This article is from the source 'guardian' and was first published or seen on . It last changed over 40 days ago and won't be checked again for changes.

You can find the current article at its original source at http://www.theguardian.com/commentisfree/2013/sep/06/nsa-surveillance-revelations-encryption-expert-chat

The article has changed 7 times. There is an RSS feed of changes available.

Version 5 Version 6
Explaining the latest NSA revelations – Q&A with internet privacy experts Explaining the latest NSA revelations – Q&A with internet privacy experts
(12 days later)
Today, beginning at 3pm ET | 8pm BST, the Guardian's James Ball, who reported on the latest NSA and GCHQ revelations, and cryptology expert Bruce Schneier, who wrote about the implications, will take your questions on the new revelation that the US and UK governments can crack much of the encryption protecting personal data, online transactions and emails – as well as the ongoing debate over surveillance. Toss your questions below and as you wait for a response, re-visit yesterday's stories:Today, beginning at 3pm ET | 8pm BST, the Guardian's James Ball, who reported on the latest NSA and GCHQ revelations, and cryptology expert Bruce Schneier, who wrote about the implications, will take your questions on the new revelation that the US and UK governments can crack much of the encryption protecting personal data, online transactions and emails – as well as the ongoing debate over surveillance. Toss your questions below and as you wait for a response, re-visit yesterday's stories:
• How US and UK spy agencies defeat internet privacy and security• How US and UK spy agencies defeat internet privacy and security
• How internet encryption works • How internet encryption works 
• The US government has betrayed the internet. We need to take it back• The US government has betrayed the internet. We need to take it back
The Q&A is now over. The Q&A is now over. 
First Question: First Question: 
Can we trust open source? Of course it is more transparent than properietry, but if NSA has been influencing standard documents, what is stopping them penetrating free software?Can we trust open source? Of course it is more transparent than properietry, but if NSA has been influencing standard documents, what is stopping them penetrating free software?
Do we have evidence supporting/denying contamination of open source?Do we have evidence supporting/denying contamination of open source?
Answer: Answer: 
James Ball: Because the NSA and GCHQ have been influencing standards, and working to covertly modify code, almost anything could potentially have been compromised. Something as simple as – hypothetically – modifying a basic random-number-generator could weaken numerous implementations of open-source code.James Ball: Because the NSA and GCHQ have been influencing standards, and working to covertly modify code, almost anything could potentially have been compromised. Something as simple as – hypothetically – modifying a basic random-number-generator could weaken numerous implementations of open-source code.
That said, anything done to open source projects, particularly popular ones, will have to be subtle, as anyone can audit the code. So I do believe they’re more trustworthy/dependable than other things. But almost nothing is certain, and we see quite regularly bugs/vulnerabilities discovered in major open source projects that have lain undiscovered for months.That said, anything done to open source projects, particularly popular ones, will have to be subtle, as anyone can audit the code. So I do believe they’re more trustworthy/dependable than other things. But almost nothing is certain, and we see quite regularly bugs/vulnerabilities discovered in major open source projects that have lain undiscovered for months.
Question:Question:
Is there any reason to believe that these back doors have also been built into hardware?Is there any reason to believe that these back doors have also been built into hardware?
Answer: Answer: 
Ball: There’s every reason to think this. The Washington Post mentioned in passing last week the use of ‘implants’, and the New York Times’ take on this story made reference to efforts against “encryption chips”.Ball: There’s every reason to think this. The Washington Post mentioned in passing last week the use of ‘implants’, and the New York Times’ take on this story made reference to efforts against “encryption chips”.
Question:Question:
How hard do you think it will be to get people to take security seriously when people are willing to type so much personal data into Facebook/Google+ etc?How hard do you think it will be to get people to take security seriously when people are willing to type so much personal data into Facebook/Google+ etc?
Answer:Answer:
Ball: I think we need more awareness of privacy and security generally, and I think as generations grow up net-native (as today’s teens are), that’s taking care of itself. I don’t think people who volunteer information to a strictly-controlled network on Facebook (or webmail, etc) are automatically willing to share that same information with their governments. That’s a large part of what the whole privacy and security debate the NSA files are fueling is about, I think.Ball: I think we need more awareness of privacy and security generally, and I think as generations grow up net-native (as today’s teens are), that’s taking care of itself. I don’t think people who volunteer information to a strictly-controlled network on Facebook (or webmail, etc) are automatically willing to share that same information with their governments. That’s a large part of what the whole privacy and security debate the NSA files are fueling is about, I think.
