Follow Slashdot stories on Twitter

 



Forgot your password?
typodupeerror
×

Comment Re:Uh-yup (Score 1) 284

"have been" is used in the past perfect tense. That's important.
They have been unaware of the program at one period in time, and have completed that period of being unaware in the past. Since they finished being unaware of the program they have been aware of it, and continue to be aware of it.

Comment Re:FUD, I am a fraid (Score 2) 341

The problem is a disconnect in threat models.

An attacker with physical access can defeat any obfuscation scheme that doesn't require input from the user.
The point of having a wireless key stored in plaintext (or obfuscated) is so that the computer can connect to that network without input from the user.
Encrypting the key requires input from the user, so storing the key is effectively pointless. Obfuscating the key doesn't actually do anything to stop anyone with root access. Whatever choice you make you will break either the security or the usability.
Why break the security? Because the security is minor, in this case. An attacker with physical access to a computer on the site of the wireless network can already compromise the wireless key, eg by using a keylogger, installing malware on the machine to sniff the wireless key from memory as the computer initially connects, and possibly reset the access point's settings, assign a new key, and assign a new key on the client computer (s). etc. An attacker with physical access to a computer off the site of the wireless network (coffee shop, etc) just stole your computer, and is probably going to sell it. If they're determined to attack your network the same issues as above arise.

So not storing the key requires the user to type it (or a password to decrypt a keyring) when they connect, and provides very little practical security benefit. Anyone who would derive a practical security benefit from encrypting the key would likely derive a much greater security benefit from using a wired connection. The benefits are outweighed by the costs.

Comment Re:"We have established what you are, madam. ..." (Score 1) 464

No, there's a known weakness. Highly simplified version:
The Dual_EC_DRBG algorithm has several constants which can be chosen in such a way to allow whoever chose them to predict some things about the random values. We have no idea why the constants in the standard were chosen the way they were, and the NSA was involved in choosing them.
Therefore, the NSA had the opportunity to exploit the weakness by choosing the constants appropriately, and the algorithm should not be used with those constants.

Comment Re:so letting the nsa hire someone (Score 1) 280

Cryptography is not security. It's one component of security, but is not the entirety thereof. They likely are quite good at crypto, that doesn't mean they're good at the rest.

Snowden had the appropriate level of clearance, but not the need to know. He should not have had access to the data outside his need to know. The US has 3 clearance levels: confidential, secret, and top secret. Information is supposed to be compartmented such that a person with a given clearance can only access information at or below that clearance level which is needed to do their job. Simply having Top Secret clearance should not give access to all top secret documents. Snowden clearly had access to numerous top secret documents not needed to do his job.

He also managed to remove the data from his place of employment, as well as remove himself from the country.

The NSA is good at certain aspects of security, and plainly terrible at others.

Comment Re:so letting the nsa hire someone (Score 1) 280

No, I observe that the NSA doesn't know enough about security to prevent a low-level contractor from walking out with a massive trove of documents and giving them to the media. I assume that any organization so inept at their publicly stated goal is not actually working towards that goal, and look for what they're really looking towards. Spying on everyone without regard to laws or the constitution seems to be their actual goal, since they're accomplishing that handily.

Comment Re:so letting the nsa hire someone (Score 1) 280

Snowden was a contractor, who had access to a significant amount of data he didn't need to know for his job.
He walked out with it and gave it to the news media.

Why do you assume that the NSA is good at security? Why do you trust the NSA propaganda that they're good at security? Clearly they're not good at security. And if Snowden walked out over an ideology how many other contractors have done the same thing, but in secret and sold the data to other governments? It would be idiotic to assume none have.

If the NSA took their job seriously their own networks would have been secure.

Comment Re:so letting the nsa hire someone (Score 1) 280

You assume that the people running the NSA care about anything but their own power. This seems silly. For example, look at the inter-branch rivalry within the US military. The Air Force hates the A-10 because it's slow, the Marines love it because it works well to keep them alive. The Air Force won't let the Marines fly the thing, because planes are for the Air Force (unless they land on a ship). There are hundreds of other petty disputes like that, many of which have cost the lives of US servicemen. Why would you expect the NSA to look out for anyone other than the NSA?

Slashdot Top Deals

"Money is the root of all money." -- the moving finger

Working...