shrike82 posted:

Yeah, I'm sure the CEO who got charged with insider trading was being unfairly persecuted...

GrizzlyCow posted:

It's not about him being unfairly persecuted. He probably did deserve what happened to him, but the story is about what leverage the NSA has to strong arm companies into designing backdoors into their technology. The fact alone that they waited until he said no to one of their schemes to prosecute him is telling enough. The victim in this case doesn't matter as except to highlight who is being targeted and coerced by the Government and into what.

Misogynist posted:

Not to mention that the entire reason they probably got wind of his insider trading was by digging through his communications for dirt once he pissed them off.

Negative Entropy posted:

Here's an article from the former head of security at Ben Gurion airport in which he tears apart the TSA. It's actually a reflection of the US national security apparatus as a whole (poor inter-department communication, lobbying based on greed and not expertise, dragnetting):
http://www.cracked.com/blog/7-reasons-tsa-sucks-a-security-experts-perspective/

Thanqol posted:

I'd actually be a lot more okay with this NSA poo poo if hundreds of CEOs got prosecuted in this way.

Misogynist posted:

This post isn't creepy at all.

Mister Fister posted:

I can't even comprehend selling out your customers and risking your entire business for a paltry 10 million dollars, there has to be more to that story about the RSA

GrizzlyCow posted:

There is the Trusted Platform Module. I'm not a computer guy, but there seems to be concerns about the TPM being able to control what you install on your computer and other stuff. We already know that the NSA spread malware to computers, so maybe they are taking advantage of this technology too? Microsoft is demanding all Windows computers sold in 2015 and onwards use TPM 2.0, and Microsoft is a known collaborator with the NSA.

Recommendation 5 on page 25 posted:

We recommend that legislation should be enacted that terminates the storage of bulk telephony meta-data by the government under section 215, and transition as soon as reasonably possible to a system in which such meta-data is held instead by private providers or by a third party. Access to such data should be permitted only with a section 215 order from the Foreign Intelligence Surveillance Court...

Chunjee posted:

So I'm guessing adobe or some other guys are going to be shooting for that storage contract.

Chunjee posted:

Ok so the CIA uses Amazon for their infrastructure, it should be safe to assume they would not both get service from the same provider; if they even act on this recommendation anytime in the future.

quote:

Since the first demonstration of the plausible future abilities of Google Glass, instant facial recognition has been one of the most exciting ideas in the pipeline. According the the development group Facial Network, the time for real-time facial recognition through Google Glass is coming a lot sooner than we originally expected. This isn't an app developed by Google, it's a 3rd party developer group - they've gone and done it first!

What you'll be seeing here is a very simple demonstration of the Glassware called NameTag. This Glass App is not yet available to the public, but is ready for up-close viewing with Glass - as this demo video shows. This app works with a vast collection of pre-programmed faces and allows you to recognized based on its cloud-based archive.


With NameTag, Glass users will be drawing from an archive that delves into the library of faces from dating networks, the National Sex Offendery Registry, and a set of criminal databases (public, the lot of them, of course). You'll also see this app recognizing celebrities galore.

NOTE: This app is different from the MedRef solution we saw earlier this year.

"I believe that this will make online dating and offline social interactions much safer and give us a far better understanding of the people around us. It’s much easier to meet interesting new people when we can simply look at someone, see their Facebook, review their LinkedIn page or maybe even see their dating site profile.

Often we were interacting with people blindly or not interacting at all. NameTag on Google Glass can change all that." - NameTag creator Kevin Alan Tussy

ANIME AKBAR posted:

I wonder which networks will broadcast it in the United States?

Mister Fister posted:

I can't even comprehend selling out your customers and risking your entire business for a paltry 10 million dollars, there has to be more to that story about the RSA

eSports Chaebol posted:

It might not have been an actual quid pro quo for a backdoor: the NSA could have just given them the money to use it without telling them why, or they could have lied and said it was more secure than everyone realized--after all, when they tinkered with DES it raised everybody's eyebrows, but it turns out they really did make it stronger instead of weaker. Of course that doesn't mean what RSA did was legitimate (and the algorithm was considered suspect even before it was confirmed to be backdoored).

quote:

In today's news of the weird, RSA (a division of EMC) has recommended that developers desist from using the (allegedly) 'backdoored' Dual_EC_DRBG random number generator -- which happens to be the default in RSA's BSafe cryptographic toolkit. Youch.

