Slashdot Mirror
FREAK, Logjam, DROWN All a Result of Weaknesses Demanded By US Gov't (csoonline.com)
itwbennett writes: You need look no further than the FREAK and Logjam attacks in 2015 and the DROWN attack announced just this week to get a sense of 'the dangers of deliberately weakening security protocols by introducing backdoors or other access mechanisms like those that law enforcement agencies and the intelligence community are calling for today,' writes Lucian Constantin. But this isn't a new problem. 'One approach [the government] used throughout the 1990s [to keep encryption under its control] was to enforce export controls on products that used encryption by limiting the key lengths, allowing the National Security Agency to easily decrypt foreign communications,' says Constantin. 'This gave birth to so-called 'export-grade' encryption algorithms that have been integrated into cryptographic libraries and have survived to this day.'
The way around the stupid laws that do not protect anyone from anything, is to import crypto from outside the US that is better and more robust than the stupid crippled versions mandated by US Law.
Agent K: A *person* is smart. People are dumb, stupid, panicky animals, and you know it.
Why does this seem so difficult? I guess if you're reliant on them for money, but business has a vested interest in doing this right (well, one would think).
..so they can hoist their own petard themselves.
Seriously, US Gov't -- keep digging, you'll finish your grave soon 'nuff.
The "Civilized World" jumped the shark ca. 1973.
I remember the 1990's crypto wars. But we've also had plenty of time to refactor our code, create secure-by-default installations and disable insecure implementations. In fact, as an industry, we've done it before for SSL 2.0, MD5, SSL 3.0, RC4 and now SHA1.
I like his last line: "...let's hope that we won't make the same mistake again." Wasn't it John Paul Jones that said, "We have not yet begun to make mistakes!"? I might not have that right.
not that I'm in favor of government intervention, but those were all implementation errors. anything designed and built by humans has them.
nothing to see here - move along
Maybe because you haven't paid all your taxes?
Base libraries like these are often widely used but everybody assumes somebody else has done the code reviews and exploit testing. It took some major exploits like heartbleed to make people realize that OpenSSL was understaffed, full of cruft and really far from the ideal crypto library. Yes, in this case it was a downgrade exploit to an export cipher. That doesn't mean the US government is generally at fault for downgrade attacks, it's poor coding. That a library might have support for old yet known flawed protocols/algorithms for compatibility is a reasonable feature, but the handshake is supposed to verify the client and server connected in the best possible way. But it's so much easier to blame somebody else.
Live today, because you never know what tomorrow brings
It's not like it's hard to export things over the Internet, even if it's "against the law", and it only has to be done once.
This sounds like a law put in place more for "the feels" than to actually accomplish anything.
[ REDACTED by order of the NSA]
and my personal favorite:
excitingthingstodo.blogspot.com
Perhaps companies/groups that write such software could implement a "warrant canary." See https://en.wikipedia.org/wiki/...
Once you are served with a secret warrant, you are legally bound not to disclose that you have been served. They can however stop updating the "We have not been served" status on their website letting users/people know that they have been served.
If you work on an security project and haven't been served, please do this now. And blink twice if you can't say anything....
I remember those good old days and the choices you got to download software:
Click here if you're with the USA, or you want better encryption, or you're a terrorist, or you think this concept is retarded.
Click here if you're an idiot and outside the USA.
. . . . all the lamp-posts in DC have been changed out from the standard pole-and-boom to strictly vertical posts. It's as if the expected the citizens to one day rise up, and do the hoisting. . . . (evil grin)
Wow! This is hilarious! This is the exact subject I did my "technical writing" course on, back in my 4th year of computer science in 2000. And I came to the same conclusion back then too, that encryption was being artificially weakened. All this information was available back then and the writing was on the wall.
"says constantin" like he's some kind of crypto expert ir something. This is just theoreticall bullshit reporting
for using OpenBSD. Not subject to US laws. I always download from the Canadian mirrors, for initial install ISOs and software installs. Been an OpenBSD fan since 2001. It's my absolutely favorite OS hands down. It features outstanding laptop support like wireless chipset support and suspend, has a very comfortable refresh cycle (6 months) and is arguably faster and more secure than any Linux distro I've ever used, and I've been a *nix sysadmin since 1998.
Special NSA user with root rights and a separate password for every installation (on every OS and platform), so that leaked credentials for one computer doesn't affect any other - creation of such a user can be done during online activation.Yes that requires that online activation should be secure process. I don't think this is genius idea, but it should be better than a backdoor in every OS that can be used with no credentials check.
I'm all for government bashing, but the downgrade attacks would not have happened if the message format included a list of supported SSL/TLS versions.
Government did a bad thing. The protocol designers however were not good enough to consider transition periods.