Question:Question:
How would one go about selecting a VPN service that is still viable? All US-based ones are likely compromised via National Security Letters, and many foreign ones are probably hacked. Is there anything specific about a VPN service's transmission protocol (key exchange method) that may make it more reliable?How would one go about selecting a VPN service that is still viable? All US-based ones are likely compromised via National Security Letters, and many foreign ones are probably hacked. Is there anything specific about a VPN service's transmission protocol (key exchange method) that may make it more reliable?
Answer: Answer: 
Ball: As you say, I think this is quite difficult, but one thing that is worth flagging is we have a sense of what the US and the other “Five Eyes” nations (the UK, Canada, Australia and New Zealand) are doing, because we have a whistleblower from those agencies.Ball: As you say, I think this is quite difficult, but one thing that is worth flagging is we have a sense of what the US and the other “Five Eyes” nations (the UK, Canada, Australia and New Zealand) are doing, because we have a whistleblower from those agencies.
It’s not inconceivable that intelligence agencies in other countries are doing a lot of the same things (it would be surprising if they weren’t doing some of it) – but we won’t hear about them unless a Chinese, Russian, German, Indian, etc, Edward Snowden comes along. I hope they do.It’s not inconceivable that intelligence agencies in other countries are doing a lot of the same things (it would be surprising if they weren’t doing some of it) – but we won’t hear about them unless a Chinese, Russian, German, Indian, etc, Edward Snowden comes along. I hope they do.
Question:Question:
First off -- thanks to James and Bruce for taking some time to answer people's questions! I know a lot of us need answers in these uncertain times.First off -- thanks to James and Bruce for taking some time to answer people's questions! I know a lot of us need answers in these uncertain times.
Mine is a two-part question:Mine is a two-part question:
1.) What can the average internet user do to protect him- or herself from government snooping online?1.) What can the average internet user do to protect him- or herself from government snooping online?
2.) What can the average citizen do to help stop the NSA?2.) What can the average citizen do to help stop the NSA?
Thank you.Thank you.
Answer: Answer: 
Ball: Bruce had a great article yesterday (http://www.theguardian.com/world/2013/sep/05/nsa-how-to-remain-secure-surveillance) on what to do to try to secure your own communications. I think it’s a brilliant starting place, especially for journalists and activists. Even though he’s described it well, of course, I think it’s beyond the expertise levels of 95%+ of internet users. This stuff is seriously hard, and I hope the crypto community carries on trying to make it easier.Ball: Bruce had a great article yesterday (http://www.theguardian.com/world/2013/sep/05/nsa-how-to-remain-secure-surveillance) on what to do to try to secure your own communications. I think it’s a brilliant starting place, especially for journalists and activists. Even though he’s described it well, of course, I think it’s beyond the expertise levels of 95%+ of internet users. This stuff is seriously hard, and I hope the crypto community carries on trying to make it easier.
As to the second question, the solution is going to have to be political: if your view is that what the NSA is doing isn’t acceptable, I think contacting congressmen, petitioning, and campaigning are the right steps. I’m sure the EFF, ACLU, EPIC and similar organizations will be stepping up their long-running efforts in the near future.As to the second question, the solution is going to have to be political: if your view is that what the NSA is doing isn’t acceptable, I think contacting congressmen, petitioning, and campaigning are the right steps. I’m sure the EFF, ACLU, EPIC and similar organizations will be stepping up their long-running efforts in the near future.
Question:Question:
Bruce's article giving advice on staying more private online included selecting certain encryption algorithms based on their mathmatical features etc -- what are some direct examples of the most 'safe' encryption techniques to use, key lengths etc?Bruce's article giving advice on staying more private online included selecting certain encryption algorithms based on their mathmatical features etc -- what are some direct examples of the most 'safe' encryption techniques to use, key lengths etc?
