What happened to the days when the NSA helped make world class crypto like AES256 in a public forum?
Sounds like the IAD mission. Examples:
- https://github.com/iadgov/Pass-the-Hash-Guidance/blob/master...
- https://www.iad.gov/iad/library/reports/nsa-methodology-for-...
I mention that first one especially because Pas-The-Hash was a major reason the most recent ransomware outbreak was able to get onto already-patched machines.
https://www.nsa.gov/what-we-do/information-assurance/
> Note: The IAD.Gov website uses TLS 1.2, supported by a Department of Defense (DoD) PKI certificate, to ensure confidentiality and integrity for all users. IAD.Gov website users will need to have the current DoD Root and Intermediate Certificate Authorities (CA) loaded into their browsers to avoid receiving untrusted website notifications.
I mean it still doesn't make sense ... Where it says "for all users" it should say "for those who have this certificate installed" because that's what the warning is about. And "to avoid receiving untrusted website notifications" should read "for a more secure connection" because, you know, what's the goal here, really? :)
Whether the NSA hoards zero-day exploits or not isn't the big issue since someone will be doing that. The issue is they should be sounding the alarm on whatever broad class of system vulnerabilities they find.
They should be evangelizing against remotely updateable hard drive firmware, against insecure IoT devices and similar things.