Hacker News Reader

Comment by yahwrong | Hacker News Reader

Like the 'government agency' doesn't already posses the encryption keys or other methods to extract information from encrypted data.

View on HN

That's super simplistic. Nobody magically 'has' anything. They need to do stuff (like this) to get anything.

Employ a 'reverse Snowden' and it's a done deal.

Large companies have plenty of safeguards against internal threats, especially when things like encryption keys are concerned.

They all do, and in most of them there are obvious errors in processes or rights assignments. It is pretty rare to come across a company that takes the threat from within serious. That's the whole reason Snowden could do what he did and if the NSA gets it wrong then there is a fair chance that your average corporation has faults as well.

Most governments don't, but even the NSA taps into unencrypted or weak links along the pipe. https://www.newyorker.com/news/amy-davidson/tech-companies-s...

"SSL added and removed here! :)"

My understanding is that they record encrypted traffic too. They can't read any of it - yet.

But they're betting one day either a security vulnerability will be discovered, or computers will be fast enough to attack the encryption and allow them to read the data. So even though it's unreadable today, it might be in 10 years.

I remember hearing a speech by a quantum computing researcher that was primarily funded by the NSA. He included an anecdote about how “they would prefer quantum computing didn’t exist, but if it’s going to exist - they want the first one”.

That's a lot of data though, especially since it's usefulness goes down with time.

It certainly is.

According to the NSA technical director at the time (2013) the Utah datacenter has a capacity around 5 Zettabytes.

That seems hard to believe. That would be five billion 1TB hard drives.

Considering around 100 million hard drives are shipped per quarter, that would be over a decade of production.

Do you have a source for that 100 million figure? It strikes me as awfully low considering how many personal computers must surely exist in the world and how often they'd be replaced without reusing the drives, not even factoring in servers.

Sorry, that's per quarter. So it would be more like over a decade of all worldwide HDD production. Still crazy high IMO.

For platter or SSD drives, sure. Some forms of magnetic tape storage can get up to 300 TB per cartridge though, which can scale up to petabytes in the right config.

Still ridiculous for information that is worth less and less over time.

300TB per cartridge in 2013? I think 10TB per cartridge was pretty high round then. That's still around half a billion tape cartridges, which are also very slow to read and write from.

There's rumours that the 2011 HDD shortage was actually due to the NSA buying it all.

Even 5EB would be a stretch for 2013. 5ZB is flat-out impossible. As another poster points out, that's years' worth of total worldwide drive shipments (most sources put it at less than 1ZB in 2013). Large buyers are further constrained by the fact that their demand can cause price spikes even at much lower percentages of the total. Not even No Such Agency has that kind of budget. The Utah facility also isn't physically big enough for that figure to hold. I work on large storage systems at one of those large buyers, and I've toured one of the several data centers where ours live. NSA's Utah data center looks to be on approximately the same scale, not orders of magnitude bigger. It's further plagued by power problems, which is another constraint on total size.

So I looked into that quote from the NSA director. What was actually said, apparently, was that the center was designed to hold up to 5ZB, not that it actually did. That seems to be a design based on some extremely optimistic assumptions about future drive density, power consumption, and cost. Needless to say, those assumptions were a bit silly at the time and have only seemed more so in retrospect.

P.S. It looks like TechCrunch came to almost exactly the same conclusions that I did, for very similar reasons. https://techcrunch.com/2013/07/24/the-nsas-massive-utah-data...

Here's an article about the NSA cracking some parts of the web:

https://arstechnica.com/information-technology/2015/10/how-t...

""" For commonly used 1024-bit keys, it would take about a year and cost a "few hundred million dollars" to crack just one of the extremely large prime numbers that form the starting point of a Diffie-Hellman negotiation. But it turns out that only a few primes are commonly used, putting the price well within the NSA's $11 billion-per-year budget dedicated to "groundbreaking cryptanalytic capabilities." """

Not even limited to 'the government'. Improperly sanitized network gear shows up in second-hand markets all around the world. Happened at a former employer of mine and a 'finder' attempted to extort us over it. VPN PSKs on the equipment were still in use in the field (no PFS either, so years of captured content could ostensibly have been decrypted).

Even equipment that appears to have been cleared out is probably hiding secrets in flash. The vendor of the equipment in this case had a separate command to wipe file contents. Deleting files just unlinked them in the flash fs.

Yep, I personally bought a Cisco firewall off of eBay several years ago that still had its entire configuration on it, including the PSKs for several IPSec VPN connections as well as SNMP (v2) communities, weak "type 7" hashes for local user accounts, the shared secrets for a pair of RADIUS servers, and so on.

Pretty much all of them (with the exception of the VPN PSKs) were sufficiently "generic" enough that I was convinced that they weren't device-specific, i.e., they were probably shared across many such devices.

According to the login banner, the firewall came from a casino.

I'm certain that my experience was not a unique one.

They absolutely cannot crack all encryption schemes. It's ridiculous to even suggest it, even if they would have fully functioning quantum computers.

who said the data isn't valuable years down the line? Crack today, who knows. Crack in the future, more than likely.

This is a claim that has been made about the Total Information Awareness program, its offshoots and, specifically, the NSA's big datacenter that was in the news some years ago: that one of the things the NSA are doing is collecting all the data they can in the hope they can make sense of it later, even I'd they can't now.

@yahwrong: > Like the 'government agency' doesn't already posses the encryption keys or other methods to extract information from encrypted data.

Shoosh, we're all supposed to engage in the charade that it isn't going on.

Reply on news.ycombinator.com