In case you're missing the story here, Dual_EC_DRBG (which I wrote about yesterday) is the random number generator voted most likely to be backdoored by the NSA. The story here is that -- despite many valid concerns about this generator -- RSA went ahead and made it the default generator used for all cryptography in its flagship cryptography library. The implications for RSA and RSA-based products are staggering. In the worst case a modestly bad but by no means worst case, the NSA may be able to intercept SSL/TLS connections made by products implemented with BSafe.

So why would RSA pick Dual_EC as the default? You got me. Not only is Dual_EC hilariously slow -- which has real performance implications -- it was shown to be a just plain bad random number generator all the way back in 2006. By 2007, when Shumow and Ferguson raised the possibility of a backdoor in the specification, no sensible cryptographer would go near the thing.
...
We can only speculate about the past. But here in the present we get to watch RSA's CTO Sam Curry publicly defend RSA's choices. I sort of feel bad for the guy. But let's make fun of him anyway.

I'll take his statement line by line (Sam is the boldface):

"Plenty of other crypto functions (PBKDF2, bcrypt, scrypt) will iterate a hash 1000 times specifically to make it slower."

Password hash functions are built deliberately slow to frustrate dictionary attacks. Making a random number generator slow is just dumb.

At the time, elliptic curves were in vogue

Say what?

and hash-based RNG was under scrutiny.

Nonsense. A single obsolete hash based generator (FIPS 186) was under scrutiny -- and fixed. The NIST SP800-90 draft in which Dual_EC appeared ALSO provided three perfectly nice non-backdoored generators: two based on hash functions and one based on AES. BSafe even implements some of them. Sam, this statement is just plain misleading.

The hope was that elliptic curve techniques—based as they are on number theory—would not suffer many of the same weaknesses as other techniques (like the FIPS 186 SHA-1 generator) that were seen as negative

Dual-EC suffers exactly the same sort of weaknesses as FIPS 186. Unlike the alternative generators in NIST SP800-90 it has a significant bias and really should not be used in production systems. RSA certainly had access to this information after the analyses were published in 2006.

and Dual_EC_DRBG was an accepted and publicly scrutinized standard.

And every bit of public scrutiny said the same thing: this thing is broken! Grab your children and run away!

SP800-90 (which defines Dual EC DRBG) requires new features like continuous testing of the output, mandatory re-seeding,

The exact same can be said for the hash-based and AES-based alternative generators you DIDN'T choose from SP800-90.

optional prediction resistance and the ability to configure for different strengths.

So did you take advantage of any of these options as part of the BSafe defaults? Why not? How about the very simple mitigations that NIST added to SP800-90A as a means to remove concerns that the generator might have a backdoor? Anyone?

There's not too much else to say here. I guess the best way to put it is: this is all part of the process. First you find the disease. Then you see if you can cure it.

quote:

Random numbers are critical for cryptography: for encryption keys, random authentication challenges, initialization vectors, nonces, key-agreement schemes, generating prime numbers and so on. Break the random-number generator, and most of the time you break the entire security system. Which is why you should worry about a new random-number standard that includes an algorithm that is slow, badly designed and just might contain a backdoor for the National Security Agency.

Generating random numbers isn't easy, and researchers have discovered lots of problems and attacks over the years. A recent paper found a flaw in the Windows 2000 random-number generator. Another paper found flaws in the Linux random-number generator. Back in 1996, an early version of SSL was broken because of flaws in its random-number generator. With John Kelsey and Niels Ferguson in 1999, I co-authored Yarrow, a random-number generator based on our own cryptanalysis work. I improved this design four years later -- and renamed it Fortuna -- in the book Practical Cryptography, which I co-authored with Ferguson.

The U.S. government released a new official standard for random-number generators this year, and it will likely be followed by software and hardware developers around the world. Called NIST Special Publication 800-90 (.pdf), the 130-page document contains four different approved techniques, called DRBGs, or "Deterministic Random Bit Generators." All four are based on existing cryptographic primitives. One is based on hash functions, one on HMAC, one on block ciphers and one on elliptic curves. It's smart cryptographic design to use only a few well-trusted cryptographic primitives, so building a random-number generator out of existing parts is a good thing.

But one of those generators -- the one based on elliptic curves -- is not like the others. Called Dual_EC_DRBG, not only is it a mouthful to say, it's also three orders of magnitude slower than its peers. It's in the standard only because it's been championed by the NSA, which first proposed it years ago in a related standardization project at the American National Standards Institute.

