihsw2• 13 years ago

The US Government and the NSA have made it painfully clear that there are two options for the US to participate in the global internet: capability to decrypt everything or an American version of China's Great Firewall.

The capability to decrypt everything is largely outside of their control, however they can exert pressure of ISPs, SSL certificate authorities, commercial software vendors, social networking services, and a variety of other organizations.

The rationale being that the US Government pressures those organizations to intentionally implement weaker security measures to facilitate the ongoing capabilities of the government's suspicionless surveillance systems.

Since this system of clandestine supportive relationships is potentially unreliable (since it is directly outside of their control and it relies on reciprocal partnerships) then it stands to reason that the simply revelation of these relationships could jeopardize the US Government's surveillance capabilities.

cmyr• 13 years ago

>What does a 12 on a scale of 1 to 10 even mean?

Integer overflow!

ohWhatever• 13 years ago

It very obviously means that this goes beyond even the kind of wattage that Spinal Tap's amps are capable of.

This one doesn't just go to eleven. Twelve is greater than eleven.

auctiontheory2• 13 years ago

He seems to be saying that it would be better (for the US) if the NSA continued to secretly spy on all the world's communications networks.

That's certainly one point of view, but it's not one I expected to see in Mother Jones, or on HN. Isn't the whole point of this uproar that we do not trust these unelected (by the US, never mind the global population) spooks with unfettered access to all communications?

ihsw2• 13 years ago

Isn't the whole point of this uproar that we do not trust these unelected (by the US, never mind the global population) spooks with unfettered access to all communications?

Yes, however some people think "the government" can do no wrong because it "works for the people." The government they support also happens to be fighting a "War on Terror" where terror can include personal opinions that are critical of the American government and her corporate pillars[1][2][3][4].

Many still see distrust of government as indicative of mental illness, where such distrust is born from paranoia and anarchist/libertarian propaganda.

[1] http://en.wikipedia.org/wiki/Big_oil

[2] http://en.wikipedia.org/wiki/Pharmaceutical_lobby

[3] http://en.wikipedia.org/wiki/Media_conglomerate

[4] http://en.wikipedia.org/wiki/Iron_triangle_(US_politics)

datanotdata• 13 years ago

“Every word that is spoken and sung here represents at least this one thing: that this humiliating age has not succeeded in winning our respect.” -Hugo Ball

bpatrianakos2• 13 years ago

I don't think he's saying it would be good for anyone for the NSA to continue snooping as they do. I think your first point is wrong, your last point is right, and the two are unrelated.

The issue isn't the fact that the NSA snoops. That's their job and it has value when their power to do so is used judiciously. The problem is that its not being used judiciously. Rather than singling out as few people as possible to root out the bad guys their just collecting everything they can. They don't need to do this and doing so opens up the possibility for huge abuses of power. That's the issue.

I think the article is right that the crypto revelations aren't pertinent to this discussion. I would even consider the crypto revelations a red herring. Is it important how the NSA spies on everyone? No, its only important to know that they do it at all when speaking in the context of how the Snowden leaks are important to creating a national debate and, hopefully, by some miracle, create reforms.

I think its reasonable that as a US citizen you're okay with the NSA being able to break crypto. You just want to be able to trust that they're using it against the bad guys and not you. Even now that we know they're probably using it against innocent civilians its more harmful to the NSA's ability to go after the "bad guys" when they legitimately do (and they still do serve that purpose) and isn't really helping the debate over whether their over collection of data is okay and how to reform that system.

kelnos2• 13 years ago

I think its reasonable that as a US citizen you're okay with the NSA being able to break crypto. You just want to be able to trust that they're using it against the bad guys and not you.

This is very interesting and got me thinking. I think that yes, in principle I agree, but there are limits.

I draw a distinction between types of "breaking encryption". There's the standard kinda that "anyone" can do: social engineering, secret mathematical hacks, 0day exploits, brute force attacks, etc.

Then there's the special stuff that only organizations in the position of the NSA can do: putting backdoors in cryptosystems (and pressuring commercial vendors to do so), influencing development of new cryptosystems to make them weaker, etc.

