# NSA Undermines Internet Security **URL:** \ **Category:** Great Debates\ **Created:** [September 6, 2013, 11:16am UTC](https://boards.straightdope.com/t/nsa-undermines-internet-security/668166 "2013-09-06T11:16:07Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![Steve\_MB](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/steve_mb/32/5339_2.png) [@Steve\_MB](https://boards.straightdope.com/u/Steve_MB)\ **Post date:** [September 6, 2013, 11:16am UTC](https://boards.straightdope.com/t/nsa-undermines-internet-security/668166/1 "2013-09-06T11:16:07Z")
[The latest in the string of dirty secrets](http://www.nytimes.com/2013/09/06/us/nsa-foils-much-internet-encryption.html) oozing out of the agency: > [@](#): > > The National Security Agency is winning its long-running secret war on encryption, using supercomputers, technical trickery, court orders and behind-the-scenes persuasion to undermine the major tools protecting the privacy of everyday communications in the Internet age, according to newly disclosed documents… Remember all the buzz about the possibility of an “electronic Pearl Harbor”? Well, it turns out that the NSA has been clipping random wires in the radar installation while running a blower fan to swirl tinfoil in front of the dishes. ---
**Author:** ![Evil\_Captor](https://avatars.discourse-cdn.com/v4/letter/e/f17d59/32.png) [@Evil\_Captor](https://boards.straightdope.com/u/Evil_Captor)\ **Post date:** [September 6, 2013, 11:23am UTC](https://boards.straightdope.com/t/nsa-undermines-internet-security/668166/2 "2013-09-06T11:23:05Z")
They just want to protect us from ourselves! Can’t you see that the TRUE enemy of the American people is the American people? ---
**Author:** ![BrokenBriton](https://avatars.discourse-cdn.com/v4/letter/b/4bbf92/32.png) [@BrokenBriton](https://boards.straightdope.com/u/BrokenBriton)\ **Post date:** [September 6, 2013, 11:45am UTC](https://boards.straightdope.com/t/nsa-undermines-internet-security/668166/3 "2013-09-06T11:45:18Z")
I find it extraordinary this is remotely legal. But then I thought the same about bank lending. And invading countries on bogus pretexts and killing hundreds of thousands of civilians without any accountability. What do I know. ---
**Author:** ![newcomer](https://avatars.discourse-cdn.com/v4/letter/n/e5b9ba/32.png) [@newcomer](https://boards.straightdope.com/u/newcomer)\ **Post date:** [September 6, 2013, 11:56am UTC](https://boards.straightdope.com/t/nsa-undermines-internet-security/668166/4 "2013-09-06T11:56:45Z")
Wait for either “Privacy: I don’t think it means what you think it means” (somewhat Orwellian) or “Privacy: It is naive to expect it” (somewhat Kafkaesque). However, judging from Syria related debates, the thread will focus on the most innocuous aspect of OP and run for miles. ---
**Author:** ![BrokenBriton](https://avatars.discourse-cdn.com/v4/letter/b/4bbf92/32.png) [@BrokenBriton](https://boards.straightdope.com/u/BrokenBriton)\ **Post date:** [September 6, 2013, 12:02pm UTC](https://boards.straightdope.com/t/nsa-undermines-internet-security/668166/5 "2013-09-06T12:02:33Z")
What I find very odd is the willingness on this board [of so many] to accept government behaviour. This really is not about ‘being American’ or some related indoctrination, it’s about the rights of citizens in a modern society and effective democracy. That’s all - not flag-draping my-govmint-right-or-wrong stupidity. ---
**Author:** ![Hermitian](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/hermitian/32/470_2.png) [@Hermitian](https://boards.straightdope.com/u/Hermitian)\ **Post date:** [September 6, 2013, 12:33pm UTC](https://boards.straightdope.com/t/nsa-undermines-internet-security/668166/6 "2013-09-06T12:33:41Z")
I’m still shocked that others are shocked about this. What do you think they use tens of thousands of people and hundreds of millions of dollars of computers for? Playing solitaire? I thought the idea of the NSA hoovering up every byte from communications that they could get their hands on was understood. Maybe not legal, maybe not liked, but expected. ---
**Author:** ![newcomer](https://avatars.discourse-cdn.com/v4/letter/n/e5b9ba/32.png) [@newcomer](https://boards.straightdope.com/u/newcomer)\ **Post date:** [September 6, 2013, 12:39pm UTC](https://boards.straightdope.com/t/nsa-undermines-internet-security/668166/7 "2013-09-06T12:39:18Z")
That was fast. ---
**Author:** ![Amateur\_Barbarian](https://avatars.discourse-cdn.com/v4/letter/a/59ef9b/32.png) [@Amateur\_Barbarian](https://boards.straightdope.com/u/Amateur_Barbarian)\ **Post date:** [September 6, 2013, 12:40pm UTC](https://boards.straightdope.com/t/nsa-undermines-internet-security/668166/8 "2013-09-06T12:40:20Z")
> [@Hermitian](#): > > I’m still shocked that others are shocked about this. Me, too, since it’s been pretty well known that the NSA has blocked or limited every encryption scheme that didn’t have a trapdoor or key. Why do you think the RSA algorithm t-shirt was “illegal”? > [@](#): > > What do you think they use tens of thousands of people and hundreds of millions of dollars of computers for? Playing solitaire? In theory, NSA was prevented from snooping and sweeping domestically. Theory, practice, patriot act, all that. ---
