Hacker News Reader

Comment by jaimex2 | Hacker News Reader

If it looks and sounds like a duck then its probably a duck.

I can't see MS admitting to giving out a backdoor key. In any case it's irrelevant as you should always assume everything you don't have source to is compromised.

View on HN

> everything you don't have source to is compromised.

Everything for which you haven't read, fully understood, and compiled from the source can be compromised. Just because there's source for something somewhere doesn't mean the binary you downloaded is secure.

Relevant... [1]

> Ken describes how he injected a virus into a compiler. Not only did his compiler know it was compiling the login function and inject a backdoor, but it also knew when it was compiling itself and injected the backdoor generator into the compiler it was creating. The source code for the compiler thereafter contains no evidence of either virus.

[1]https://wiki.c2.com/?TheKenThompsonHack

This has always impressed me, I'd love to peek the code and try to read it but I highly doubt I'd be proficient enough to understand it.

Make sure you've also read, understood and recompiled the compiler. And the compiler used to compile the compiler.

Even then, assembly is too high level.

https://m.youtube.com/watch?v=eunYrrcxXfw

And then we get into hardware design...

https://m.youtube.com/watch?v=_eSAF_qT_FY

That reminds me of an answer on Quora where a compiler was infected and would insert white supremacy messages into the compiled program. And if you tried to recompile the compiler, it would inject its code into the new compiler[0].

[0]: http://www.quora.com/What-is-a-coders-worst-nightmare/answer...

Because open source projects like OpenSSL never have bugs sitting wide open for years. cough Heartbleed

Normally, I'd agree with you, but this seems a bit too on-the-nose for me. When people have to talk about a shady or immoral activity or put mentions of it in writing, they usually get very creative in finding an inconspicuous name for it.

As such, if this were really a backdoor, I'd expect it's identifiers to look maximally boring and no direct reference to the NSA given anywhere.

Conspiracy theories tend to hinge on the idea that the conspirators are simultaneously 5-dimensional chess playing lizard people from the future and, at the end of the day, dumb as a rock.

Coincidence theories tend to hinge on the idea that everyone is incompetent and that nobody could ever collude together in secret for any sort of malicious or self interested purpose.

They hinge on the idea that the greater the value of T or N, the less likely a conspiracy will remain a secret, where T is time and N is the number of conspirators. N is usually the dominate factor.

I think there are many obvious weaknesses to this line of logic. There is some merit there, but it oversimplifies the subject in the extreme.

Well, I would think so as well, but we have at least some anecdata (N=1) in the other direction [0]:

> In doing this I discovered that the NSA public key had an organizational name of "MiniTruth", and a common name of "Big Brother". Specifically what I saw in my debugger late one night, which was spooky for a short moment was:

O=MiniTruth CN=Big Brother

[0]: http://www.cypherspace.org/adam/hacks/lotus-nsa-key.html

This could just as easily be a programmer stretching the metaphor as far as possible, which is not exactly an uncommon practice.

That was specifically a key escrow-style system, so you're right there. Lotus Notes wanted to provide strong encryption abroad, in the bad old days of ITAR. they used a hybrid of an exportable-sized key (~50 bit encryption) and a stronger, backdoored key (MiniTruth.)

They were very public about it, though. It sucked they had to water down their encryption, but that was the reality until PGP challenged ITAR head-on.

What if it is a case of malicious compliance like Lotus Notes' backdoor someone else already has mentioned (the classic O=MiniTruth CN=Big Brother)?

I'd wager that there's a high probability that an arbitrary engineer tasked with implementing things like this either doesn't care or is antagonistic, thereby calling the duck a duck.

Also, the name was never supposed to be known - it was due to early releases mistakenly having debug symbols included.

Nadella has just said that he would support a "don't-call-it-a-backdoor" backdoor key for the U.S. (and I assume other) government(s):

https://www.theverge.com/2020/1/13/21064267/microsoft-encryp...

Also, there are at least several other instances that make Microsoft highly suspicious in regards to this stuff, starting with:

- how they bought Skype not long after the NSA was promising billions of dollars (in government contracts most likely) to the company that would bypass Skype's encryption somehow

- changing Skype's architecture to be intercept-able

- Skype entering the PRISM program the moment Microsoft bought it

- some other suspicious "bugs" and design choices in regards to how Bitlocker works, including storing the encryption keys on its servers or defaulting to break-able OEM encryption. Plus the fact that you never do hear about law enforcement being thwarted by laptop encryption

- silently adding root certificates in Windows with no official documentation, some for some oppressive regimes, other for the U.S. government

- Not to mention that the first thought that came to my mind after hearing about all the hidden tracking stuff built into Windows 10 was that Windows 10 must have been designed based on a FBI/NSA wishlist.

If you've ever done anything "wrong" on your Windows 10 machine, the U.S. government will know about it, because Microsoft will know about it. At least Microsoft revealed to us that half of the government's orders to the company were secret and came with gag orders -- too bad they never really fought the government on it and ended-up supporting it with the Cloud Act.

There are probably others I missed myself or forgot about. Nadella must think of us all as idiots if he thinks we'll buy the idea that a specially-made encryption key for various governments doesn't equal a backdoor.

Where do you believe MS is storing all this tracking data you believe they are taking from every Windows 10 machine on the planet?

Doesn't this conspiracy theory stretch belief a great deal?

The NSA has built absolutely fuck off massive datacenters in multiple places in the United States. The parent is suggesting the telemetry from Windows 10 is mostly getting passed off to the NSA

That's a nice conspiracy theory, but that doesn't make it any less absurd.

^Willful ignorance.

Sorry, but if you've been reading, there's just no other explanation.

Props for at least knowing the difference between a conspiracy and a conspiracy theory, though, unlike half of the internet.

Reply on news.ycombinator.com