I'm ok with the first set of methods, but not the latter. When you weaken a cryptosystem, you weaken it for everyone, not just the people you want to be able to spy on. Even if the NSA's activities were completely above-board and their power was used appropriately, weaker crypto that everyone uses means that no one can trust their crypto, whether it's to secure corporate communications, keep discussion of an unpopular idea secret, or just trust that when you access your bank's website, a random attacker can't use an NSA backdoor to steal your banking info.

auctiontheory2• 13 years ago

I think its reasonable that as a US citizen you're okay with the NSA being able to break crypto

I think you have forgotten the phrase "absolute power corrupts absolutely." Humans with unchecked access to information (=power) will NEVER be completely trustworthy. Never. It is by definition. That's why we have checks and balances. That's why we had democracy. No one should be absolutely above democracy. But that's what today's NSA is.

You realize these guys (in the NSA) have been using intelligence resources to spy on their girlfriends and neighbors? How much more human and fallible does it get than that?

jusben1369• 13 years ago

Very nicely put!

greedo• 13 years ago

The problem with having the NSA break encryption in this manner is that it's not like they've discovered a 0day and are hacking into our enemies; instead, they've corrupted the encryption, exposing what were formerly considered secure comm methods. I'm pretty sure that these corrupted comm methods aren't only available to the NSA. This gives enemies of the US an idea of how to circumvent our encryption, thus exposing everyone who uses these comm methods to attack, whether they're US allies or enemies.

mikeash• 13 years ago

Is it important how the NSA spies on everyone?

I think that is by far the most important thing.

Imagine a hypothetical world in which it's been revealed that the NSA is spying on the entire internet through the means we generally expected them too, i.e. an army of super-smart crypto people and access to more computing power than God. What would happen following this revelation?

I anticipate that there would be outcry similar to what we've seen, followed by efforts to block their access. Companies like Google, Apple, Microsoft, all the tech heavyweights, would lead the charge. I think there'd be a lot of newfound interest in moving from crypto that's "good enough" to crypto that's deeply over-engineered. 1024-bit AES variant, anyone?

Instead, the NSA has gained their access largely through influence. This is smart, considering their mission. Why crack good crypto when you can just bypass it, or at least ensure that the crypto is not so good? It's certainly way easier. As far as we know, there's still no realistic way for them to crack a solid implementation of things like AES, so it's really the only way.

Are Google, Apple, Microsoft, et al leading the charge for better crypto in our world? No, because they're hopelessly compromised. Nobody trusts them, because the NSA has subverted all of them.

I anticipate that any new crypto, whether algorithm, system, or implementation, involving the United States in any way will be completely shunned. The US's tech giants will be shut out of a lot of activities. A huge chunk of the US's tech dominance will shift elsewhere. This will hurt the US economy and the US's security.

In short, the question comes down to, how do you avoid NSA spying? And that depends on how the NSA spies. If they spied due to math and computers, then you avoid NSA spying with better math and better computers. If they spied by broadly subverting a huge number of companies and organizations, as appears to be the case, then you avoid NSA spying by avoiding the American tech industry. This is tremendously damaging.

joe_the_user• 13 years ago

Well,

You could say that technically he wants the NSA to secretly have the ability to secretly snoop on anyone but somehow not use it widely despite the complete lack of oversight, the fact that they have done each time they were given the option, etc.

rhizome2• 13 years ago

Your comment seems reasonable, but you don't speak to the elephant in the room: who the NSA spies on. It's not supposed to be "everyone."

agilord• 13 years ago

I think its reasonable that as a US citizen you're okay with the NSA being able to break crypto.

Because the world is divided to US citizens or the bad guys? C'mon, there is a non-US world out there, who are not bad guys, but who've just lost every respect for the US tech sector.

kelnos2• 13 years ago

I think we (on HN) underestimate just how OK a large part of the US is about all of this stuff. "The terrorists" in many ways have already won: people are scared. My take on it is that a large part of the US populace (and also in other parts of the first world) believe that giving up what we on HN consider essential liberty is a fine trade-off for some extra security (real or imagined).