**Author:** ![davidm](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/davidm/32/225_2.png) [@davidm](https://boards.straightdope.com/u/davidm)\ **Post date:** [September 6, 2013, 12:43pm UTC](https://boards.straightdope.com/t/nsa-undermines-internet-security/668166/9 "2013-09-06T12:43:20Z")
This is obviously completely unacceptable. That said, the reports I’ve read bring out a little of the skeptic in me. It’s being stated that they’ve used influence to covertly introduce weaknesses into encryption standards used by software developers worldwide. These standards are, by definition, open and available to anyone. There are people all over the world, including amateurs and university computer science departments, constantly looking for weaknesses and trying to improve those standards. The idea that the NSA could “covertly introduce weaknesses” into those standards strikes me as questionable at best. Even if they could manage to do this, they’d be risking global financial chaos if the weaknesses were discovered, as is likely. Honestly, to me this sounds like a Hollywood version of the government and the NSA as omnipotent entities that can do anything and fool anyone. It’s like the version of the government believed in by 911 truthers and moon landing hoaxers. Anyone agree with me? Am I off base here? Is this just bad reporting? ---
**Author:** ![Amateur\_Barbarian](https://avatars.discourse-cdn.com/v4/letter/a/59ef9b/32.png) [@Amateur\_Barbarian](https://boards.straightdope.com/u/Amateur_Barbarian)\ **Post date:** [September 6, 2013, 12:54pm UTC](https://boards.straightdope.com/t/nsa-undermines-internet-security/668166/10 "2013-09-06T12:54:18Z")
> [@davidm](#): > > This is obviously completely unacceptable. So is most of what the last 12 years have wrought WRT privacy and security. Welcome to 2013, Rip. ☹ > [@](#): > > It’s being stated that they’ve used influence to covertly introduce weaknesses into encryption standards used by software developers worldwide. This is not news to anyone who’s been paying attention since at least, oh, Bamford’s _Puzzle Palace_. > [@](#): > > These standards are, by definition, open and available to anyone. There are people all over the world, including amateurs and university computer science departments, constantly looking for weaknesses and trying to improve those standards. The idea that the NSA could “covertly introduce weaknesses” into those standards strikes me as questionable at best. If you own the only ten-ton hammer in the world and don’t advertise the fact, most people would feel pretty safe with lockboxes that can’t be cracked with a five-ton hammer. NSA has ALWAYS had a basement full of ten-ton hammers and has guided security development to keep what is commercially and publicly available within their cracking range. This is, again, not news. ETA: That is, any encryption can be cracked if you have big enough computers. University types may feel safe knowing it takes X teraflops to crack a particular prime-based algorithm; NSA just smiles, with their basement full of petafloppers. ---
**Author:** ![tim314](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/tim314/32/3468_2.png) [@tim314](https://boards.straightdope.com/u/tim314)\ **Post date:** [September 6, 2013, 1:15pm UTC](https://boards.straightdope.com/t/nsa-undermines-internet-security/668166/11 "2013-09-06T13:15:35Z")
> [@davidm](#): > > It’s being stated that they’ve used influence to covertly introduce weaknesses into encryption standards used by software developers worldwide. So they didn’t just make sure they could read people’s emails and credit card transactions, they did it in a way that makes it a little bit easier for _anyone_ to read your emails and credit card transactions. If spying on us all is evil, then weakening security standards is evil[sup]2[/sup], IMO. You raise some good points about why this would be a terrible idea. But at this point, I don’t have any faith that the NSA would care about such concerns. ---
