> I think most of us would be fine with the NSA doing what they do if it was targeted

You think wrong. That fact that there are opposing world states engaging in this nefarious, oppressive, terrible acts and they're not all aligned doesn't legitimize any of these states' activities.

The NSA should essentially be shut down, or cut down to a small agency operating in public with a much more limited mandate. And no secret FISA courts all of that spy-movie crap. That should just stop, period.

NIST and the NSA should be shunned when it comes to setting crypto standards (apart from setting their own FIPS and such for government users) because they've demonstrated their corruption and efforts to work against the public interest. Instead, an international nonprofit that encourages transparency and academic adversarial due-diligence across the whole lifecycle of standards would be a better vehicle for crypto standards, like an Underwriters Laboratory or similar. (NESSIE-ish but even broader.) It's impossible to remove gamification and attempts to infiltrate standards bodies, but it's important to remove both appearances of condoning their subversion and proactively mitigating all actual infiltration should a fellow, contributor or other affiliate be working on behalf of a foreign government. It's not a "all gubberment bad" thing, but particular parts of government who's culture has infected the integrity of the process to deliver modern, reliable cryptography as a net commonwealth good, but they've chosen instead to create more liabilities and doubt that defeat and outweigh the "benefit" they brought to the table for users outside of government.

I love privacy 'n' stuff, for sure.

But relative to the risk of global nuclear war, and the certainty of global climate disruption, I couldn't care less about the NSA and its adversaries.

And hey, maybe all that spying reduces the risk of overt war.

Why do you believe NSA spying decreases the risk of nuclear war, or helps stave off climate change?

Also, it's not that we "love privacy", it's that we dislike oppression. And believe you me - most people in my part of the world know very well how the US is oppressing them through military and intelligence means. We don't want to live under the US' boot, and the NSA is part of that boot.

I didn't say anything about spying staving off climate change. That's pretty much a done deal, at least to the extent of destroying our current civilization. We've been in free fall to that, for at least a decade.

And about nuclear war. Although I'm not expert, it seems pretty obvious that uncertainty increases the risk of war.

Sure, I hate oppression. And I'm not into oppressing others.

But the problem is all the assholes who are driven to oppress others. If I could snap my fingers, and have them all die instantly, I would. But that just ain't gonna happen.

And indeed, it's arguable that they've been selected for, since the development of agriculture and animal husbandry. I got that from Morgan's Black Man.

So anyway, I just do what I can for myself and those close to me, and what I can to help others. I don't focus so much on changing the system. Given how people are, it seems kinda pointless.

You could argue that uncertainty reduces the risk of war because you're only starting wars where you're reasonably certain that you can win. Uncertainty about your adversary's capabilities then prevents war.

Too much uncertainty can also risk war. It all depends on what you're uncertain about.

MAD doctrine is based on both sides being reasonably sure neither can get away with a first strike. There is interest in having that fact independently verifiable; spying is both providing that verification and serving as an incentive against overstating your actual capabilities.

Gives those who get a kick out of war and conflict something to do that isn't lob nukes at each other.

Same reason you want layers of government with progression at a small scale available to many. So all the people with political ambitions aren't all trying to start their own governments and revolutions.

Busy is stability.

To be fair, I don't think a search warrant is oppression if used correctly. If there was something analogous for encryption I wouldn't mind. Problem is an "encryption search warrant" likely would happen without anyone knowing about it.

Okay, but these big picture perspectives don't materialize in a vacuum. It's not just this binary do-or-die nuclear deterrence that such a mindset acquiesces to.

The rubber meets the road, and real names are drawn from a hat somewhere along the line. After we shoo away that pesky threat of hypersonic implosion triggered plutonium cores raining down upon our heads, the sun rises on a new day, and we have to put on coffee and make breakfast.

And some people ride in limousines from hotels for brunch, and some people ride the bus to a fast food job at the ass crack of dawn.