Yes, the Snowden disclosures have tipped many people (who were on the fence) toward an active dislike of what US intelligence agencies are doing, but I think there is still a very large percentage of people -- perhaps even still a majority -- who truly think all this makes them safer, and that the cost is worth it. I won't pretend to understand that point of view, but... there it is.

rtpg• 13 years ago

I never got the unelected point.

Do you think these initiatives are strictly done at the NSA level? At one point an elected official (being the top of the chain in the executive and the legislative) agreed to this stuff happening.

In what universe do we build a government where everyone is an "elected official"?

the_french• 13 years ago

The way I've understood the recent leak was that we know the NSA has been concentrating on breaking SSL, 4G and others but that the actual techniques haven't been revealed. Besides, I feel that it is very important to know that bank, internet, and wireless security have been comprised by at least one actor.

jmadsen2• 13 years ago

I'm not going to come out on either side on this yet, still thinking about it.

But to anticipate those who will say, "do you think the bad guys are really dumb enough to use basic encryption techniques?" -

The 1993 (failed) World Trade Center bombers were caught because they went back to the rental truck company to try to collect the deposit on the "stolen" truck.

So yes, some of them certainly are.

sillysaurus27• 13 years ago

They have children, though, and some of those children are probably smart, and might train their old men to use Tarsnap via Tor in order to transmit encrypted messages/photos/other data anonymously and securely.

I'd imagine the NSA is concerned about future intelligent adversaries who have finesse, which is why they stay as far as possible ahead of the curve.

(I'm trying to come up with an alternative to our standard explanation of "the NSA does this because it's a soulless governmental machine that wants access to the world's information for corrupt purposes.")

jmadsen2• 13 years ago

LOL - actually, OT but lot of recent articles are showing that "young people know all about computers" is a complete falsehood.

sliverstorm5• 13 years ago

I'd imagine the NSA is concerned about future intelligent adversaries who have finesse

I'd imagine the NSA already has such adversaries. Note how difficult it appears to be to track down members Al-Qaeda, and how relatively well-informed bin Laden's hiding scheme was. There are doubtless also other less-publicized malicious operations of the same breed.

tomasien2• 13 years ago

I wonder what criteria Snowden used in his disclosures in terms of what to release and what not to release.

alan_cx• 13 years ago

I thought that was what the Guardian's lawyers job was.

mpyne4• 13 years ago

Snowden himself was quite clear in his initial interview that he was being selective with what he took (if not what he actually released to the journalists), in order to set himself apart from Manning's behavior.

milsorgen• 13 years ago

Hopefully none. The information should be free to the public that paid for it. You can sit here and quiver over national security or how some "know better than others" and how they can be trusted with information that the public can't. But at the end of the day that is all verbal excriment, tax dollar paid information is property of the tax payers and anyone that argues against that is living with their head in the sand.

tomasien2• 13 years ago

Anyone who ends a tenuous argument with "anyone who argues against this is (insert any insult here)" is being ridiculous.

ChuckMcM• 13 years ago

Per the article the gains that were made in breaking existing systems have been made public, so all of that effort goes for naught as people move on to new systems (which requires all new efforts). Basically if you want to consider the "cost" (as in $$) of Snowden's leaks, this shows a bunch of budget $$s that were spent on the assumption that these broken systems would remain in use for a period of time. Since that assumption is removed, the $$s spent on breaking those systems won't be as useful as forecast, hence the cost estimate.

That said, at the big crypt-a-geddon moment, when Leon Panetta said [1] "It does not mean that the Department of Defense will monitor citizens’ personal computers. We're not interested in personal communication or in e-mails or in providing the day to day security of private and commercial networks. That is not our goal. That is not our job. That is not our mission." he was lying. Both by omission and by commission.

And perhaps the most painful aspect of Snowden's act is that by exposing this failure of integrity in the NSA, they will never again be able to take the "high road" of we need this to defend the nation.

