If anything, you probably need several layers of different, non-aligned country vendors to have some Swiss cheese model security. So some Huawei stuff, somewhere, as long as it isn't only Huawei stuff.

This is a great idea in that they’ll likely also patch their stuff when they discover the other team has exploited it.

lmao it's like using a multi-hop VPN to hop through multiple jurisdictions, but in your own home!

Network designs i have seen often include this for much the same reason. A perimeter firewall is from one vendor and an internal firewall is from another. If there is a security issue with one device the other should not be effected in the same way.

checkpoint firewall (Israel), PAN/fortinet firewall (US), and huawei firewall (china) daisy chained - should keep each other in sync and provide defense in depth :D

Where is the proof?

Chinese law requires Huawei to cooperate with their intelligence agencies.

That doesn't prove anything. You're just saying that Huawei could theoretically be compromised, but the above commenter asked for evidence.

They are compromised in terms of governance, and their legal environment is the proof of this.

Nobody has ever claimed that Huawei devices have backdoors. The issue is that the supply chain is compromised by legal means, not the hardware or software currently being shipped has technical vulnerabilities.

> Nobody has ever claimed that Huawei devices have backdoors.

Just a few comments up in this thread, someone claimed definitively that Huawei equipment has been proven to be compromised, meaning backdoored.

> They are compromised in terms of governance

We don't have any known examples of Huawei being forced by the Chinese government to compromise its equipment. This is still a wholly theoretical discussion. In contrast, we know that the US government has inserted backdoors into American (and not just American) equipment, and is able to secretly compel companies to comply with US spying.

If you're using that non-standard definition of "compromised" then anything substantially made in the US, Australia, South Korea, Israel or Kazakhstan (non-exhaustive list) should be considered compromised.

I'd love it if people actually stuck to some principles and stopped buying from any of these countries. But using that legal situation as a reason to single out China/Huawei is bullshit.

"compromised" might be a word used by the tech community to refer specifically to technical compromises, but the word means something much more broad outside of tech forums.

> then anything substantially made in the US, Australia, South Korea, Israel or Kazakhstan (non-exhaustive list) should be considered compromised.

Not really, because many of those countries you listed have mutual treaties of cooperation and are not hostile to each other.

> Not really, because many of those countries you listed have mutual treaties of cooperation and are not hostile to each other.

Doesn't seem to stop them from taking immensely hostile actions, e.g. the US spying on Merkel's emails, or helping killers and rapists who work for them evade arrest in "allied" countries. Governments are large and complex and have many competing interests. Why would/should one trust any of the ones I mentioned more than the government of China?

People/governments should trust whoever is more closely working in cooperation with their own interests over those who are working against them.

Agreed, so how do you get from that to mistrusting only China? Everyone, including China/Huawei, has an interest in growing the pie. Some entities have an interest in zero-sum competition with me and mine. That's more likely to be someone closer - Chinese companies aren't competing directly with my business, but American, Australian and Israeli ones are.

I don't. It's just that this thread was about Huawei.

As does the USA, so we shouldn't be using Windows or Yubico either, or virtually any other software/hardware from any other vendor because there's few countries that let you do illegal-over-there things without having a mechanism to force you

It's a "pick your poison" situation, not a "they've got national security letters and so you can't trust them" one

This is why security is not a "one size fits all" exercise. The first thing you must do is define your threat model.

The reason the Chinese government doesn't want to build their telecom system on Cisco hardware is the same exact reason the USG doesn't want to do the same with Huawei hardware. Because neither government is delusional enough to think that parts/service/updates wouldn't be immediately sanctioned in times of war.

The US and China are already sanctioning each other's tech. The risk of building critical infrastructure on it is obvious.

> The US and China are already sanctioning each other's tech.

It's not symmetrical. Since Trump, the US has been extraordinarily aggressive in its use of sanctions against Chinese companies, whereas China has been very reluctant to retaliate directly.