And you can bet that whomsoever holds the keys to these cryptosystems that serve as nuclear-proof umbrellas keeping our heads dry from the oh-so-inevitable megatons of explosive fire, they'll never drive a garbage truck, they're kids won't have to worry about flunking out of college, and none of them will ever get cold in the winter, unless they want to on their holiday ski trip.

And it's no accident, the way such things work.

So, maybe this whole nuclear war thing? Maybe it's always been a big shakedown.

Maybe, sometimes you buy a gun with the full knowledge that keeping it clean, safe and ready for reliable use is going to book your Sundays solid from now on, and whoops, the cost of gun ownership, it just so happens, is never attending Sunday mass again.

Don’t understand the gun paragraph

It's something like people who are into violence being immoral, I suspect. Not that I'd pick religion as a reliable measure for morality.

It is arguable that the US and Russia have collectively committed a crime against humanity that's comparable to genocide. Not in any simple numeric sense, of course. But even 1% annual risk of killing a billion people, protracted over several decades, is a pretty big number.

And yes, humanity is highly stratified. Socially, economically, whatever. But that just reflects what we are. Hate on it all you want, it's not gonna change.

OK, so reckless endangerment is a crime.[0] It's especially serious when weapons are involved, and when children are endangered. How does that not apply?

Except, of course, that there's no body with the requisite authority or power. But maybe someday there will be.

0) https://www.legalmatch.com/law-library/article/reckless-enda...

And who is creating the risk of global nuclear war, if not those very same governments?

Most of it is economic and political espionage, not spying on each others' military secrets. That happens too, sure, but none of the other stuff is necessary to protect us from nuclear war.

Hmm, nah I don't think people understand that they created NSA. It is them and their neighbor living in quiet area paying taxes where government want to keep them quiet and keep paying.

This way of things is giving birth to idealism and naivete. Just like people living in cities are idealistic and naive about life of cattle and poultry.

You don't want innocent chicken to be killed, but it is tasty. You don't want innocent person to be kept in hidden prison, but you feel safer.

They all would like to close down the farms or agencies that deal with bad stuff, but once they will be hungry enough that they will have to kill an animal or will be faced with actual violence, they will change their mind right away. (I bet they will want someone else to deal with such things)

If someone lives comfy life he can be oblivious. But on the other hand that is also beneficial for society because people in first world countries can focus on growing their interests and don't mind that bad stuff.

In the end if I would have to kill chickens for food every day I could not learn software development. So I am grateful I don't have to. I am also grateful that I don't have to deal with criminal people every day, because also I probably would not have time to do software development (most likely I would be dead before my 20th birthday).

I would say it is the _opposite_ of what you suggest. That is, people are willing to accept the existence of oppressive institutions because they are kept ignorant about their terrible impact. And those who aren't ignorant are fearful.

On a personal note: I' been arrested, I've been beaten, I've been in court and I've been in prison (*) to uphold and promote my beliefs and principles. And I do software development too... it's possible :-)

> You don't want innocent person to be kept in hidden prison, but you feel safer.

Umm, no. That this happens makes me feel less safe. If it can happen to anyone, after all, it can happen to me or the people I hold dear.

A spy agency is necessary for the USA to compete on the world stage. Though, it's operations should be significantly limited.

The CIA is a disaster that needs to be dismantled.

The conceit of planetary-level politics being a "competition" is - with due respect - propaganda of the imperialist powers, that most of us are being fed and expected to buy into. Don't.

In fact, with deepening global threats like climate change and nuclear war (), it is becoming clear just how mortally dangerous such perceptions are. So: Stop supporting "competition on the world stage".

---

Yes, that is still a thing and making quite the comeback; see:

https://www.newsweek.com/us-military-new-nuclear-weapons-782...

and

https://www.theguardian.com/world/2019/jan/28/us-nuclear-wea...

for example.

Welp, I'm a doomsday prepper now.

> The CIA is a disaster that needs to be dismantled.

Working for the CIA is like being a sysadmin. The world only knows you exist when you fuck up.