How can Tor be any safer than VPN if both SSL/TLS and VPN methodologies have been exploited? Is the Tor routing process still a good security?How can Tor be any safer than VPN if both SSL/TLS and VPN methodologies have been exploited? Is the Tor routing process still a good security?
Answer:Answer:
Ball: GCHQ’s phrasing of beating “30” then “300” VPNs suggest it’s done on a case-by-case basis, rather than a blanket capability. It’s also worth noting that just because the NSA can, say, beat SSL in some (or many, or most) cases, it doesn’t mean they can do it all the time, especially as they often seem to circumvent rather than directly beat security. Tor also has its onion methodology. I think Bruce’s take – that Tor makes tracing you harder, rather than impossible – seems a sensible one.Ball: GCHQ’s phrasing of beating “30” then “300” VPNs suggest it’s done on a case-by-case basis, rather than a blanket capability. It’s also worth noting that just because the NSA can, say, beat SSL in some (or many, or most) cases, it doesn’t mean they can do it all the time, especially as they often seem to circumvent rather than directly beat security. Tor also has its onion methodology. I think Bruce’s take – that Tor makes tracing you harder, rather than impossible – seems a sensible one.
Note: Bruce Schneier has been traveling but will be online shortly. James Ball will take questions in the meantime.Note: Bruce Schneier has been traveling but will be online shortly. James Ball will take questions in the meantime.
Question:Question:
The questions I find myself asking are "Who is chiefly responsible for this breach of trust?", "Will anyone be held accountable?" and "What sort of backlash will there be, if any, from society at large?".The questions I find myself asking are "Who is chiefly responsible for this breach of trust?", "Will anyone be held accountable?" and "What sort of backlash will there be, if any, from society at large?".
Answer:Answer:
Ball: Me too! There are a lot of issues here, not least that the technological capabilities of the NSA have hugely outpaced the efforts of most lawmakers to meaningfully understand them, let alone regulate them.Ball: Me too! There are a lot of issues here, not least that the technological capabilities of the NSA have hugely outpaced the efforts of most lawmakers to meaningfully understand them, let alone regulate them.
In the environment after 9/11, the agency had a permissive environment to expand its remit, masses more funding, and technological advancements making surveillance possible on a scale never previously imaginable. For privacy advocates, the past decade was essentially the perfect storm.In the environment after 9/11, the agency had a permissive environment to expand its remit, masses more funding, and technological advancements making surveillance possible on a scale never previously imaginable. For privacy advocates, the past decade was essentially the perfect storm.
That encroachment happened under three Presidents, from two parties. I don’t think this is a partisan issue. It feels a little like the (apocryphal) tale of a frog in boiling water: if the water is slowly heated, the frog never notices it’s being cooked.That encroachment happened under three Presidents, from two parties. I don’t think this is a partisan issue. It feels a little like the (apocryphal) tale of a frog in boiling water: if the water is slowly heated, the frog never notices it’s being cooked.
A final note is that at a bare minimum we need to hold senior intelligence officials accountable in public, and demand honest answers. Obama’s Director of National Intelligence has been accused of outright lying to Congress, seemingly with no adverse consequences. If you’re looking to increase accountability and transparency, surely you’ve got to start there.A final note is that at a bare minimum we need to hold senior intelligence officials accountable in public, and demand honest answers. Obama’s Director of National Intelligence has been accused of outright lying to Congress, seemingly with no adverse consequences. If you’re looking to increase accountability and transparency, surely you’ve got to start there.
Question:Question:
Thus far the focus has been on the US and UK. But we see the five-eyed acronym on some of the documents. Should Aussies, Kiwis and Canadians be concerned about their privacy too?Thus far the focus has been on the US and UK. But we see the five-eyed acronym on some of the documents. Should Aussies, Kiwis and Canadians be concerned about their privacy too?
Answer:Answer:
Ball: The short answer is yes – the techniques revealed in the whole NSA Files series are shared with the five eyes nations, as is access to most of the databases of intelligence and communications the agencies collect.Ball: The short answer is yes – the techniques revealed in the whole NSA Files series are shared with the five eyes nations, as is access to most of the databases of intelligence and communications the agencies collect.
