News for hackers. Stuff that matters.
Re:Was the iOS SSL Flaw Deliberate? by zacinbusiness on Thursday February 27, 2014 @09:41AM (#7312396)
I don't think the NSA is nearly as technologically capable as people think they are. If they want info from someone all they have to do is detain them and bust open their kneecaps with a hammer. No one would ever find out. So there's really no reason to go through all the shadow games.

If this is an intentional bug, I think it's likely a hacker or just a disgruntled employee. But I'd be willing to wager that it was a tiredness error, rushed to implementation by an overworked and likely underpaid engineer deep within Apple.

Re:Was the iOS SSL Flaw Deliberate? by fit2rule on Thursday February 27, 2014 @10:12AM (#7312557)
You're absolutely wrong on this. The NSA are far, far more technologically competent than we've been giving them credit - and that is precisely why the NSA releases have been so imporant, and chilling, to the computer industry and hacker community. The NSA are way ahead of the pack. To think of them as a stupid bungling agency, the way most people associate government TLA's, is doing the world a disservice. Their competence is terrifying - as in it literally induces terror.
Re:Was the iOS SSL Flaw Deliberate? by zacinbusiness on Thursday February 27, 2014 @10:19AM (#7312596)
I think they are paranoid and have a blank check budget. But I don't think they are competent. If they were competent then they would know that no serious threats will be discussed in world of Warcraft or over yahoo messenger. The supposed enemy in the shadow is at least smart enough to know better. If they aren't, then they aren't smart enough to warrant the invasion if basically everyone's privacy. It just doesn't add up to me. If we are fighting super technical enemies, we must assume they are smart enough to not use basic, consumer grade chat. If they are not technically capable enough to know better than to use something like yahoo, then just send them an email with Sub7 in it. Either way, spending billions of dollars of my money to watch some millionaire banker sext with his secretary is a waste of money and of time.
Re:Was the iOS SSL Flaw Deliberate? by pessimizer on Thursday February 27, 2014 @01:06PM (#7313766)
> If they were competent then they would know that no serious threats will be discussed in world of Warcraft or over yahoo messenger.

No, that would be a sign that they were incompetent, because secretly communicating groups do use unusual chats, such as graphical children's chat applets, in-game communications, shoutboxes and such. Why wouldn't they?

Re:Was the iOS SSL Flaw Deliberate? by smackfu on Thursday February 27, 2014 @11:51AM (#7313217)
>If they were competent then they would know that no serious threats will be discussed in world of Warcraft or over yahoo messenger.

I don't know, game chat systems seem like a pretty good place to conspire. Imagine something like Call of Duty, you can pretty obviously talk about attacks and targets without setting off any red flags since it would be indistinguishable from real game chat.

Re:Was the iOS SSL Flaw Deliberate? by nthj on Thursday February 27, 2014 @11:14AM (#7312944)
> If they were competent then they would know that no serious threats will be discussed in world of Warcraft or over yahoo messenger.

Or they're pretending to be incompetent so they have an excuse to swallow up World of Warcraft and Yahoo Messenger chat logs. Because they don't care about terrorists, they care about logging /everything/. It's about power.

Re:Was the iOS SSL Flaw Deliberate? by fit2rule on Thursday February 27, 2014 @12:48PM (#7313632)
Your mistake is in thinking that the NSA is fighting an enemy.

Its not.

It is creating one.

That is why its imperative that we do something about the NSA.

Re:Was the iOS SSL Flaw Deliberate? by iaskwhy on Thursday February 27, 2014 @10:02AM (#7312508)
Have you seen the more technical slides with some of the hacks they use? They are very technilogically capable. Actually, they are much more capable than most people used to think.
Re:Was the iOS SSL Flaw Deliberate? by zacinbusiness on Thursday February 27, 2014 @10:07AM (#7312530)
I'm sure they can do these things. I'm just not sure why they would. If the NSA wants my encrypted email keys they can ask me, they can hack my server, or they can break my jaw. The last option is considerably cheaper. So the entire organization seems like a gigantic waste of money to me.
Re:Was the iOS SSL Flaw Deliberate? by iaskwhy on Thursday February 27, 2014 @11:27AM (#7313038)
I understand your point but you might be missing NSA view on this. Their goal is (apparently) to source as much data as possible and, although breaking a jaw doesn't sound expensive as a one-off, it gets extremely expensive when doing it for a given percentage of the world population. In our own language, it's not scalable. And neither are the other options. Global automation of the gathering of personal data is much cheaper and much more useful (again, apparently).
Re:Was the iOS SSL Flaw Deliberate? by smackfu on Thursday February 27, 2014 @11:52AM (#7313224)
>Global automation of the gathering of personal data is much cheaper and much more useful (again, apparently).

And completely legal (from their perspective), whereas attacking foreign citizens gets into grey areas.

Re:Was the iOS SSL Flaw Deliberate? by iaskwhy on Thursday February 27, 2014 @03:02PM (#7314608)
While I agree with you, I don't think that's a grey area from their perspective either. The CIA has done it with the support of other governments.
Re:Was the iOS SSL Flaw Deliberate? by zacinbusiness on Thursday February 27, 2014 @11:46AM (#7313179)
That's a fair point. Really the whole thing bugs me. It seems they could be solving real problems with all those cycles.
Re:Was the iOS SSL Flaw Deliberate? by mikeash on Thursday February 27, 2014 @11:45AM (#7313166)
Breaking your jaw is most definitely not cheaper. Not by a long shot.

The NSA could, for example, compromise Comcast routers, use this bug to MITM every single SSL connection to e-mail servers, and collect literally millions of people's credentials and messages.

The cost of doing the equivalent with "break my jaw" techniques is astronomical. You'd need massive manpower, huge facilities, and of course the public backlash would be almost incomprehensibly vast.

Programmers of all people should be able to understand that an automated, computerized solution can be applied to a large scale extremely cheaply, and that this is pretty much the only way to scale up to millions of users. In the NSA's case, it's targets instead of users, but the same principle applies.

The NSA wants all of the data. Technological measures is how to obtain it, and that's what they've been doing.