Hacker News Reader

Comment by shawn | Hacker News Reader

Snowden caused this.

That's pretty interesting, one way or the other.

Interesting way to put the blame on someone exposing the crimes, instead of those actually doing the crimes.

The parent comment can only be read as assigning blame if you think that ISO rejecting the NSA's proposal is a bad thing. I'd say it's a good thing since we know that the NSA's proposals are sometimes backdoored.

Irrespective of the proposal being backdoored, it was clear that the NSA refused to follow standard procedure by providing the necessary supporting materials for their proposal, so it's not difficult to see why the ISO rejected the proposal.

Your rush to judgement here is unwarranted. OP said nothing about whether what Snowden did was good or bad, just that it was a factor in the ISO's decision.

Still off. The NSA’s behaviours made this decision happen. Snowden exposing those behaviours isn’t really relavent.

You're arguing over proximate vs. ultimate causes, when both are causes.

This was proximately caused by Snowden disclosing what the NSA was doing. It was ultimately caused by NSA monitoring major swaths of the population.

ETA: decent summary: https://en.wikipedia.org/wiki/Proximate_and_ultimate_causati...

I agree with other guy, that is a useful distinction and I didn’t know that’s what it was called.

I’ll still argue for ultimate cause because if it wasn’t Snowden it seems likely would have been someone else.

I’m a firm believer in don’t shoot the messenger, even if they are flawed.

Thanks for thatuseful distinction

Snowden helped bring those behaviors to light by being someone people could 'relate' to. Thus, calling attention to past, present, and future actions by certain agencies.

Unless you're trying to thank him.

True. Snowden made it happen :)

"Snowden causing this" is not a bad thing, it's a good thing. Personally, I like to be blamed for good things...

>> Snowden caused this.

No. NSA's reputation is its own. They were once trusted as experts but that stopped long ago. Clipper chips, lotus notes, echelon, RSA ... the decline in NSA's trustworthiness started decades ago and has been steady ever since. Snowden gave us shiny powerpoints and codenames, but the overall programs have been common knowledge in the community for generations.

In other words the NSA had a great reputation up until anyone knew it existed? They aren't NIST, they are a spy agency.

While the NSA never have given reasons for their recommendations, they did at least to some extent contribute to securing standards in the past. One example was DES, that NSA changed the key schedule, at the same time reducing it from 128-bit to 56 bits around 1976. They never said why, but 15 years later, in 1991, the academic crypto community discovered differential cryptanalysis, and found that the changes suggested by NSA was in fact strengthening DES, not weakening it. The attack made possible by differential cryptanalysis require 2^55 steps, which is the same as a brute force attack against a 56-bit key. That indicates that NSA knew differential cryptanalysis already in 1976, but only modified DES to being able to resist it, not telling about the attack. The reduced key length of the new key schedule indicated the actual strength of the cipher, without revealing the attack.

NSA recommendations was also one of the reasons that the Rijndael cipher was chosen as AES. So at least in the late 90s they had some positive reputation. As far as I can tell, the tipping point is 2001. After that, the spy part NSA seems to have all the leverage, and to actively propose backdoored standards is not below their dignity.

They didn't start out as a spy agency. That was the CIA's job. NSA were the security experts. They built the tools that protected government systems, and the systems of government contractors (aerospace). That they are now called a "spy agency" shows that reputation is long gone. Of course now the CIA is flying armed drones and the NYPD has a foreign intelligence branch. The old job descriptions are irrelevant. Everyone can do everything these days.

Ask the old hats about "no such agency". If you were working with the US government in the 80s/90s you knew the term.

SIGINT, that is spying on electronic communications, has always been a core part of the NSA's mission.

They have always been a spy agency.

See https://en.wikipedia.org/wiki/ECHELON

> They didn't start out as a spy agency.

They were a spy agency as long as they were the NSA, and inherited that function from prior, WWII spy agencies.

> That was the CIA's job.

CIA is a civilian spy agency focussed on HUMINT, analysis, and open source intelligence, and also the lead US spy agency (and it's head was essentially the overall head of intelligence prior to the separate DNI), while NSA has always been a defense department spy agency and the lead SIGINT spy agency.

> NSA were the security experts.

They have that function, too, but they have been a spy agency back to 1945 (before being public in 1952) and inherited duties from prior spy agencies when they were founded.

This is hardly the first time suspicion has fallen on NSA proposals.

As linked elsewhere in this thread, https://en.wikipedia.org/wiki/Dual_EC_DRBG

True, but it's one of the first with hard evidence to use against the NSA.

Trevor Perrin also asked to kick some NSA chair from the IETF board. On my phone can't find the thread.

https://news.ycombinator.com/item?id=6942145

Yes, because Snowden taught us not to trust the NSA because they're shysters and crooks. How dare he!

People that aren't the US government have been suspicious of, and reluctant to adopt, NSA backed encryption proposals at least as far back as the Clipper chip, because of the NSA’s overt signals intelligence mission.

Snowden certainly didn't help the NSA plan get traction, but reducing the rejection to Snowden is overly simplistic.

Not really. Snowden caused a lot of people to think that everything ever leaked out of the NSA and all changes in perception of the NSA were caused by Snowden. But that is a somewhat different thing.

Reply on news.ycombinator.com