Of course, there’s a flipside, which is that (in theory at least) the citizens of the five-eyes nations get a little bit extra protection against being spied on by the others – so perhaps you should be more worried if you’re NOT in the US, UK, Canada, Australia or New Zealand. Hard to say!Of course, there’s a flipside, which is that (in theory at least) the citizens of the five-eyes nations get a little bit extra protection against being spied on by the others – so perhaps you should be more worried if you’re NOT in the US, UK, Canada, Australia or New Zealand. Hard to say!
Question:Question:
Could the spooks sell the information or keys when they retire?..Would it be impossible?Could the spooks sell the information or keys when they retire?..Would it be impossible?
Answer: Answer: 
Ball: If the NSA’s internal security was perfect, Edward Snowden would never have been able to leak. We’re essentially lucky he chose to release to the press – and it’s worth remembering he asked for responsible, measured publication, not mass-release – rather than simply sell it to hackers or criminals.Ball: If the NSA’s internal security was perfect, Edward Snowden would never have been able to leak. We’re essentially lucky he chose to release to the press – and it’s worth remembering he asked for responsible, measured publication, not mass-release – rather than simply sell it to hackers or criminals.
If someone in a similar position to Snowden decided to just take what they could and sell it to a foreign government, or criminal gang, would we ever know? It seems unlikely we’d be told. And given the NSA has repeatedly said they don’t know which documents Snowden accessed, maybe they wouldn’t know either.If someone in a similar position to Snowden decided to just take what they could and sell it to a foreign government, or criminal gang, would we ever know? It seems unlikely we’d be told. And given the NSA has repeatedly said they don’t know which documents Snowden accessed, maybe they wouldn’t know either.
That’s an important, additional, reason to be very concerned about the scope of NSA surveillance and activities, in my view – whatever your take on the need/legitimacy of mass-surveillance in general.That’s an important, additional, reason to be very concerned about the scope of NSA surveillance and activities, in my view – whatever your take on the need/legitimacy of mass-surveillance in general.
Question:Question:
Your article states:Your article states:
$250m-a-year US program works covertly with tech companies to insert weaknesses into products$250m-a-year US program works covertly with tech companies to insert weaknesses into products
Answer:Answer:
Ball: I think this is a serious risk of what the NSA has been doing: if I ran a US security company, I’d be concerned about my reputation (maybe deservedly so, though) – and I’m sure overseas competition will be stressing their ability to refuse US government requests in their advertising (though maybe their own government have similar programs).Ball: I think this is a serious risk of what the NSA has been doing: if I ran a US security company, I’d be concerned about my reputation (maybe deservedly so, though) – and I’m sure overseas competition will be stressing their ability to refuse US government requests in their advertising (though maybe their own government have similar programs).
That does seem to have been a concern of the NSA and GCHQ. I find that quite telling: if companies are just doing what the government requires, and no more, why such a need for secrecy around it? Why can’t they level? I think the efforts some of the silicon valley firms seem to be making are a good start – though what seems to be happening with Lavabit (a secure email company that shut down) are concerning.That does seem to have been a concern of the NSA and GCHQ. I find that quite telling: if companies are just doing what the government requires, and no more, why such a need for secrecy around it? Why can’t they level? I think the efforts some of the silicon valley firms seem to be making are a good start – though what seems to be happening with Lavabit (a secure email company that shut down) are concerning.
Finally: this could be a boost to the free software / open source movement, too. That would be no bad thing.Finally: this could be a boost to the free software / open source movement, too. That would be no bad thing.
Question: Question: 
They may have broken various methods of encryption (I'd assumed as much), but my question is; is this legal/viable evidence, that can be used in court? My understanding is that evidence that is acquired via snooping in on a secure/encrypted connection is illegitimate, and thus unusable in a court of law? (Not that legality seems to bother these people)They may have broken various methods of encryption (I'd assumed as much), but my question is; is this legal/viable evidence, that can be used in court? My understanding is that evidence that is acquired via snooping in on a secure/encrypted connection is illegitimate, and thus unusable in a court of law? (Not that legality seems to bother these people)
Answer: Answer: 
Ball: I can’t speak for the US system, as I don’t know it in detail (if you do, please chip in, in the comments) but in the UK intercept evidence isn’t admissable in court – it can be used as part of an investigation, and to get information which is then obtained ‘again’ by means of a warrant (so it can be used in court), but you can’t use it towards a conviction.Ball: I can’t speak for the US system, as I don’t know it in detail (if you do, please chip in, in the comments) but in the UK intercept evidence isn’t admissable in court – it can be used as part of an investigation, and to get information which is then obtained ‘again’ by means of a warrant (so it can be used in court), but you can’t use it towards a conviction.
