Sunday, September 08, 2013

An Expert Account of What NSA Can Do and How to Protect Yourself

I've just read a piece by Bruce Schneier, a prominent expert on computer security, describing in some detail what the NSA can currently do and how one can or cannot protect oneself. The basic message is that you cannot prevent the NSA from accessing your computer and getting any information you have on it by precautions that ordinary users are likely to use, but they probably won't bother unless they have some special reason to target you. Most NSA spying is done by targeting the network not the end point, and you can, by making the correct choices in encryption software, make it difficult to impossible for the NSA to read your messages without going to the effort to access your computer.

An important point is that the NSA attack on encryption consists in large part of weakening, in non-obvious ways, publicly available encryption, at least sometimes with the cooperation of the firms producing the software. That is important because once the NSA has done it, there is nothing to prevent other people from taking advantage of the weaknesses, provided they can discover them. That makes the NSA efforts, at least potentially, a large benefit to computer criminals interested in stealing trade secrets, credit card numbers, or other valuable information, as well as to foreign governments interested in stealing information for their purposes. As I put it some years back in my Future Imperfect, discussing the desire of law enforcement for ways of overcoming encryption:
Encryption provides the locks for cyberspace. If nobody has strong encryption, everything in cyberspace is vulnerable to a sufficiently sophisticated private criminal. If people have strong encryption but it comes with a mandatory back door accessible in half an hour to any police officer with a court order, then everything in cyberspace is vulnerable to a private criminal with the right contacts. Those locks have billions of dollars’ worth of stuff behind them – money in banks, trade secrets in computers.

From time to time, U.S. officials complain that the Chinese have been breaking into U.S. computers and stealing trade secrets. It now appears that the National Security Agency has been spending hundreds of millions of dollars a year making it easier for the Chinese to do so.

13 comments:

Anonymous said...

its always a matter of time before any cipher can be deciphered. one must ALWAYS assume that messages sent are only temporarily secure and will be read at some point in the future with ease by people who want to do so. so behaviour adjustment is necessary.

what is really scary is that it is not unimaginable that at some point in the future there would be technology to scan people's brains from a far and record thoughts and feelings.

Tibor said...
This comment has been removed by the author.
Tibor said...

Anonymous: Well, public key encryption is pretty secure. If the mean decyphering time is 1 thousand years for a brute force algorithm,then it is as good as perfectly encrypted.

Of course, there can be a new Emmy Noether (a famous algebraist) who works for NSA today and has come up with a ingenious new way to crack that in a smarter way.

Also, what I gather from my limited knowledge of quantum computers, if they are constructed, the public key encryption is as good as the Caesar's cypher. Of course, very likely someone would come up with new methods or possibly already has that would work with quantum computers as well.

David Friedman said...

Judging by what I've been reading, the NSA probably does not currently have the ability to crack strong encryption using an adequate (but not impractical) key length. They may well be able to crack encryption done with a key that was considered adequate some years back. But mostly they have the ability to easily read unencrypted traffic and to break encryption that has weaknesses that the user is not aware of, in some cases weaknesses deliberately designed in by the NSA.

Douglas Knight said...

What you say in this post ("provided they can discover them") is different from what you said in your book ("with the right contacts"). The one example confirmed this week was discovered by cryptographers in 2007, but they were unable to exploit it because it relies on a secret key that only NSA has.

David Friedman said...

Douglas: Yes. In the book I was considering the problem with a legal requirement that provided a back door to law enforcement, which isn't exactly what the NSA has done.

But I don't think one can rule out the possibility of someone in the NSA making the secret information available, at a price, to people outside it, or someone outside figuring out how to exploit a weakness engineered in by the NSA.

RKN said...

Schneier is definitely a go to guy on this.

I used to use PGP with a pretty strong Diffie-Hellman key when I wanted to encrypt email and/or files. Schneier said in '96 PGP was as close to military grade encryption as an any user was going to find. I have one or two old computers that still run the old PGP implementation. It used to run as a plugin inside Eudora, and that worked really well, seamless encryption and decryption on the fly. Even attachments. Now PGP is owned by Symantec (I think) and Qualacomm gave up Eudora, which is now open-source (I think).

Totally agree with one point in particular in the linked article: If you really fear prying eyes keep your stuff on a computer off the network. This can be hassle for many, but you do what you have to do.

jimbino said...

Ironic that we techies, trained at great gummint expense, now need to apply our talents to frustrating our own gummint's attempts to compromise our privacy and liberty.

Tibor said...

I read the article in the link and I was especially worried about the fact that companies like CISCO actually are "persuaded" by the NSA to have built-in gadgets that allow them to wiretap routers and other devices.

It is funny,really. NSA spents hundreds of millions of dollars not only to make it easier for the chinese private criminals, but then they spend about the same amount of money for the opposite. It is almost like subsidizing tobacco and running government funded anti-smoking campaigns. Except that the consequences of NSA actions are probably much worse.

A friend of mine works at COSE (cognitive security) which is a company recently bought by CISCO and they develop botnet (a botnet is a network of "enslaved" computers that serve some purpose of those who control them externally - usually for either computing power, or more often data mining) detecting software and similar protection services. At one point they had a contract from the NSA as well, even though mostly they deal with private customers. The friend told me that the software they developed for NSA was for protection, but it could be easily altered for surveillance as well, which I guess means it probably has been. He's become increasingly paranoid about data protection since he has started workinng there...only that it probably is not paranoia, unfortunatelly.

Simon said...

One-time pads are looking better and better...

I thought this article in the MIT Technology Review was interesting... It describes making one-time pads in a medium that cannot be easily copied.

Simon said...

Seems to me that the most important information that we exchange tends to be relatively short messages to people we sometimes meet in person... Maybe one could print business cards with built-in memory chips containing one-time pads?

David Friedman said...

Simon:

Thanks. An interesting piece.

But the approach only works for communication between two people who have set things up in advance. It doesn't provide the equivalent of public key encryption, where you can send messages to a stranger with reasonable confidence that nobody else can read them.

Unknown said...

The best policy is to have any sensitive data stored in paper and have that data hidden in a safe place, preferably concealed. Anything you write on paper and store requires a person to physically enter the area where you store it and access your information. Of course this is not always practical so the most secure way to protect yourself is anonymity online. This can be achieved by purchasing a used portable computer that can access a wifi connection and using unsecured wifi connections that you find in your area to access the internet (for best results you would do this away from the house apartment you are staying in) and setting up new contact information on that device (do not use anything you used for identity before). IF you are really concerned about security doing this once every few months or at least once a year would be enough to make monitoring you harder. OF course, the issue with transfering the data to your computer is easy, just use a memory card to transfer it from teh portable device and format it enough times to wipe all data permanently and prevent recovery using a camera or other device that does not store information. If course, encryption still helps a lot with protecting data but that will make you hard to track by the NSA and otehr government organizations.

Oh, and a tip for people living in Canada: Purchasing a phone through the service provider President's Choice Mobility is good because you set up your information over the phone and can have it set up under a false name.