The US has sanctioned hundreds of Chinese tech companies. China has only recently begun to retaliate in kind, but has so far only sanctioned a few US companies (Micron is the only prominent example that comes to mind).

It isn't. And I didn't say it was. But the current state isn't the ultimate risk that is being considered. The ultimate risk is war, under which both the US and China would invoke defense powers to compel industry to act in their respective nations' interest, and would apply wide sanctions.

The zero-sum thinking of the Trump and Biden administrations, in which China is seen purely as a threat and all sorts of cooperation and economic integration are being rolled back, makes war more likely. The US is not compelled to ban Huawei and sanction all sorts of Chinese tech firms - that's a choice.

Since the Snowden leaks (and honestly since long before) it's been safe to assume that if a nation state has the means and motive to commit <insert form of illegal surveillance here>, then they will.

China is way less dangerous to me than the NSA

How is the NSA personally dangerous to you?

Compared to any TLAs in China, the NSA is far more likely to take action against a US citizen for a thing that citizen chose to say. It's likely there's a low amount of actual danger but it's greater than that of what China poses.

If you live in the US, you're under US federal jurisdiction.

Unless you're regularly traveling to China or unearthing info that can seriously harm China, they're not going to send anyone after you.

I rather be spied on by a foreign government than my own.

As a non US citizen living in a western country, the NSA has no qualms analyzing everything I do/say/think, including in my activism, and tell on me to the government of my country.

a CIA claim isn't "proof". I've never seen anything to prove it, just imperialist hysterics

It is fair to think that if the CIA is compromising US companies, then China is likely doing the same to Chinese companies. To assume otherwise is wishful thinking.

I'm getting downvoted for saying something negative about China... as you do. :waves: Howdy wumao!

Here's a link to one such article proving that Huawei networks are backdoored: https://www.cnet.com/tech/mobile/us-finds-huawei-has-backdoo...

And an original source article in WSJ: https://www.wsj.com/articles/u-s-officials-say-huawei-can-co...

That's not proof, that's just an accusation. Huawei even offered up source access to customers as a way to prove that they didn't do that.

Not saying they don't do such things, but the evidence is lacking.

People who disagree with me must be paid actors! I don't even disagree with you, it's just really cringe-worthy.

I'd usually agree, except when it comes to saying anything critical of China on the Internet, my statement is very true. The wumao is a real thing, and they're pervasive within online tech.

Well your comment isn't greyed out or flagged, so they must be on vacation today :)

I wonder if you have enough self-awareness to notice why your behavior here might be considered bizarre. No, people who point out that your government routinely and brazenly backdoors equipment and software everyone uses (or rather, has forced upon them to use), while Chinese actions of this sort are evidenced to a lesser extent, and so the onus in justifying the use of that country's products is on the US at least as much as on China, are mostly not "wumao", nor whataboutists, nor anything of the sort. They're making an entirely sound argument an unbiased person would make given the context, you're just using those mind-killing political notions to dismiss a topic that offends your patriotic sensibilities.

Wumaos are low-paid grunts and sincere idiots who disingenuously downvote, report and post irrelevant nonsense regarding racist imperialist AmeriKKKa or legitimate Chinese clay/territorial waters/6000 years of peaceful history. This is very easy to see. You're free to suspect any interlocutor as being one, of course, but if that's your only retort, you'd do better not stooping to the level of an undeniable propagandist and instead conceding the object-level issue – or keeping silent.