All three of the UK’s major political parties have said they want to make intercept evidence available in court, but the intelligence agencies have long opposed it – so far, with success.All three of the UK’s major political parties have said they want to make intercept evidence available in court, but the intelligence agencies have long opposed it – so far, with success.
Question: Question: 
Details may be protected by one or more ECIs and/or the secure BULLRUN COIDetails may be protected by one or more ECIs and/or the secure BULLRUN COI
COI = Community of interest
So what does ECI stand for? The term is used frequently in the documents.		COI = Community of interest
So what does ECI stand for? The term is used frequently in the documents.
Answer: Answer: 
Ball: ECI stands for “Exceptionally Controlled Information” – it’s another level above top-secret, which keeps information to a very select group of individuals.Ball: ECI stands for “Exceptionally Controlled Information” – it’s another level above top-secret, which keeps information to a very select group of individuals.
Question: Question: 
In the face of the larger Snowden revelations, has The Guardian made any website changes, or critiqued business partners data usage, like Google and Facebook [for example how they may use the comments on this very page], in exploration of ways to insure, or at least enhance, TheGuardian.com users' privacy?In the face of the larger Snowden revelations, has The Guardian made any website changes, or critiqued business partners data usage, like Google and Facebook [for example how they may use the comments on this very page], in exploration of ways to insure, or at least enhance, TheGuardian.com users' privacy?
Answer: Answer: 
Ball: I can only really speak on this from the journalists’ perspective, as a reporter, but here I know we’re definitely thinking about what we can do to help make it clear how potential sources can communicate with us safely and securely (something we obviously think about anyway).Ball: I can only really speak on this from the journalists’ perspective, as a reporter, but here I know we’re definitely thinking about what we can do to help make it clear how potential sources can communicate with us safely and securely (something we obviously think about anyway).
Obviously it’s something reporters have thought about for a long time, in terms of technical and legal protections (I use things like OTR, GPG email, etc, and have for several years), but I think in the wake of this particular story any responsible reporter at any outlet in the world should be reassessing what they do. I’d like to see outlets doing more to learn about security, train their staff in it, and I’d like to see outside groups doing more to help with training – and building new tools to help. It takes a village, and all that.Obviously it’s something reporters have thought about for a long time, in terms of technical and legal protections (I use things like OTR, GPG email, etc, and have for several years), but I think in the wake of this particular story any responsible reporter at any outlet in the world should be reassessing what they do. I’d like to see outlets doing more to learn about security, train their staff in it, and I’d like to see outside groups doing more to help with training – and building new tools to help. It takes a village, and all that.
Question:Question:
Hi, thanks for answering questions. While everyone focuses on facebook accounts and emails, there's this thing that's been nagging me. A month ago the US authorities concluded a prosecution against 5 russians that have penetrated NASDAQ and many banks. They stole over 160 million credit card numbers, and had the entire NASDAQ network under control, apparently.Hi, thanks for answering questions. While everyone focuses on facebook accounts and emails, there's this thing that's been nagging me. A month ago the US authorities concluded a prosecution against 5 russians that have penetrated NASDAQ and many banks. They stole over 160 million credit card numbers, and had the entire NASDAQ network under control, apparently.
http://arstechnica.com/security/2013/07/nasdaq-is-owned-five-men-charged-in-largest-financial-hack-ever/http://arstechnica.com/security/2013/07/nasdaq-is-owned-five-men-charged-in-largest-financial-hack-ever/
I think that is more dangerous than facebook accounts. How likely is it that thes NSA tampering have weakened the security of say financial institutions or critical communication infrastructure?I think that is more dangerous than facebook accounts. How likely is it that thes NSA tampering have weakened the security of say financial institutions or critical communication infrastructure?