[1] http://www.defense.gov/speeches/speech.aspx?speechid=1728

masswerk• 13 years ago

Now this is quite a national-biased view (again). On the other hand standards, protocols, and the trust in networks are an international affair as well. So what is probably a future damage viewed from a national side is a damage already caused from an international point of view.

malandrew3• 13 years ago

    "For what it's worth, this is about the point where I get 
    off the Snowden train. It's true that some of these 
    disclosures are of clear public interest. In particular, 
    I'm thinking about the details of NSA efforts to 
    infiltrate and corrupt the standards setting groups that 
    produce commercial crypto schemes."

If anything this new information should put more people on the Snowden train. In the 90s, legislation was proposed which would have put backdoors everywhere via the Clipper Chip. Back then, we voted against that bill and all was good. This new information is shocking because we've already told the government that backdooring things was unacceptable behavior, yet they've done so anyways. We should all be outraged by this because it clearly doesn't represent the interest of the people.

anigbrowl• 13 years ago

I can't any record of a Congressional vote on the subject, only that its adoption was the subject of a proposed FIPS #185. I don't think your statement above is founded in fact.

I refer you to Michael Froomkin's lengthy but readable analysis from 1996: http://osaka.law.miami.edu/~froomkin/articles/planet_clipper...

lukejduncan• 13 years ago

That stood out to me too. It's exactly at that point I would hope for the opposite reaction in the general public.

rondon• 13 years ago

Maybe Kevin Drum can provide the government a live encrypted feed of his family's bathroom and bedroom. I'm sure they will only crack the encryption if they think a bad guy is on the video.

ewoodrich3• 13 years ago

The Clipper Chip didn't fail because of any vote, and a Congressional vote wasn't really necessary because it was intended to be a "opt-in" technology mainly for telcos and electronics manufacturers. It was never adopted due to backlash and criticism, but it's not as if they were explicitly banned from similar pursuits.

Of course, that isn't to say that this justifies recent actions or is really even relevant to the latest releases, but you made the connection.

http://en.wikipedia.org/wiki/Clipper_chip

malandrew3• 13 years ago

Thanks for the correction. I recalled history correctly since I was young at the time and failed to fact check.

stfu• 13 years ago

It should be noted that Mother Jones is generally regarded as a left-wing magazine - even by Wikipedia's description. [1]

From my understanding left-wing ideology has always placed the interest of the collective, represented by the state, over the interest of the individual. So the article and the author's conclusion seems to me completely in line with this way of thinking.

[1] https://en.wikipedia.org/wiki/Mother_Jones_(magazine)

calibraxis• 13 years ago

Depends on what you mean by "left". The Democrats are called left in the US, but clearly right-wing by much of the world's standards. It's a business party. If you mean leftists like the anarchist-influenced Occupy movement (like David Graeber [1] who popularized "We are the 99%"), well obviously there's many anti-statist leftists. (No one's going to accuse anarchists of being pro-state.)

[1] http://en.wikipedia.org/wiki/David_Graeber

toyg4• 13 years ago

That's a very simplistic view of a very complicated history of political theories.

Anarchism, a doctrine that explicitly negates the State, is rooted squarely in the leftist camp as classically intended, and gives individuals freedom from being coerced in any collective action whatsoever.

You also have Libertarian Socialism, probably the most romantic of all leftist ideologies, which tries to bring collectivist and individualist theories together.

And then of course, the very source of the meaning of "left": the French Revolution, with its rights trifecta of freedom, fraternity and equality, which was born in complete opposition to the notion of the superiority of the State over individuals.

Saying "left-wing ideology has always placed the interest of the collective, represented by the state, over the interest of the individual" is like saying "right-wing ideology has always placed the interest of the rich, represented by the individual, to screw the poor, over the interest of society to improve as a whole" -- a simplistic mystification.

notdrunkatall2• 13 years ago

Not always, but as it is practiced today in the United States, most certainly.

windexh8er• 13 years ago

Kevin Drum (edited name) was relegated to an old guy who really doesn't get it when I read that paragraph. I understand the need to the NSA to have countermeasures and options - however this is in the public interest as it puts disclosure, privacy and breach laws in a very awkward position. It also asserts that there is no expectation of privacy within US borders on the Internet - that is unacceptable and complete bull shit. Soghoian said it best recently when he stated that it is not OK for the NSA to possess dragnet capabilities on all crypto.

