> If they can crack encryption they're not going to tell us and they will probably act like they can't.

The thing that was pretty apparent from Snowden's leaks is primarily that they don't need to. This fear that "NSA can crack cryptography" is the wrong fear. First, as others have noted, there are legions of other researchers evaluating and attempting to break widely used crypto-systems. There is no reason to believe the NSA has some unique brilliant minds that aren't available elsewhere.

More importantly, though, why bother with a "frontal assault" on breaking crypto schemes when endpoint security is a million times more hackable. That is, usually at some point someone wants to view the encrypted data that is being sent, and at that point it needs to be decrypted, so why not just try to hack at that point (which is exactly what they do). As an example, just look at all the stolen cryptocurrency heists. All of these heists resulted from stolen keys or from implementation bugs, not from cracking the crypto schemes that protect cryptocurrency in the first place.

https://xkcd.com/538/ writ large

What I dislike about this comic is the subtle implication that torture is an effective means of information extraction - it suffers from the car keys phenomenon of how people think about torture.

Basically: if I threatened to hit you with a crowbar unless you gave me your car keys, you'd give them to me, because a car isn't worth anything.

Same story with an ordinary person's computer: they just don't have enough worth hiding that can't be repaired later, compared to serious injury. "Oh no, someone got my credit card! I'll have to argue for some chargebacks from my bank after I report it was stolen" rather then recover from a shattered knee-cap.

Some cyphers maybe. But it's highly unlikely that all or even most in use are compromised. There are many cryptography researchers who aren't part of the NSA. Other nations for example. And banks obviously trust some cryptography.

Even if they were compromised I imagine the nsa would probably hesitate to use it in a detectable way and "save it for a real threat"

I recall reading that government agencues forced the NIST to relax certain crypography standards so that they could still be reasonably broken with super computers.

I want to downvote you but can't think of a better reason than I don't like what you say.

Surely we can encode better behavior into our institutions.

A case against security nihilism (cryptographyengineering.com)

468 points by feross on July 20, 2021 | un‑favorite | 333 comments

https://news.ycombinator.com/item?id=27897975

Take this as an anecdote, but I have a friend that works at the top of a large quantum computing program at a well known company and he related once that the government is making it very difficult for them to retain talent in the field and make progress. The government feels it has to be at the forefront of quantum tech because of the possibly game-changing encryption capabilities. It was a bit chilling to hear but not at all surprising.

As a participant in the "digital underground" since the early 80's, we were very aware of "ECHELON", "5 eyes", and other spying programs. The "Snowden revelations" are not really anything new, living a life around digital communications 20 years before most people ever heard of the internet it was clear very early that surveillance is just something the government is going to do. And yes, they definitely would consider it top-secret info if they did create a quantum computer capable of cracking modern encryption. We wouldn't know about it unless someone leaks it, but I don't really care if anyone leaks that info - they either already have it or will have it first so it's fair to just assume that they do have that capability.

I find odd enjoyment in observing how one arm of the government is pushing for quantum surveillance abilities while another is urging everyone to quickly adopt PQC.

> The best thing we can do is stay safe from criminals.

And if the criminals are government entities or government-sponsored entities?