# Another Security Hole Brought To You By Uncle Sam **URL:** \ **Category:** Miscellaneous and Personal Stuff I Must Share\ **Created:** [March 3, 2015, 7:39pm UTC](https://boards.straightdope.com/t/another-security-hole-brought-to-you-by-uncle-sam/714126 "2015-03-03T19:39:27Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![Steve\_MB](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/steve_mb/32/5339_2.png) [@Steve\_MB](https://boards.straightdope.com/u/Steve_MB)\ **Post date:** [March 3, 2015, 7:39pm UTC](https://boards.straightdope.com/t/another-security-hole-brought-to-you-by-uncle-sam/714126/1 "2015-03-03T19:39:27Z")
At this point, bringing in yet more evidence of the stupidity of government undermining actual security in the name of surveillance-state “security” seems like piling on, but [this one](http://www.washingtonpost.com/blogs/the-switch/wp/2015/03/03/freak-flaw-undermines-security-for-apple-and-google-users-researchers-discover/) is just too perfectly apropos to ignore: > [@](#): > > Technology companies are scrambling to fix a major security flaw that for more than a decade left users of Apple and Google devices vulnerable to hacking when they visited hundreds of thousands of supposedly secure Web sites, including [Whitehouse.gov](http://Whitehouse.gov), [NSA.gov](http://NSA.gov) and [FBI.gov](http://FBI.gov). > > The flaw resulted from a former U.S. government policy that once forbid the export of strong encryption and required that weaker “export-grade” products be shipped to customers in other countries, say the researchers who discovered the problem. These restrictions were lifted in the late 1990s, but the weaker encryption got baked into widely used software that proliferated around the world and back into the United States, apparently unnoticed until this year. > > Researchers discovered in recent weeks that they could force browsers to use the old export-grade encryption then crack it over the course of just a few hours. Once cracked, hackers could steal passwords and other personal information and potentially launch a broader attack on the Web sites themselves… Bad ideas from the past come back to bite us all the time, to be sure, but rarely do they do so in such neat synchronicity with a drive to resurrect them from their well-deserved graves. ---
**Author:** ![iamthewalrus\_3](https://avatars.discourse-cdn.com/v4/letter/i/258eb7/32.png) [@iamthewalrus\_3](https://boards.straightdope.com/u/iamthewalrus_3)\ **Post date:** [March 3, 2015, 7:52pm UTC](https://boards.straightdope.com/t/another-security-hole-brought-to-you-by-uncle-sam/714126/2 "2015-03-03T19:52:48Z")
> [@Steve\_MB](#): > > Bad ideas from the past come back to bite us all the time, to be sure, but rarely do they do so in such neat synchronicity with a drive to resurrect them from their well-deserved graves. While I think that limits on encryption technology have proven to be a bad idea, I don’t think the case was nearly as clear-cut when they were first implemented. Back in the 60s and 70s, regular people didn’t rely on encryption for day-to-day security. It was pretty much just governments (and, later, banks). Wars are won and lost based on infosec, so it wasn’t a totally unreasonable idea to try to limit proliferation of the technology. And when normal people starting using computers regularly, the restrictions were relaxed. ---
**Author:** ![Ravenman](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/ravenman/32/2929_2.png) [@Ravenman](https://boards.straightdope.com/u/Ravenman)\ **Post date:** [March 3, 2015, 8:03pm UTC](https://boards.straightdope.com/t/another-security-hole-brought-to-you-by-uncle-sam/714126/3 "2015-03-03T20:03:03Z")
“Technology companies produce shitty software for ten years; blame government.” It’s like Silicon Valley has been taken over by Cliven Bundy. ---
**Author:** ![Steve\_MB](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/steve_mb/32/5339_2.png) [@Steve\_MB](https://boards.straightdope.com/u/Steve_MB)\ **Post date:** [March 3, 2015, 8:07pm UTC](https://boards.straightdope.com/t/another-security-hole-brought-to-you-by-uncle-sam/714126/4 "2015-03-03T20:07:14Z")
> [@iamthewalrus\_3](#): > > Back in the 60s and 70s, regular people didn’t rely on encryption for day-to-day security. Er, if your apologia boils down to “the government in the 1990s followed policy designed to address the situation as it existed in the 1960s and 1970s”, you might not want to take up a career in PR. I’m just saying… ---
**Author:** ![iamthewalrus\_3](https://avatars.discourse-cdn.com/v4/letter/i/258eb7/32.png) [@iamthewalrus\_3](https://boards.straightdope.com/u/iamthewalrus_3)\ **Post date:** [March 3, 2015, 8:17pm UTC](https://boards.straightdope.com/t/another-security-hole-brought-to-you-by-uncle-sam/714126/5 "2015-03-03T20:17:41Z")
> [@Steve\_MB](#): > > Er, if your apologia boils down to “the government in the 1990s followed policy designed to address the situation as it existed in the 1960s and 1970s”, you might not want to take up a career in PR. I’m just saying… The government made policy in the 60s to restrict export of strong encryption, which was reasonable policy at the time. Since then, the government has relaxed the restrictions to match current needs multiple times. The crappy standard in question here is one that was reasonable when it was the best thing allowed, and currently better encryption is allowed, but the code still exists to use the crappy one in many products, and there’s a way to trick software into using it.