There was a great CCC talk recently that showed how one of the Vault 7 tools wasn't a remote assassination boogieman drone tool like Wikileaks framed it, but actually a control the CIA developed that allowed them to give anti-air weapons to friendlies in Syria and Ukraine with positive access control and strong time/geo scoping to prevent them from being used nefariously.

> Working for the CIA is like being a sysadmin. The world only knows you exist when you fuck up.

While there's some truth to that, this way of thinking entirely ignores the opportunity cost that all those agencies have. With those insane budgets, you could do so much good in the world that one wouldn't have to fear the problems those agencies try to solve, because a lot of them wouldn't exist in the first place.

The budget of intelligence agencies is not anywhere near that big.

CCC... Communist Congress of China? Christian Columnist Caucus? Conference on Computational Complexity?

Probably Chaos Computer Club, a German association of hackers. At least in Europe quite well known. They do a lot of cool stuff, like looking for security flaws in voting machines and such stuff.

I'm sure that's what you would have told me 300 years ago if I claimed we should abolish monarchy and hereditary rule...

I am fine getting rid of the NSA as soon as you can guarantee that Russia and China dismantle their equivalents. Not to mention all the other agencies in the world.

Sorry but when you talk of those two in particular, the US is the obvious good guy. Regardless of the terrible shit Trump has done, we would never accept him murdering journalists or critics. That shit happens regularly in Russia and China

Thinking of the US as “the good guy” deters improvement. If anything, the US is “the better guy,” a more modest claim.

> Regardless of the terrible shit Trump has done, we would never accept him murdering journalists or critics

There is strong evidence that Turkish intelligence intercepted the telephone call between Trump's son-in-law Jared Kushner and Bin Salman green-lighting the killing of Jamal Khashoggi, and used it as leverage to force the US drawdown in Syria. Turkish state media was the source of the audio recording of the murder inside the embassy, so it is not unreasonable to believe they have sufficient espionage capabilities against the Saudis to have phone recordings as well.

Source for Kushner phone call claim?

So you are saying the US killed Khashoggi.

Of course you don't mean that. What you mean is that the US didn't intervene.

Yes, I am certain the world that hates the US would have loved the US intervening in Saudi Arabia's affairs.

Whether the US gov't knew Saudi was going to do it or not is different than the US gov't pulling the trigger.

Can you name the Trump, Obama, or Bush vocal american citizen critics that have been killed by the government? Because it sure is easy to find the ones Putin has murdered

Not really about critics, but murder of Epstein pretty much shows corruption of the US establishment.

I'm pretty sure there more deaths like this but I don't collect this data and US is the country with most efficient propaganda and brainwashing. It's extremely effective at hiding unpleasant facts and dissemination of fake news.

It takes a lot of hubris to think that you would ever know for sure if some US three letter agency was killing journalists and critics.

Ummm Trump's biggest critics aren't dropping dead left and right. That is exactly what happens to Putin's critics.

Just watch the "Mission Impossible" franchising. They are obviously dramatized stories but I would not be surprised that the world has been very closed to cease to exist as we know it and the only thing that prevented was that they did their job. Only few people know what they have done, no glory, no prizes, no recognition. What kind of people do that? Heros.

Feel free to down vote me.

I can only guess but I would not be surprised if your very life was saved. Or even if we just look at money, you may have lost a significant amount of what you have in a scam that was avoided.

We do not know what we do not know. But there must be more good than bad in what they do.

There's plenty of memoirs by actual intelligence agents.

The world is a lot more boring than films and far more complicated and difficult to pull off serious operations. The serious operations often merely being inside information about other nation states. Not saving the world from bad guys.

It's mostly just a long series of super paranoid people chasing each other in circles. And in between plenty of useful information being given to leaders, ie before big events to give them an edge or whatnot.

The cold war was the heyday of the outside-the-office spycraft stuff. Today I'm sure it's mostly just countering massive digital campaigns hitting gov agencies, critical infrastructure, and megacorps. Plus the old school agents working within each of those agencies feeding information back to their motherlands.