The NSA has always been intimately involved in U.S. cryptography standards -- it is, after all, expert in making and breaking secret codes. So the agency's participation in the NIST (the U.S. Commerce Department's National Institute of Standards and Technology) standard is not sinister in itself. It's only when you look under the hood at the NSA's contribution that questions arise.

Problems with Dual_EC_DRBG were first described in early 2006. The math is complicated, but the general point is that the random numbers it produces have a small bias. The problem isn't large enough to make the algorithm unusable -- and Appendix E of the NIST standard describes an optional work-around to avoid the issue -- but it's cause for concern. Cryptographers are a conservative bunch: We don't like to use algorithms that have even a whiff of a problem.

But today there's an even bigger stink brewing around Dual_EC_DRBG. In an informal presentation (.pdf) at the CRYPTO 2007 conference in August, Dan Shumow and Niels Ferguson showed that the algorithm contains a weakness that can only be described as a backdoor.

This is how it works: There are a bunch of constants -- fixed numbers -- in the standard used to define the algorithm's elliptic curve. These constants are listed in Appendix A of the NIST publication, but nowhere is it explained where they came from.

What Shumow and Ferguson showed is that these numbers have a relationship with a second, secret set of numbers that can act as a kind of skeleton key. If you know the secret numbers, you can predict the output of the random-number generator after collecting just 32 bytes of its output. To put that in real terms, you only need to monitor one TLS internet encryption connection in order to crack the security of that protocol. If you know the secret numbers, you can completely break any instantiation of Dual_EC_DRBG.

The researchers don't know what the secret numbers are. But because of the way the algorithm works, the person who produced the constants might know; he had the mathematical opportunity to produce the constants and the secret numbers in tandem.

Of course, we have no way of knowing whether the NSA knows the secret numbers that break Dual_EC-DRBG. We have no way of knowing whether an NSA employee working on his own came up with the constants -- and has the secret numbers. We don't know if someone from NIST, or someone in the ANSI working group, has them. Maybe nobody does.

We don't know where the constants came from in the first place. We only know that whoever came up with them could have the key to this backdoor. And we know there's no way for NIST -- or anyone else -- to prove otherwise.

This is scary stuff indeed.

Even if no one knows the secret numbers, the fact that the backdoor is present makes Dual_EC_DRBG very fragile. If someone were to solve just one instance of the algorithm's elliptic-curve problem, he would effectively have the keys to the kingdom. He could then use it for whatever nefarious purpose he wanted. Or he could publish his result, and render every implementation of the random-number generator completely insecure.

It's possible to implement Dual_EC_DRBG in such a way as to protect it against this backdoor, by generating new constants with another secure random-number generator and then publishing the seed. This method is even in the NIST document, in Appendix A. But the procedure is optional, and my guess is that most implementations of the Dual_EC_DRBG won't bother.

If this story leaves you confused, join the club. I don't understand why the NSA was so insistent about including Dual_EC_DRBG in the standard. It makes no sense as a trap door: It's public, and rather obvious. It makes no sense from an engineering perspective: It's too slow for anyone to willingly use it. And it makes no sense from a backwards-compatibility perspective: Swapping one random-number generator for another is easy.

My recommendation, if you're in need of a random-number generator, is not to use Dual_EC_DRBG under any circumstances. If you have to use something in SP 800-90, use CTR_DRBG or Hash_DRBG.

In the meantime, both NIST and the NSA have some explaining to do.

Paul MaudDib posted:

Coming soon to a portable computing device near you. Obviously there's massive privacy concerns from this, but it's a pretty obvious and inevitable application of the technology. Just the stream of metadata from this would be enormously intrusive. It would be a huge honeypot for government surveillance among other things.

CNN posted:

(CNN) -- The National Security Agency notched a much-needed win in court, after a series of setbacks over the legality and even the usefulness of its massive data collection program.

A federal judge in New York ruled Friday that the National Security Agency's bulk collection of data on nearly every phone call made in the United States is legal.

The ruling contrasts with another ruling last week by a federal judge in Washington, who called the same program "almost Orwellian" and likely unconstitutional.

In his ruling Friday, U.S. District Judge William Pauley said that while the NSA's program under Section 215 of the Patriot Act has become the center of controversy since it was revealed by leaks by former NSA contractor Edward Snowden, it is legal.

