When faced with claims of security it is necessary to fully understand the underlying basis of trust without which security is a mirage.

What is the mechanism by which one system or user authenticates the identity of another system or user and why is this process trustworthy?

Without secure authentication and proper binding encryption by itself is useless.

How are the key parameters to AES and HMACs derived? If an attacker can figure that out then a whopping $0 worth of GPUs will suffice.

So how about it... where does this magical session key for admittedly very substantial and well engineered SMB3 encryption come from?

The answer is NTLMv2 or Kerberos. This is a "bad deal". NTLMv2 credentials can be stolen and replayed with impunity by launching offline brute force attacks against captured challenge response. Ditto for Kerberos. Game over.

Recommend looking into a PAKE algorithm. The advantage they are able to provide mutual proof of possession of a common secret without leaking knowledge that may be used to determine what that secret is. These systems are not vulnerable to offline attack and provide keying to encrypt the network session such that you can carry on a secure conversation post authentication.

TLS-SRP is currently my favorite option. Currently shipping with many commonly used SSL toolkits. Supported by Apache and CURL but still quite sparse in terms of application support.

Anything you can put a TLS wrapper around you can probably hack to support TLS-SRP authentication without a terrible amount of effort.

Kerberos client authentication is subject to offline dictionary attack.

I don't know how or why it came to this. The world is hooked on insecure authentication protocols. NTLMv2, Kerberos, plaintext, plaintext over encrypted tunnel protected by group secrets (sigh..) or certificates and dull thud of every flawed permutation of a challenge handshake system imaginable.

These things are employed virtually everywhere and the consequences are visible everywhere.

Haha I tricked you or your computer into connecting to my file system or my fake bank or my fake web site and because of that I now have your credentials and your f*****d.

Living with consequences has become so routine and institutionalized some find it difficult to see the problem at all ... instead resorting to blaming failure of a castle defense or operating in an unsafe environment rather than notice the root cause of the problem - broken authentication systems.

When the most widely deployed use of a secure authentication protocol is protecting an online role playing game I have no interest in Microsoft's (And all other vendors) lame excuses for not fixing these problems decades ago.

article = new nonsensefilledstory();
article.addStrife();
article.addContraversy();
article.stoketribalisim();
article.allowAnonymousComments(true);
stack_of_trolls *users = article.create();

forall users as user (
      if (user.isTroll() == false && user.respondsToTrolls() == true)
            (globalBanList.addUser(user));
)

What is wrong with the people who take information for purposes other than original intent without asking and proceeding to leverage it for commercial gain?

Did these companies ask the Pilots for permission first?

Do these people even listen to themselves? They can't even communicate a coherent value proposition.

Cuz it aint one.

When you have excess so does everyone else and when you have a deficit so does everyone else. Little capability exists to buffer energy at scale in current systems.

Practical is more often than not determined by how many are willing to spend how much to get a desired result.

Truly, certainly, actually indeed.

Using the fact that something has been done to justify doing it is genius.

What happens if someone just wants to use this technology for the intended purpose of enhancing safety and does not want nor appreciate global collaboration of spies using it to track their every move?

Conversations in the clear overheard on public frequencies are fair game and can be reused and rebroadcasted for any purpose without limits...right? If something moves in a public space the world has an inherent right to know about it with no limitations....right?

I'm sure the execs running flightaware would have no problem with someone following their and their families asses around town every time they leave their driveway for the entire day and broadcast it all live on the Internet.

What is even rarer these days is the jury trial. With evolution of threat of insane sentences looming and nonsensical cost of litigation even the completely innocent dare not risk ignoring plea deals and settlement.

Blemishing the record of a prosecutor constitutes a high crime against god that will not be tolerated under any circumstance.

When real people in the real world hear the word "encrypted" the word they actually hear is "secured" ... encryption without trust is a dangerously nonsensical illusion.

What is the point? This does not stop the NSA
from using QUANTUM INSERT and there is a very good chance anyone able to easedrop on wire has the means to spoof a few packets and coopt TCP sessions... so what does doing this buy you other than confusing people with doublespeak nobody understands?

Maybe I don't understand what your trying to say but there is no point at all in encrypting without trust. If your saying you would rather use a local CA for internal business or family use this is an excellent idea.

This isn't ever going to happen unless trust anchors are deterministically derivable from DNS names implying little to no choice in your selection of a trust anchor.

Names is all that you can use because it is all people are willing to accept. Nobody is willing to go to google.com and manually enter or have to confirm use of the proper registry nor does relying on some coordinating structure do anything other than recreate the same problems in a different form.

Certs don't work, never have. Aggregating so much power and responsibility into the hands of CAs is just as foolish as key escrows run by governments and organized crime. Something will always go wrong there will always be too much incentive locked up in ensuring that it does. The more successful and useful a "simple" solution for everyone becomes the more incentive exists to coopt it.

The answer is not doubling down on these things and "encrypting" just because you can or just because its easy.

Most systems worth securing already require you to provide a password to login. If you want to improve the status quo and really make a difference then get browser vendors to natively support secure logins via TLS-SRP and relegate free certs to the margins for service discovery and account setup where there is no other practical means of establishing trust.

Snowden addressed this in his interview with his gun analogy.

Merely collecting and having the information is crossing the line. It is undisputed Irrefutable public knowledge NSA possess call records of EVERYONE who uses a phone in this country.

Nobody has any idea or can know what NSA does with it nor do they have any reason to trust the government. The point of view "oh but we don't use it" is simply irrelevant. The word "collect" does not mean "unless I use" anymore than stealing money from a bank only counts as stealing once the stolen money has been spent.

There is enough bullshit (e.g. parallel construction) going on behind the scenes to justify blanket mistrust.