Sorry Kevin, I think you've gotten off the wrong train - you landed in the land of complacency.

mpyne4• 13 years ago

It also asserts that there is no expectation of privacy within US borders on the Internet - that is unacceptable and complete bull shit.

Have you solved the problem of bright-line jurisdictional boundaries on the Internet? That doesn't just interest the NSA, it would surely interest tax agencies around the world.

ericlavigne4• 13 years ago

It sounds like you're misunderstanding Kevin Drum's statement.

The sentences that you quoted are examples of leaks that Kevin Drum believes were in the public interest. Kevin supports these leaks because they are about what the NSA chooses to do, and are therefore necessary for public debate about US policy.

Kevin clearly distinguishes between leaking NSA behavior (as in your quote) and leaking NSA capabilities (which is in the following paragraph). The ability to decrypt certain types of encryption is the sort of technological advancement that we should expect military and intelligence agencies to make and to keep secret.

Here's the part where Kevin talks about specific Snowden leaks (about NSA capabilities) that he disagrees with:

   "But the rest of it is a lot more dubious. It's
   not clear to me how disclosing NSA's decryption
   breakthroughs benefits the public debate much,
   unlike previous disclosures that have raised
   serious questions about the scope and legality of
   NSA's surveillance of U.S. persons. Conversely,
   it's really easy to see how disclosing them harms
   U.S. efforts to keep up our surveillance on
   genuine bad guys. Unlike previous rounds of
   disclosures, I'm a lot less certain that this one
   should have seen the light of day."

Achshar• 13 years ago

How is knowing a crypto is no longer strong not in public interest? We would most certainly like to know if they have broken RSA somehow.

38252• 13 years ago

Please tell me how we can talk about NSA behavior without disclosing capability used to enable such behavior.

ig1• 13 years ago

Article 12. (The Universal Declaration of Human Rights)

"No one shall be subjected to arbitrary interference with his privacy, family, home or correspondence, nor to attacks upon his honour and reputation. Everyone has the right to the protection of the law against such interference or attacks."

brudgers• 13 years ago

All the latest revelations show is that corporate and consumer encryption is just corporate and consumer encryption. It's never going to phase a state sponsored intelligence organ. What they can't decrypt, they buy, what the cannot buy they subvert or cripple or backdoor.

In fairness, it would be grossly unprofessional if they did not. The three letter agencies take pride in their craft and part of their job is staying in front of any wide spread encryption technology.

blcknight3• 13 years ago

We need to stop posting these non-technical ravings of people who haven't a clue. Kevin Drum can certainly have an opinion about the NSA (and he's mostly wrong, I think), but his musings about what the NSA can do is clearly uninformed.

He seems to believe that all commercial crypto is suspect; and there exists some other nebulous category called "strong crypto." D'oh! If only we had all been so smart enough to use this obviously better "strong crypto" instead of "commercial." It's meaningless. The NSA has it's hands in all the crypto cookie jars.

The NY Times slides:

http://www.nytimes.com/interactive/2013/09/05/us/documents-r...

give us some new details that have some usable specifics that can be gleaned.

kalkin2• 13 years ago

You beat me to this complaint.

drcode• 13 years ago

Exactly. The idea that the NSA has can break arbitrary SSL without access to source keys is an EXTRAORDINARY CLAIM that goes against most of what we know about the science of cryptography.

Just some managment type in the government saying a single time that the government has made "major breakthroughs" in cracking SSL does not meet the standard of ETRAORDINARY EVIDENCE.

a3n• 13 years ago

"It's not clear to me how disclosing NSA's decryption breakthroughs benefits the public debate much,"

Backdoors, bought or coerced. If I obtain crypto capability, I expect it to be at least as good as advertised.