Answer: Answer: 
Ball: This touches on a really important issue: if the NSA *have* successfully undermined some universal encryption standards, then they may have indeed made some infrastructure more vulnerable to attacks by foreign governments.Ball: This touches on a really important issue: if the NSA *have* successfully undermined some universal encryption standards, then they may have indeed made some infrastructure more vulnerable to attacks by foreign governments.
That would have been a conscious trade-off in the agency, though possibly one based either on the hope/knowledge that hackers in the Chinese or Russian governments (or gangs) weren’t sophisticated enough to take advantage of the flaws, and would never get to that level, and that they would never get a mole inside the NSA or a contractor who could pass on knowledge of it. That seems like quite a lot of bets to take.That would have been a conscious trade-off in the agency, though possibly one based either on the hope/knowledge that hackers in the Chinese or Russian governments (or gangs) weren’t sophisticated enough to take advantage of the flaws, and would never get to that level, and that they would never get a mole inside the NSA or a contractor who could pass on knowledge of it. That seems like quite a lot of bets to take.
I wonder, if more were ever to emerge on what standards were compromised, whether there’d be widespread concern or reprisals. Could the NSA face legal responsibility for leaving institutions open to attack?I wonder, if more were ever to emerge on what standards were compromised, whether there’d be widespread concern or reprisals. Could the NSA face legal responsibility for leaving institutions open to attack?
Note: Bruce Schneier will now begin answering questionsNote: Bruce Schneier will now begin answering questions
Question:Question:
Bruce, in an article yesterday you said that you used the Tails version of Linux for security purposes. Another Linux distribution built for security is Liberté Linux. Are there any reasons to prefer Tails over Liberté?Bruce, in an article yesterday you said that you used the Tails version of Linux for security purposes. Another Linux distribution built for security is Liberté Linux. Are there any reasons to prefer Tails over Liberté?
Answer:Answer:
Schneier: I like Tails because it fits on a memory stick and gives me a relatively secure environment on any computer. I don't know Liberte, so I can's comment on it. In general, I don't have any inside knowledge about which applications have been compromised and which are secure. I'm making my best guesses based on what we all now know about the NSA's methods and economic realities.Schneier: I like Tails because it fits on a memory stick and gives me a relatively secure environment on any computer. I don't know Liberte, so I can's comment on it. In general, I don't have any inside knowledge about which applications have been compromised and which are secure. I'm making my best guesses based on what we all now know about the NSA's methods and economic realities.
Question:Question:
Are there known to have been any "hacker" exploits of back-doors built into hardware, software or standards at the request of NSA/GCHQ?Are there known to have been any "hacker" exploits of back-doors built into hardware, software or standards at the request of NSA/GCHQ?
What steps do NSA/GCHQ take to stop their operatives "going rogue" and supplying exploitable information to hackers or other parties?What steps do NSA/GCHQ take to stop their operatives "going rogue" and supplying exploitable information to hackers or other parties?
Answer:Answer:
Schneier: It's a good question. Given 1) that the NSA has repeatedly said that they do not know what documents Edward Snowden has, and 2) that they would not have known he had them had he not gone public, it is reasonable to assume he's not the first. He's the first to go public.Schneier: It's a good question. Given 1) that the NSA has repeatedly said that they do not know what documents Edward Snowden has, and 2) that they would not have known he had them had he not gone public, it is reasonable to assume he's not the first. He's the first to go public.
Question: Question: 
From what I got the gist of this round of revelations is that cryptography has been weakened by human, political decisions: that of the government to make covert agreements with tech companies - by the way, are they voluntary on their part or not? - to collaborate with intelligence agencies, for example, and let them insert "secret vulnerabilities".From what I got the gist of this round of revelations is that cryptography has been weakened by human, political decisions: that of the government to make covert agreements with tech companies - by the way, are they voluntary on their part or not? - to collaborate with intelligence agencies, for example, and let them insert "secret vulnerabilities".
Of course there is a legal complication here - the companies say they are basically compelled to comply when required by law - but there seems to be a difference between mathematically defeating cryptography and circumventing it by covert partnerships.Of course there is a legal complication here - the companies say they are basically compelled to comply when required by law - but there seems to be a difference between mathematically defeating cryptography and circumventing it by covert partnerships.