**Author:** ![Steve\_MB](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/steve_mb/32/5339_2.png) [@Steve\_MB](https://boards.straightdope.com/u/Steve_MB)\ **Post date:** [September 6, 2013, 1:29pm UTC](https://boards.straightdope.com/t/nsa-undermines-internet-security/668166/12 "2013-09-06T13:29:38Z")
> [@davidm](#): > > These standards are, by definition, open and available to anyone. There are people all over the world, including amateurs and university computer science departments, constantly looking for weaknesses and trying to improve those standards. The idea that the NSA could “covertly introduce weaknesses” into those standards strikes me as questionable at best. Even if they could manage to do this, they’d be risking global financial chaos if the weaknesses were discovered, as is likely. The standards themselves may be sound; [the way the NSA gets around that](http://www.theguardian.com/world/2013/sep/05/nsa-how-to-remain-secure-surveillance) is by subverting the implementions of those standards: [QUOTE=Bruce Schneier] The NSA deals with any encrypted data it encounters more by subverting the underlying cryptography than by leveraging any secret mathematical breakthroughs. First, there’s a lot of bad cryptography out there. If it finds an internet connection protected by MS-CHAP, for example, that’s easy to break and recover the key. It exploits poorly chosen user passwords, using the same dictionary attacks hackers use in the unclassified world. As was revealed today, the NSA also works with security product vendors to ensure that commercial encryption products are broken in secret ways that only it knows about. We know this has happened historically: CryptoAG and Lotus Notes are the most public examples, and there is evidence of a back door in Windows. A few people have told me some recent stories about their experiences, and I plan to write about them soon. _Basically, the NSA asks companies to subtly change their products in undetectable ways:_ making the random number generator less random, leaking the key somehow, adding a common exponent to a public-key exchange protocol, and so on. If the back door is discovered, it’s explained away as a mistake. And as we now know, the NSA has enjoyed enormous success from this program. (emphasis added) [/QUOTE] As for risking global financial chaos – this is an agency of the same government that _caused_ global financial chaos a few years ago with its see-no-evil attitude toward Wall Street shenanigans. ---
**Author:** ![Bricker](https://avatars.discourse-cdn.com/v4/letter/b/977dab/32.png) [@Bricker](https://boards.straightdope.com/u/Bricker)\ **Post date:** [September 6, 2013, 3:21pm UTC](https://boards.straightdope.com/t/nsa-undermines-internet-security/668166/13 "2013-09-06T15:21:46Z")
> [@Amateur\_Barbarian](#): > > ETA: That is, any encryption can be cracked if you have big enough computers. University types may feel safe knowing it takes X teraflops to crack a particular prime-based algorithm; NSA just smiles, with their basement full of petafloppers. Not true. Trivially, One-time pads and universal hash functions are completely secure in terms of simply being cracked by “big enough computers.” No matter how big, or how fast, those methods are unconditionally secure from computer decryption. But even forgetting those special cases, if I create an 16384-bit key, and encrypt something, and avoid factoring and discrete logarithms-based cryptography, any computer, no matter how big, runs into basic physics problems concerning how information storage and computation works if trying to brute-force that key. Now, admittedly, that 16384-bit key is unwieldy for use as a session key. But it’s perfectly workable for encrypting an e-mail. ---
**Author:** ![tim314](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/tim314/32/3468_2.png) [@tim314](https://boards.straightdope.com/u/tim314)\ **Post date:** [September 6, 2013, 3:41pm UTC](https://boards.straightdope.com/t/nsa-undermines-internet-security/668166/14 "2013-09-06T15:41:44Z")
> [@Bricker](#): > > Not true. Trivially, One-time pads and universal hash functions are completely secure in terms of simply being cracked by “big enough computers.” No matter how big, or how fast, those methods are unconditionally secure from computer decryption. > > But even forgetting those special cases, if I create an 16384-bit key, and encrypt something, and avoid factoring and discrete logarithms-based cryptography, any computer, no matter how big, runs into basic physics problems concerning how information storage and computation works if trying to brute-force that key. > > Now, admittedly, that 16384-bit key is unwieldy for use as a session key. But it’s perfectly workable for encrypting an e-mail. Are you talking about private key cryptography? Because if so, you of course have the problem of how you get the key to the person who will be reading the email. ---
**Author:** ![suranyi](https://avatars.discourse-cdn.com/v4/letter/s/e36b37/32.png) [@suranyi](https://boards.straightdope.com/u/suranyi)\ **Post date:** [September 6, 2013, 5:13pm UTC](https://boards.straightdope.com/t/nsa-undermines-internet-security/668166/15 "2013-09-06T17:13:33Z")
I think there are two separate issues here: The revelations that the NSA has been using its resources to figure out how to break codes should not be a surprise to anyone. That’s what its purpose is, that’s what it is funded to do, everybody knows that. The revelations that the NSA has been using that capabilty not just on “foreign” messages but on Americans is the really troubling thing, and the thing that is possibly illegal. ---