Or, in other words, they went to the public in the 90s and asked for Clipper. They were denied. So they went against the public and implemented what they were told, by their supposed masters, that they couldn't have.

If your dog is eating your children, is he your dog?

kalkin2• 13 years ago

The distinction which is the basis of this article between "commercial" and "strong" encryption seems confused. Kevin Drum in this post makes it sound as if commercial encryption is algorithmically weaker, which as a rule it is not, rather than just easier for the NSA to plant backdoors in by strongarming vendors.

The distinction matters here since we're meant to believe that most "bad guys.. figured that ordinary commercial crypto provided sufficient protection." But this translates to, they trusted Google, Microsoft et al. That seems less likely to me.

Disclaimer: I am not a cryptographer or security researcher. (On the other hand, given that I've done various kinds of antiwar political organizing and associated with members of Muslim Student Associations whose infiltration by NYPD later became a matter of public record, maybe I can speak as a government-classified "bad guy!" I should really do an FOIA request one of these days...)

sillysaurus27• 13 years ago

You know, there's one very valuable piece of info that I don't think has been revealed anywhere yet, or I missed it:

Recall, for example, Glenn Greenwald's admission that he "almost lost one of the biggest leaks in national-security history" because Snowden initially insisted on communicating with strong crypto and Greenwald didn't want to be bothered to install it.

What exactly did Snowden insist Greenwald do, precisely? Whatever Snowden insisted on, it's guaranteed to be an NSA-proof method of communication. So it seems like it's an essential first step to figure out the details and train people to use it habitually.

ewoodrich3• 13 years ago

A document properly encrypted with AES or similar modern methods would be considered "strong crypto" (using the article/'90s political terminology) and would be infeasible with current computing power to crack (assuming AES does not have a major vulnerability/backdoor, which has yet to be discovered by the top security researchers who depend on it).

As tptacek and others frequently say: "Crypto is hard to do right".

There is sufficient encryption technology to evade the NSA (at this point in time) but the social-engineering aspects and difficulty confirming a bug-free, secure implementation present the most issues.

sillysaurus27• 13 years ago

Indeed, which is precisely why it's so valuable for us to figure out exactly what Snowden insisted on: it addresses every single one of the problems you mention, which is no small feat.

gwern• 13 years ago

PGP email. And Snowden has already specifically stated that a PGP/GPG encrypted document is safe from the NSA (assuming no one leaves around a plaintext or private key, anyway).

sillysaurus27• 13 years ago

I appreciate your comment, thank you. May I ask for a source where you got your info? It's probably accurate, but it's good practice to insist that hearsay not be trusted on faith.

EDIT: Ah, it appears to be confirmed at http://www.huffingtonpost.com/2013/06/10/edward-snowden-glen... ... Thanks!

blcknight3• 13 years ago

"Encryption works. Properly implemented strong crypto systems are one of the few things that you can rely on. Unfortunately, endpoint security is so terrifically weak that NSA can frequently find ways around it." - http://www.theguardian.com/world/2013/jun/17/edward-snowden-...

Bruce Schneier has said something similar, having seen some of the guardian documents. https://www.schneier.com/blog/archives/2013/09/the_nsas_cryp...

brudil• 13 years ago

Going by [1] it seems like PGP. "Snowden only wanted to communicate securely using PGP encryption, for which Greenwald didn’t have the proper software installed at the time."

[1] http://www.huffingtonpost.com/2013/06/10/edward-snowden-glen...

sillysaurus27• 13 years ago

In an interview with The Huffington Post, Greenwald acknowledged that he's no expert in using such technology and said that Snowden even provided a step-by-step email and video to help secure their communication.

I wish Greenwald would publish that step-by-step email. It's probably one of the most valuable HOWTOs ever written, because only Snowden (and his colleagues) know for a fact what steps are NSA-proof.

casca• 13 years ago

Bear in mind that as soon as Snowden started communicating with Greenwald, he knew that he was going to flee the US within a short time period, after which there would be little damage in the NSA decrypting the historical communication logs. As such, knowing which mechanism he would choose for encryption that was required to be secure for only a few months might not be that useful.