So my question is: can we still trust cryptography per se? Is it still mathematically sound or does NSA spying provide us with a case to believe that it is «less secure than we thought», as in this paper by MIT http://web.mit.edu/newsoffice/2013/encryption-is-less-secure-than-we-thought-0814.html?So my question is: can we still trust cryptography per se? Is it still mathematically sound or does NSA spying provide us with a case to believe that it is «less secure than we thought», as in this paper by MIT http://web.mit.edu/newsoffice/2013/encryption-is-less-secure-than-we-thought-0814.html?
Fabio Chiusi
https://twitter.com/fabiochiusi		Fabio Chiusi
https://twitter.com/fabiochiusi
Answer: Answer: 
Schneier: I wrote about this explicitly here. I believe we still can trust cryptography. The problem is that there is so much between the mathematics of cryptography and the "encrypt" button on your computer, and all of that has been subverted.Schneier: I wrote about this explicitly here. I believe we still can trust cryptography. The problem is that there is so much between the mathematics of cryptography and the "encrypt" button on your computer, and all of that has been subverted.
Question:Question:
What are the implications for the financial industry? For example, can people trust their internet banking services? Any comment what a reasonable security action in this matter an ordinary citizen (whatever that is) should take?What are the implications for the financial industry? For example, can people trust their internet banking services? Any comment what a reasonable security action in this matter an ordinary citizen (whatever that is) should take?
Answer: Answer: 
Schneier: Like everything else, it depends on the definition of "trust." Even before any of these Snowden revelations, we knew that the FBI has been collecting wholesale banking data on Americans. And this deliberate weakening of the cryptographic systems that protect Internet banking only put us at greater risk from criminals and other espionage agencies.Schneier: Like everything else, it depends on the definition of "trust." Even before any of these Snowden revelations, we knew that the FBI has been collecting wholesale banking data on Americans. And this deliberate weakening of the cryptographic systems that protect Internet banking only put us at greater risk from criminals and other espionage agencies.
As to your second question, I talked about how to maintain security here. But what ordinary citizens need to do is to make their voices heard; this will not stop unless we all demand it, loudly and repeatedly.As to your second question, I talked about how to maintain security here. But what ordinary citizens need to do is to make their voices heard; this will not stop unless we all demand it, loudly and repeatedly.
Question: Question: 
Regarding the"10-year NSA program against encryption technologies made a breakthrough in 2010".Regarding the"10-year NSA program against encryption technologies made a breakthrough in 2010".
Is the breakthrough NSA break through related to the MD5 weakness described in
http://www.sslshopper.com/article-md5-weakness-allows-fake-ssl-certificates-to-be-created.html		Is the breakthrough NSA break through related to the MD5 weakness described in
http://www.sslshopper.com/article-md5-weakness-allows-fake-ssl-certificates-to-be-created.html
Has the NSA created a poisoned (i.e. false) root certificate purporting to be from a trusted Certificate Authority (e.g. from thawte, symantec, trustco, etc.)?Has the NSA created a poisoned (i.e. false) root certificate purporting to be from a trusted Certificate Authority (e.g. from thawte, symantec, trustco, etc.)?
If so, how does one identify the poisoned CA root certificate?If so, how does one identify the poisoned CA root certificate?
How do I inform my SSL (secure socket layer) module from not using any certificate "signed" by the poisoned certs?How do I inform my SSL (secure socket layer) module from not using any certificate "signed" by the poisoned certs?
Better yet, have my SSL browser module not use *ANY* SSL cert signed only with an MD5 signature?Better yet, have my SSL browser module not use *ANY* SSL cert signed only with an MD5 signature?
Answer: Answer: 
Schneier: I do not know. My guess is that the "breakthrough" is not related to MD5. The cryptanalysis of that was public, and the algorithm is only peripherally involved in confidentiality. And I would certainly suspect the entire CA root structure. Answer to "poisoned CA root question": I don't think we can. Answer to SSL questions: MD5 should have been purged years ago.Schneier: I do not know. My guess is that the "breakthrough" is not related to MD5. The cryptanalysis of that was public, and the algorithm is only peripherally involved in confidentiality. And I would certainly suspect the entire CA root structure. Answer to "poisoned CA root question": I don't think we can. Answer to SSL questions: MD5 should have been purged years ago.