"Don't feed egregious comments by replying; flag them instead."

a.k.a. please don't feed the trolls

https://news.ycombinator.com/newsguidelines.html

The first link depends on the second. The second requires some sort of sign up to read, but archive.is works as proxy https://archive.ph/Dov1N

The proof amounts to essentially one sentence spoken by an unnamed source

> U.S. officials said Huawei has built equipment that secretly preserves its ability to access networks through [lawful intercept interfaces]

but I understand that source confidentiality is useful so if WSJ trusts that, perhaps so should I. Not sure I'd then go so far as to independently say it has been "proven" when all that I truly know is that someone else believes someone else who has a commercial interest in saying this. It's probably true but that's not the same thing

I would trust a proven security research group's analysis and evidence of backdoors rather than CNN or WSJ that has a track record of lies and biases. They always cite government sources or experts without provided a single shred of evidence. I have read a lot of articles in relations to the so called "Chinese backdoor" and the "evidence" was either the equipment contains default root or admin passwords or the software has vulnerabilities. Last time I checked, most if not all vendors have default admin accounts and passwords so you can configure the device and change the initial password. Similarly I have not come across any network equipment software without security vulnerabilities. If you can refer me to an article with conclusive evidence please send me the link. This would be much appreciated.

You can't take the WSJ as proof of anything, let alone in regards to China.

You broke more than one of the site guidelines quite badly here. Please don't do that, regardless of how right you are or feel you are. Those rules for good reasons.

If you'd please review https://news.ycombinator.com/newsguidelines.html and stick to them when posting here, we'd appreciate it.

Isn't that just the US speaking in order to get more control? How is it proven? I've never seen any evidence of that, but there has been much evidence that the US does what they blames others of doing, like this and Cisco.

At this point it seems the US is accusing others for doing bad things because that's what they themselves do.

Huawei was growing really fast, threatening both Apple and Google. Then the US said it was not safe while trying to sabotage both smart phone sales and mobile networks sales. The US pressured allied countries to not choose Huawei for 5G, and didn't let companies work with them.

Huawei was also willing to compromise by giving network operators acces to source code.

Is Huawei bad? I don't know, and I've yet to see any evidence. Does the US do exactly what they are accusing other for? Yes, that has been proven multiple times.

We live in a day where we talk about privacy and security, while giving large corporations full control over our iOS and Android devices. How useful is e.g. E2E encryption really when the os itself has a direct connection to the mothership?

China has a LOT to gain from industrial espionage, is extremely well known for its industrial espionage, and also happens to effectively own EU telecoms (the 5G thing was like a decade too late).

It would be astounding if they didn't take advantage of this.

There is ample evidence of China's intentions and capability to install backdoors. Everything made in China or a heavily influenced Chinese country should be assumed to be compromised, even if 'proven' otherwise. Chances are we just haven't found the backdoor yet.

Sure - but all that is equally true of the US.

True of the US yes. Equally? I probably wouldn't say that. The US govt doesn't have the same control over media the the Chinese govt has. So they have to work harder to keep things out of public view. The US also has to massage the way they work to be somewhat within the bounds of the constitution.

It was never proven to be compromised though. GCHQ concluded after many years that they were sloppy, not malicious. All of the fear mongering by the US is what gave everyone the impression they were compromised.

To my knowledge, no proof has actually been publicly presented for this claim. There have been a few stories that didn't pan out (like the one that boiled down to, "Huawei devices have telnet installed"), but no actual evidence of backdoors has come to light yet.

This is despite the fact that Huawei has been under an extraordinary level of scrutiny for years. British intelligence was given extensive access to Huawei's hardware and code, as a condition of Huawei equipment being installed in the UK. We know from Snowden that the NSA hacked into Huawei HQ, but there's no indication that they found any evidence of backdoors. And despite running a global campaign to convince/pressure other countries not to use Huawei, the US hasn't publicly unveiled any evidence of Huawei backdoors. British officials have even admitted that the UK's decision to ban Huawei was based on pressure from the US, not evidence of wrongdoing.[0,1] This all makes me think that the US, UK et al. don't actually have proof of backdoors.

0. https://www.theguardian.com/technology/2020/jul/18/pressure-...

1. https://www.euractiv.com/section/politics/short_news/uk-bann...

Great post. Seeing similar with TikTok and DJI FUD

Proven?

Did they ever show any evidence?

I hear that claim pretty often but have never seen any proof unlike in Cisco hardware.