Zigurd• 13 years ago

Schneier has pretty much outlined how to communicate with reasonable assurance of security while he is working on Snowden document: Use an air-gapped machine for your work, and a separate Internet-connected machine to send and receive documents encrypted offline.

But this is just the logical conclusion if you believe: a) Crypto math works b) The NSA has zero-day exploits for every system.

Steuard2• 13 years ago

It's very valuable to see this reaction to the latest Snowden disclosures: I expect it will be common, and the tech community needs to be prepared to make it clear why this really does reflect another betrayal of trust.

Personally, I can't blame the NSA for trying to intercept and read lots of "suspicious" internet traffic: that's their job. Governments do this, and whether it's good or bad, it's expected. (I'm not happy about the degree to which the NSA seems to be stretching the rules against them acting domestically, nor am I happy about massive all-encompassing interceptions rather than targeted ones, but those are separate issues.)

So there really is a legitimate argument that these latest Snowden disclosures damage national security. The thing is, they also indicate that the NSA has been doing its expected work by actively weakening the protections that we (and large parts of the global economy) depend on. Their actions and strategies have also undermined global confidence in American technology companies. And those are factors that I think the average watcher (like the author of this article) may not recognize unless folks like us point it out.

kordless• 13 years ago

We definitely all need to step up and help explain this shit to other people. It's a challenge to understand for a layman.

GoodIntentions• 13 years ago

Not really a challenge. This is how I explained it to my non-technical father years ago:

"Nothing you do online is anonymous. There is a record of everything you do."

He understood it right away and ( I think ) has always treated everything online as public. No need to go into any technical details.

sehugg• 13 years ago

The author has posted an update which kinda-sorta retracts this article: http://www.motherjones.com/kevin-drum/2013/09/hed

nly• 13 years ago

It's a shame we'll likely never see the "Annexe (available to BULLRUN indoctrinated staff)" that contains a breakdown of their capabilities.

sliverstorm5• 13 years ago

Give it fifty years. They seem to have been pretty good about releasing documents from the Cold War.

cjdrake• 13 years ago

False. A scale of 1 to 10 only goes to 10. :).

B0Z• 13 years ago

I have a question from the article that I hope someone here can answer... What's the difference between simple encryption and the "strong" encryption Snowden was insisting on? Truecrypt volumes?

nraynaud• 13 years ago

we need facts, the list of compromised ciphers, the bugs they are exploiting etc. I guess those NSA guys can't travel abroad, since spying is a felony in most countries.

kawera• 13 years ago

we need facts, the list of compromised ciphers, the bugs they are exploiting etc

More than that, we need the names of those involved.

reader5000• 13 years ago

You know, it's really only an accident of history that human communication historically primarily took place through air vibrations (which are difficult to acquire, store, and query). Digital communication is a new medium with different principles of interpretation. It is stupidly cheap to algorithmically monitor and query digital comms on a mass scale. Why wouldn't it be done? If you think the NSA is the only institution in the world doing this you're an idiot. The only thing Snowden accomplished was demonstrating how large an undisciplined joke US intel is that a high school graduate with a narcissism complex could accomplish these leaks.

Here's an idea: if you don't want your neckbeard anime discussions pinged by the world's intel/ad agencies, don't digitize and broadcast them over the internet.

grannyg00se• 13 years ago

What is this strong crypto vs weak crypto he's talking about? Apparently strong crypto is more of a PITA I gathered that much. But weak crypto is no crypto. If you are going to go through the trouble of using any at all how much more annoying is it to use NSA proof methods? Has any well established crypto methodology been declared broken because of Snowden leaks?

dinkumthinkum• 13 years ago

This so horribly misinformed or just naive. The "bad guys" should assume the sites can read their data or the NSA has the private keys or whatever ... I mean really? This is the straw that breaks the camels back ... That "bad guys" didn't known "the man" was actually serious about reading their data?

at-fates-hands• 13 years ago

"and the protection used on fourth-generation, or 4G, smartphones."

This quote was particularly eye opening to me.