"But the question of whether that program should be conducted is for the other two coordinate branches of government to decide."

http://www.cnn.com/2013/12/27/justice/nsa-ruling/index.html

B B posted:

Another ruling on NSA collection, but this one takes the other side:


Guessing this is going to end up with SCOTUS at some point in the near term?

B B posted:

Another ruling on NSA collection, but this one takes the other side:


Guessing this is going to end up with SCOTUS at some point in the near term?

Aurubin posted:

He mentions 9/11 a bunch in his ruling. Sad that all you have to do is invoke that and people still jump.

EDIT:

Hell go back to 1920 and scream anarchists you get the same response. Then fascist, then commie, then terrorist. Worrying that the labels are getting even more generic, even when communist was distorted beyond recognition during the Cold War.

ACLU v. Clapper posted:

Regarding the statutory arguments, there is another level of absurdity in this case. The ACLU would never have learned about the section 215 order authorizing collection of telephony metadata related to its telephone numbers but for the unauthorized disclosures by Edward Snowden. Congress did not intend that targets of section 215 orders would ever learn of them. And the statutory scheme also makes clear that Congress intended to preclude suits by targets even if they discovered section 215 orders implicating them. It cannot possibly be that lawbreaking conduct by a government contractor that reveals state secrets—including the means and methods of intelligence gathering—could frustrate Congress’s intent. To hold otherwise would spawn mischief: recipients of orders would be subject to section 215’s secrecy protocol confining challenges to the FISC, while targets could sue in any federal district court. A target’s awareness of section 215 orders does not alter the Congressional calculus. The ACLU’s statutory claim must therefore be dismissed.

Washington Post posted:

Pauley is essentially saying that the targets of the order have no recourse to challenge the collection of their personal data because Congress never intended for targets to ever know that they were subject to this sort of spying. And that the fact that everyone knows about it now, thanks to Edward Snowden, doesn't change the targets' ability to challenge the legality of the order.

That suggests a troubling possibility: that even if there were clear-cut evidence that the government was sending out illegal 215 orders, the people harmed by the government's illegal conduct might not have any way to stop it. Instead, the only recourse may be for the recipient of an order (such as Verizon) to challenge it in the notoriously secretive Foreign Intelligence Surveillance Court. But Verizon isn't the one whose privacy is harmed by the order, so why would it expend legal resources to fight it?

While that outcome might seem a little crazy, it's not necessarily wrong as a matter of law. The Supreme Court has ruled in some cases, including Gonzaga v. Doe, that there can be cases where, even though the government's actions may be illegal, the individuals harmed can't sue to stop them. That still leaves room for challenging the statute on constitutional grounds. But in this case, Pauley dismissed the ACLU's constitutional arguments as well.

ACLU v. Clapper posted:

There is no evidence that the Government has used any of the bulk telephony metadata it collected for any purpose other than investigating and disrupting terrorist attacks. While there have been unintentional violations of guidelines, those appear to stem from human error and the incredibly complex computer programs that support this vital tool. And once detected, those violations were self-reported and stopped. The bulk telephony metadata collection program is subject to executive and congressional oversight, as well as continual monitoring by a dedicated group of judges who serve on the Foreign Intelligence Surveillance Court.

No doubt, the bulk telephony metadata collection program vacuums up information about virtually every telephone call to, from, or within the United States. That is by design, as it allows the NSA to detect relationships so attenuated and ephemeral they would otherwise escape notice. As the September 11th attacks demonstrate, the cost of missing such a thread can be horrific. Technology allowed al-Qaeda to operate decentralized and plot international terrorist attacks remotely. The bulk telephony metadata collection program represents the Government's counter-punch: connecting fragmented and fleeting communications to re-construct and eliminate al-Qaeda's terror network.

"Liberty and security can be reconciled; and in our system they are reconciled within the framework of the law." Boumediene, 553 U.S. at 798. The success of one helps protect the other. Like the 9/11 Commission observed: The choice between liberty and security is a false one, as nothing is more apt to imperil civil liberties than the success of a terrorist attack on American soil. The 9/11 Commission Report, at 395. A court's solemn duty is "to reject as false, claims in the name of civil liberty which, if granted, would paralyze or impair authority to defend [the] existence of our society, and to reject as false, claims in the name of security which could undermine our freedoms and open the way to oppression. American Comm'cns rear end'n, C.I.O. v. Douds, 339 U.S. 382, 445 (1950) (Jackson, J., concurring in part and dissenting in part.)

For all these reasons, the NSA's bulk telephony metadata collection program is lawful.

