News for hackers. Stuff that matters.
Re:Allegations of FBI crypto backdoors in OpenBSD IPSEC by tptacek on Tuesday December 14, 2010 @06:07PM (#2006131)
Anyone want to start a pool? I'm definitely a "no".
Re:Allegations of FBI crypto backdoors in OpenBSD IPSEC by there on Tuesday December 14, 2010 @06:17PM (#2006165)
http://www.openbsd.org/reprints/article_20000419.html

"The recent incident of "backdoors" in Microsoft software is indicative of a fundamental problem that electronic commerce will need to address very soon," Jerry Harold, president & co-founder of NetSec [...] Even if Microsoft has stringent internal requirements for software assurance, it's very difficult to catch a backdoor that may be hidden by a single coder deep inside hundreds of thousands of lines of code," said Harold

"This is why NetSec builds its products on an operating system (OpenBSD) that has made security its number one goal," Harold told SOURCES. "The source for the operating system was re-built from the ground up for security and is publicly available. As a result, it is continuously subjected to rigorous security review by independent software engineers around the world. This has additional benefits because secure code often tends to be well designed, stable, and efficient."

(netsec being the company that worked with the fbi and employed the developer that wrote the openbsd ipsec code in question)

Re:Allegations of FBI crypto backdoors in OpenBSD IPSEC by dfranke on Tuesday December 14, 2010 @06:19PM (#2006173)
That depends. Do we just have to find a vuln somewhere in one of NETSEC's check-ins, or do we have to prove it was put there deliberately?
Re:Allegations of FBI crypto backdoors in OpenBSD IPSEC by tptacek on Tuesday December 14, 2010 @06:26PM (#2006193)
Vulns are disqualified if a similar vuln was check in to an analogous crypto product within a 5 year window.
Re:Allegations of FBI crypto backdoors in OpenBSD IPSEC by pbhjpbhj on Tuesday December 14, 2010 @09:53PM (#2006840)
Wouldn't that be a great way to hide it though, insert a vulnerability that you've seen elsewhere and know how to exploit rather than inserting something completely unfamiliar. Indeed if it's been in some other app and not discovered then it's unlikely to get noticed quickly.
Re:Allegations of FBI crypto backdoors in OpenBSD IPSEC by m0nastic on Tuesday December 14, 2010 @06:19PM (#2006174)
I also will go with "no", although I'm a little too close to this story to wager.
Re:Allegations of FBI crypto backdoors in OpenBSD IPSEC by dangoldin on Tuesday December 14, 2010 @10:57PM (#2006988)
Do you mind elaborating on that a little?
Re:Allegations of FBI crypto backdoors in OpenBSD IPSEC by m0nastic on Wednesday December 15, 2010 @12:18AM (#2007157)
Basically that I absolutely believe this is a bogus story, but my reasons for believing that aren't able to be shared due to direct involvement.

I don't expect other people to take that as evidence of anything (because who the hell am I), but thankfully, this isn't the kind of thing that has to be wondered about for eternity (if his claim is true, it should be able to be verified).

edit: Oh look, HD Moore just posted this link on Twitter about the guy who sent the original email: http://www.bop.gov/iloc2/InmateFinderServlet?Transaction=IDS...

Re:Allegations of FBI crypto backdoors in OpenBSD IPSEC by dangoldin on Wednesday December 15, 2010 @12:40AM (#2007193)
Fair enough - I'm not going to pry any deeper. It's nice to see the depth of the HN community though.
Re:Allegations of FBI crypto backdoors in OpenBSD IPSEC by mfukar on Wednesday December 15, 2010 @03:37AM (#2007485)
I'm a 'no' too. I think OpenBSD is just being trolled.