In the early 2000's I remember speaking to a Verizon engineer who said their encryption on CDMA was bulletproof. He went on to explain over the course of an hour how impossible it was to crack their encryption or even eavesdrop on their network.

See page 34 here: http://www.scribd.com/doc/22599374/Security-Encryption-in-GS...

"The security protocols with CDMA-IS-41 networks are among the best in the industry. By design, CDMA technology makes eavesdropping very difficult, whether intentional or accidental. Unique to CDMA systems, is the 42-bit PN(Pseudo-Random Noise) Sequence called “Long Code” to scramble voice and data. On the forward link (network tomobile), data is scrambled at a rate of 19.2 Kilo symbols per second (Ksps) and on the reverse link, data is scrambled ata rate of 1.2288 Mega chips per second (Mcps). CDMA network security protocols rely on a 64-bit authentication key(A-Key) and the Electronic Serial Number (ESN) of the mobile"

jdiez17• 13 years ago

Holy shit, that's a whole lot of nothing.

gmuslera• 13 years ago

Another shoot the messenger article. Somewhat they try to convince us that every single person ten miles around NSA is basically an archangel, incorruptible and honest, that work just for justice and fairness, and given by God the right of being over everyone else rights. And everyone in the other side must be punished, stripped of privacy and intellectual property and keep be unsafe while there are "bad" people around.

This really means that thousands (hundreds of thousands?) of people which ultimate goal is to get money, and have little to none auditing on what they do, some NSA employees, some from private companies, can access your trade secrets, your bank account, or whatever that can be used to blackmail you, and make any kind of profit from it, no matter from where you are, or who you are. And that won't be even noticed by the authorities (if they even care, they have the "state secret" wildcard) unless they become public on that (they noticed what Snowden did because he went public, on pourpose). And that also means that that information (that they are "careful" having it safe) on which vulnerabilities they introduced on pourpose on every kind of "secure" software, if ever leaks, get reverse engineered or found out by luck, will be exploited by the bad guys too.

Hanlon's razor is not an excuse for this kind of article anymore.

lakeeffect• 13 years ago

What are the implications of this on bitcoin? Seeking a technical understanding of farming bitcoins.

enko• 13 years ago

It's not clear to me how disclosing NSA's decryption breakthroughs benefits the public debate much, unlike previous disclosures

Well, that's the problem with trying to keep everything secret. If the majority of these "disclosures" were in the public interest - they should have been public knowledge. That would have made it far less likely for someone like Snowden to feel the need to "blow the whistle".

There is such a thing as a "presumption of trust", which the NSA has squandered. They likely had it before these leaks began, but now they have lost it, no-one listens even when they might have a good point.

notdrunkatall2• 13 years ago

What's the latest news on Snowden? Is he still holed up in Russia? Have they started prodding him for information in return for protection yet?

Qantourisc• 13 years ago

Does anyone has a list of what is considered unsafe now ?

frank_boyd• 13 years ago

“These capabilities are among the Sigint community’s most fragile, and the inadvertent disclosure of the simple ‘fact of’ could alert the adversary and result in immediate loss of the capability,”

That's a statement designed to mislead.

"the adversary" certainly assumes that the NSA does what it does and acts accordingly.

Now, if "the adversary" is the general public, then the statement actually makes sense.

EDIT: The consumer is indeed part of "the adversary":

Extract of one of Snowden's documents: "These design changes make the systems in question exploitable through Sigint collection … with foreknowledge of the modification. To the consumer and other adversaries, however, the systems' security remains intact." Taken from http://www.theguardian.com/world/2013/sep/05/nsa-gchq-encryp...

bsaul• 13 years ago

One theoretic question : suppose that the nsa did manage to crack encryption using very advanced technology such as quantum computers. Would that seem outrageous as well ?

I don't think people would have reacted the same. On this subject i believe what piss people off is the mean rather than the result. Somehow people hoped for a smarter NSA, not for a meaner one.

But that's a bit naïve isn'it ? After all they're here to save lives in the end.

Snowden Disclosures Finally Hit 12 on a Scale of 1 to 10

Related Stories