The other amusing thing is that said leaders often ignore all that useful information when making their decisions, because they believe that they know better.

And for 2 years of boring paranoia there may be 2 days that save the day.

I would expect that people that speak up are mostly dissatisfied and frustrated people.

And for opacity, one part of the org will likely not know about what is going on on the other side.

A big selection bias.

But who knows...

I mean, sure, if you want to believe in superheroes, that's fine. But heroics typically have an opportunity to exist due to extreme events. Those, in turn, mostly happen due to massive screwups or deliberate large destructive events. Occasionally, accidents, but that's not what you're talking about.

If you want insight as to why heroic interventions are a sign of failure, talk to your IT department and then scale that up to nation states.

Wow! I have never seen it stated that well. I always said this one team got hero status for saving a contract that was horribly underbid in schedule and budget, so they proceeded to underbid contracts to recreate the success. If we treated heroics as a red flag we would all be better off.

I completely agree that the need of superheroic actions may arise by the result of self inflicted pains and it is usually the case in big corps.

At the same time, other heroic efforts may also require hard work to keep up with the competition or to clean up someone's mess.

That seems one of the reason they monitor what is going on and are vigilant: so they are more likely successful at preventing problems before they araise or become too big. Are not those the problems that require superheroic measures?

The world is far more Mr. Bean than James Bond.

I think a James Bond in the past may end up becoming a Mr Bean in the future if we are not careful.

I am not naive, there are problems in big organizations.

To keep the movies methaphor, the biggest fears I have come from movie like Star Wars in which the empire turns to the dark side.

I have no idea what systems are in place to prevent things like this to happen. I hope they are VERY good.

My experience as software engineer teaches me that as things become more and more complex in a system the risk of a bug increase. And opacity is a double edge sword.

Even if you have a buggy system, you do not say "Let get rid of it" without talking about the alternatives. Other thing to consider is: "full rewrites are generally a bad idea".

I would like to open this to constructive suggestions but I am afraid that without an inside view we are just shouting the breeze.

Mad guy speeds across London streets with a highly customized vehicle. Also, tanks. I see no difference.

I only downvoted this comment because the poster wrote:

>"Feel free to down vote me".

You are the reason the show "24" was rushed through.

iMessage is so riddled with problems from using weak RSA key sizes (1280 bits), to using RSA in the first place (thus no forward secrecy), to apple essentially managing the public keys for the user (which allows transparent MITM due to lack of public key fingerprints).

Also, both iMessage and WhatsApp are proprietary, thus it's almost impossible to verify the code you're running is safe. You're right in that E2EE has become more common, but seeing how the intelligence agencies have targeted major vendors like Crypto AG and RSA, we should be extra careful with popular, proprietary systems.

All it takes is one elected president who could upend the other branches, and the three letters become much more scary.

But thats just a partisan political beliefs, right?

> I think most of us would be fine with the NSA doing what they do if it was targeted, like the police getting warrants to break privacy only in important cases for public safety.

Except it's not getting a warrant, but simply deciding whether to spend resources. Which is not something that, like a warrant, I would be fine with.

Also there's another difference, technically it'll never really be on a case-by-case basis, because they can store all the encrypted communication (text chats, just store everything, easily). And they can in hindsight decide to decrypt any of that history (depending on ample metadata).

Or maybe they have a tiered system, a first-pass filter that detects a very vague definition of "possibly maybe interesting" (again, metadata) that would never ever pass a warrant request. Then just store everything that passes the filter, forever, and decrypt when needed.

> WhatsApp and iMessage

Don't both of these have default/recommended configurations that back up your chats to cloud services?

iCloud just recently added Messages in iCloud, but I know a fair amount of people that turn it off since the default iCloud storage space is 5gb.

So the messages on your phone are not backed up with the normal iCloud backup?

I know WhatsApp nags to turn on chat backup to the cloud.

normal iCloud backup I don't think so, but it does ask you to turn on 'messages in icloud' once you upgrade to iOS 13 and/or get a new phone, albeing one time only.