Question: Question: 
Assuming these are illegal activities, what is the ultimate motivator for these private companies to be complicit?
Wouldn't these private companies be concerned with losing market share when/if these revelations became public? What's the motivation?		Assuming these are illegal activities, what is the ultimate motivator for these private companies to be complicit?
Wouldn't these private companies be concerned with losing market share when/if these revelations became public? What's the motivation?
Answer: Answer: 
Schneier: There are many possible motivations. Patriotism. A desire to help. Fear of reprisal if you won't help. Not wanting to engage in an expensive legal battle. I'm sure the NSA promises absolute secrecy; perhaps the possibility of losing market share when it becomes public is so remote that it's not really an issue.Schneier: There are many possible motivations. Patriotism. A desire to help. Fear of reprisal if you won't help. Not wanting to engage in an expensive legal battle. I'm sure the NSA promises absolute secrecy; perhaps the possibility of losing market share when it becomes public is so remote that it's not really an issue.
Question:Question:
My questions are:My questions are:
1. Are the symmetric and/or asymmetric protocols (AES-256, RSA-2048+) fundamentally compromised? Or is it simply the implementation?1. Are the symmetric and/or asymmetric protocols (AES-256, RSA-2048+) fundamentally compromised? Or is it simply the implementation?
2. Are point to point VPN links between commercial OTS h/w such as SonicWALL therefore decryptable, even with PFS?2. Are point to point VPN links between commercial OTS h/w such as SonicWALL therefore decryptable, even with PFS?
3. Are A/V vendors cooperating with NSA/GCHQ to ignore gov't malware in order to compromise endpoints? If so, would it makes sense to use A/V such as Kaspersky?3. Are A/V vendors cooperating with NSA/GCHQ to ignore gov't malware in order to compromise endpoints? If so, would it makes sense to use A/V such as Kaspersky?
4. Mobile devices: Is it possible the h/w or s/w on Androids and iPhones is backdoored, rendering on-device encryption such as silent phone useless?4. Mobile devices: Is it possible the h/w or s/w on Androids and iPhones is backdoored, rendering on-device encryption such as silent phone useless?
5. All-in-all, is it safe to assume that there exists no viable means of protecting traffic against NSA/GCHQ?5. All-in-all, is it safe to assume that there exists no viable means of protecting traffic against NSA/GCHQ?
Answer: Answer: 
Schneier: 1. I believe that the algorithms are not fundamentally compromised, only the implementations. I talk about this more here.Schneier: 1. I believe that the algorithms are not fundamentally compromised, only the implementations. I talk about this more here.
2. I don't know. I have no reason to believe that SonicWALL is secure.2. I don't know. I have no reason to believe that SonicWALL is secure.
3. This is an interesting question. I actually believe that AV is less likely to be compromised, because there are different companies in mutually antagonistic countries competing with each other in the marketplace. While the U.S. might be able to convince Symantec to ignore its secret malware, they wouldn't be able to convince the Russian company Kaspersky to do the same. And likewise, Kaspersky might be convinced to ignore Russian malware but Symanetec would not. These differences are likely to show up in product comparisons, which gives both companies an incentive to be honest. But I don't know.3. This is an interesting question. I actually believe that AV is less likely to be compromised, because there are different companies in mutually antagonistic countries competing with each other in the marketplace. While the U.S. might be able to convince Symantec to ignore its secret malware, they wouldn't be able to convince the Russian company Kaspersky to do the same. And likewise, Kaspersky might be convinced to ignore Russian malware but Symanetec would not. These differences are likely to show up in product comparisons, which gives both companies an incentive to be honest. But I don't know.
4. I think it would be completely implausible for the NSA not to pursue both Android and iOS with the same fervor as the rest of the Internet.4. I think it would be completely implausible for the NSA not to pursue both Android and iOS with the same fervor as the rest of the Internet.
5. That's what I wrote about here5. That's what I wrote about here
Our editors' picks for the day's top news and commentary delivered to your inbox each morning.