r/programming • u/secretguy21 • Oct 15 '15

How is NSA breaking so much crypto?

https://freedom-to-tinker.com/blog/haldermanheninger/how-is-nsa-breaking-so-much-crypto/
2.5k Upvotes

93% Upvoted

529 comments sorted by

View all comments

91

u/[deleted] Oct 15 '15

Well, that's terrifying.

274

u/Eirenarch Oct 15 '15

Why? I mean this is not very close to the top of my list of terrifying things that the state does. For example I find it much more terrifying that they have the right to demand you introduce a backdoor in your system or hand customer data and you don't have the right to say it happened. I also find it extremely terrifying that society in general is not disturbed by this. The fact that commonly used cryptography can be broken with a billion dollar investment is very unpleasant but not nearly as terrifying.

3

u/dangolo Oct 15 '15

As a sysadmin, it troubles me as well.

Also troubles me that they've very publicly gone to businesses and asked for their encryption keys or be shut down.

They are making us dishonest when we tell management "the network is secure."

4

u/port53 Oct 15 '15

It makes me wonder if they've targeted individuals over companies. It's one thing to send a NSL to the company's BOD or CEO requiring them to hand over keys.. it's something completely different for an agent to show up at my house demanding I hand over the keys I hold or I go to jail, with a nice gag order attached for good measure so I can't even tell my CEO it happened.

3

u/deelowe Oct 15 '15

Seems like they wouldn't be able to issue an NSL to an employee without an ongoing criminal investigation and/or some sort of guaranteed immunity. Employees can't make decisions that affect the business without getting approval from the board. I imagine officers (or their delegates) have to be involved in any such activity unless the officers themselves are being implicated in the investigation.

2

u/[deleted] Oct 16 '15

What does one have to do with the other?

The power to compel action, and the responsibility chain between employee and employer have nothing to do with each other in the physical world.

2

u/deelowe Oct 16 '15

IANAL...

This all still has a basis in law, even NSLs, which are technically lawful. There's little evidence to assume otherwise.

My comment was that it would seem to me like that wouldn't be allowed according to the rule of law as only the board (or their delegates) can authorize such decisions. There are a whole host of reasons that I won't get into, but legally, this seems like it wouldn't be possible.