**Author:** ![tim314](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/tim314/32/3468_2.png) [@tim314](https://boards.straightdope.com/u/tim314)\ **Post date:** [September 6, 2013, 5:33pm UTC](https://boards.straightdope.com/t/nsa-undermines-internet-security/668166/16 "2013-09-06T17:33:45Z")
> [@suranyi](#): > > I think there are two separate issues here: > > The revelations that the NSA has been using its resources to figure out how to break codes should not be a surprise to anyone. That’s what its purpose is, that’s what it is funded to do, everybody knows that. > > The revelations that the NSA has been using that capabilty not just on “foreign” messages but on Americans is the really troubling thing, and the thing that is possibly illegal. It’s not just that, though. I mean, even if the NSA were only trying to read the communications of foreigners, the techniques they’re using (adding backdoors, weakening encryption protocols or their implementations) makes communication less secure for Americans, too. Ideally, foreigners who aren’t suspected of being terrorists or criminals wouldn’t have the privacy of their communications infringed on either (even if it’s legal under U.S. law for the NSA to do so). ---
**Author:** ![Bricker](https://avatars.discourse-cdn.com/v4/letter/b/977dab/32.png) [@Bricker](https://boards.straightdope.com/u/Bricker)\ **Post date:** [September 6, 2013, 5:36pm UTC](https://boards.straightdope.com/t/nsa-undermines-internet-security/668166/17 "2013-09-06T17:36:38Z")
> [@tim314](#): > > Are you talking about private key cryptography? Because if so, you of course have the problem of how you get the key to the person who will be reading the email. Sure. Private courier, on a USB stick. Or US Mail – the NSA isn’t opening people’s physical mail, are they? ---
**Author:** ![BrokenBriton](https://avatars.discourse-cdn.com/v4/letter/b/4bbf92/32.png) [@BrokenBriton](https://boards.straightdope.com/u/BrokenBriton)\ **Post date:** [September 6, 2013, 5:45pm UTC](https://boards.straightdope.com/t/nsa-undermines-internet-security/668166/18 "2013-09-06T17:45:47Z")
> [@Bricker](#): > > Sure. Private courier, on a USB stick. Or US Mail – the NSA isn’t opening people’s physical mail, are they? Well … funny you should mention that. The answer is ‘not quite’: > [@](#): > > the US Postal Service photographs the outside of every piece of mail it processes each year - around 160 billion pieces annually. > > At the request of law enforcement agencies, postal workers take pictures of the letters and packages before they are delivered, the New York Times reported. [http://rt.com/usa/us-nsa-mail-spying-706/](http://rt.com/usa/us-nsa-mail-spying-706/) ---
**Author:** ![Walton\_Firm](https://avatars.discourse-cdn.com/v4/letter/w/45deac/32.png) [@Walton\_Firm](https://boards.straightdope.com/u/Walton_Firm)\ **Post date:** [September 6, 2013, 5:53pm UTC](https://boards.straightdope.com/t/nsa-undermines-internet-security/668166/19 "2013-09-06T17:53:30Z")
They have not restricted themselves to passively “figuring out how to break codes”. They have strong-armed vendors of security software into deliberately making their products weaker than they could have made them, in order to enable the NSA (and anybody else who knows where to find the deliberately-introduced weakness) to crack them more easily. In other cases, they have stolen the ‘master keys’ used in commercial security software through clandestine means, rather than forcing those companies to cooperate “voluntarily”. Even if one would believe that they did this with the intent of snooping on foreigners using American-made software, and that any American users of such software are merely unintentional collateral damage, that’s still an awful lot of collateral damage. ---
**Author:** ![Smapti](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/smapti/32/17938_2.png) [@Smapti](https://boards.straightdope.com/u/Smapti)\ **Post date:** [September 6, 2013, 5:57pm UTC](https://boards.straightdope.com/t/nsa-undermines-internet-security/668166/20 "2013-09-06T17:57:03Z")
> [@](#): > > The agency treats its recent successes in deciphering protected information as among its most closely guarded secrets, restricted to those cleared for a highly classified program code-named Bullrun, according to the documents, provided by Edward J. Snowden, the former N.S.A. contractor. Wasn’t one of the conditions of Snowden’s asylum in Russia that he _stop_ telling the press more stuff about the NSA? I hope for his sake that this is something he let slip months ago and the Times just held on to it in anticipation of a slow news day. [Next page](https://boards.straightdope.com/t/nsa-undermines-internet-security/668166.md?page=2)