Combed Thunderclap posted:

I'm no legal expert, so anyone's free to correct me, but this logic seems incredibly disturbing from a layperson's perspective. All Congress need do, apparently, is imply an intent for part of a law to be secret and/or impossible to legally challenge, and it becomes impossible to adjudicate that section. And all the government need do is have a non-governmental entity collect data in order to collect the data itself without any threat of legal challenges. On top of all this, there were members of Congress who attempted to protest the interpretation of Section 215 but couldn't fully do so for fear of legal repercussions, thereby ensuring that Congress's "intent" is unilaterally interpreted.

quote:

Reinterpreted by some sarcastic judgment of my own:

• There has never, ever been any kind of abuse or problem with metadata collection, and there never ever will be. And when there was, it was an accident, and it was stopped really quick.
  
• Surveillance is constitutional as long as it is subject to checks and balances, like secret rulings by secret courts.
  
• We need technology to outwit al-Qaeda, an international terrorist organization that operates in many countries. Therefore, we must collect information about every single phone call made in America at all times.
  
• In order to protect civil liberties, we must prevent terrorist attacks, which would endanger civil liberties. Therefore, we must reject the attempt to declare the metadata collection program illegal, since it definitely doesn't contain any possibility for abuse (see above) and would prevent terrorist attacks (see above). This ruling therefore protects civil liberties.
  

quote:

There is no evidence that the Government has used any of the bulk telephony metadata it collected for any purpose other than investigating and disrupting terrorist attacks.

Geoff Peterson posted:

Forums Terrorist posted:

I hope you're all ready for a good loving courtesy of Scalia

Combed Thunderclap posted:

• In order to protect civil liberties, we must prevent terrorist attacks, which would endanger civil liberties. Therefore, we must reject the attempt to declare the metadata collection program illegal, since it definitely doesn't contain any possibility for abuse (see above) and would prevent terrorist attacks (see above). This ruling therefore protects civil liberties.
  

Broken Machine posted:

What are you hoping to accomplish with this post?

Geoff Peterson posted:

...

Do you have any issues with the legal analysis contained within?

Broken Machine posted:

No, other than that it seems pointless. I mean, the court decisions are generally going to reflect the desires of power, and they're going to justify whatever they want to using whatever specious logic they'd like. Mostly I was just wondering what you would say.

Geoff Peterson posted:

The inclusion of "generally" above allows one to handwave away this millennium's Kyloo (evidence obtained via warrantless thermal imaging is inadmissable), Jones (Placement and monitoring of a GPS device on a vehicle constitutes a search) and Florida v Jardines (a drug dog sniffing the front door of a home is a search requiring warrant)-among others, limiting the options of the those with "power".

"Desires of power" is incredibly vague as well. I find it difficult to believe that the "desires of power" were reflected in both Shelby County (VRA) and NFIB (PPACA) for instance-unless "power" refers the white conservative power structure in the former and the Administration in the latter (but explicitly not in the former). And that says nothing of Fisher v UT-A (Affirmative Action) where I imagine the country would be split nearly in half regarding what the "desires of power" (the reverse discrimination goal of the liberal elite or the expectation of special treatment by the photogenic white girl) were in the case-each side regarding themselves as the oppressed underdog.

The sentiment-which I've seen here and elsewhere and do not mean to single you out for-appears to be the privacy advocate's equivalent of the conservative's "judicial activism" rallying cry- with all the attendant vacuousness.

Unless, I suppose, "Desires of Power" is intended to mean the accepted interpretations of legitimately passed legislation by a duly elected Congress, viewed through the prism of controlling precedent regarding constitutional matters. If that was your intent, then... yes?

Geoff Peterson posted:

"Desires of power" is incredibly vague as well. I find it difficult to believe that the "desires of power" were reflected in both Shelby County (VRA) and NFIB (PPACA) for instance-unless "power" refers the white conservative power structure in the former and the Administration in the latter (but explicitly not in the former). And that says nothing of Fisher v UT-A (Affirmative Action) where I imagine the country would be split nearly in half regarding what the "desires of power" (the reverse discrimination goal of the liberal elite or the expectation of special treatment by the photogenic white girl) were in the case-each side regarding themselves as the oppressed underdog.

Unless, I suppose, "Desires of Power" is intended to mean the accepted interpretations of legitimately passed legislation by a duly elected Congress, viewed through the prism of controlling precedent regarding constitutional matters. If that was your intent, then... yes?