Report finds phone network encryption was deliberately weakened
vice.com
vice.com
See the success the Allies had in cracking the German and Japanese codes, and how devastating that was to the Axis, who couldn't believe their codes were broken.
In commercial applications, yes. In free-software that received audit and is built in a more-or-less reproducible manner, there is less concerns.
I'd have more trust in Conversations.im built by F-Droid.org repository than any proprietary messenger, for example.
I agree with your point. You'll see in my previous comment i never said such a solution was secure, just that it has "less concerns" and therefore i have "more trust". But i would rather not place my life in the hands of ANY KIND of software, or hardware that's beyond my mechanical comprehension.
In the case of OpenSSL, nobody had dared to even look at the code maintained by a single person. That's a huge problem. That code is not reproducible is another huge problem. It's also a huge problem that even when it is reproducible you don't have a convenient way to bootstrap the environment, to automatically audit code signatures (PGP) on the repository, and to compare checksums with another build environment.
The GNU/guix project is addressing all these issues. Their blog is full of good stuff about their work on bootstrap seeds, on their new "guix git authenticate" command which follows a "channel introduction" to validate signatures on the repo, and with "guix challenge" command to compare build output from several repositories. Exciting days ahead of us!
Trying to guess what your enemy is thinking is crucial yet very difficult work in a war like that. In "Most Secret War" R.V. Jones provides excerpts from some of the documents he wrote trying to do exactly this, based on what he believed his German equivalents would or ought to know e.g.
"A representative from Rechlin might point out that even if they could not go to decimeters, the use of frequency modulation with the present system might provide some immunity from jamming".
[ This is referring to the Germans' previously successful radio direction finding for bomber aircraft, which by this point the British are jamming. In the "fog of war" some German pilots believe the signal isn't jammed but "bent" sending them off course, in reality the British never developed the sophisticated calibration needed to actually do this, they just jammed the signals with powerful transmitters, but doubt set in anyway ]
Since you have are familiar with the man, there is a great PhD thesis online somewhere analysing Jones's work - he is the only source on manner matters here and he did have an ego. I'll link it when I can find it again.
He was passed up for the SciInt job at MI5 post-war for having the wrong background, apparently. Shame, might have put some more pressure on Philby and friends.
Each side held back on using it because they didn't want to tip the other side off.
It's curious to think what would have happened if one side or the other had discovered that their opponent knew about it too.
There are things that everyone could know (A), things that everyone knows (B), and things that everyone knows that everyone knows[3] (C). These are distinct sets.
The fact that direct access to FAANG servers[2] is granted without a warrant to the US government was widely publicized, yet most people still don't realize that the NSA is regularly looking at naked pictures of Americans stored in cloud services[1]. You might even be aware of this, but have missed the (reported at the same time) fact that this is the #1 source, the most-often used, in US intelligence reports. It's where they do most of their spying.
People haven't moved on to C about the non-privacy of gmail, for instance. Everyone savvy knows that gmail is compromised, yet because not everyone knows that everyone knows that, it's still pretended that your email box is private.
Publicity is helpful. Most people are too busy to realize what is being done by their military in their name. Repetition helps.
[1]: https://youtu.be/XEVlyP4_11M?t=1495
[2]: FISA Amendments Act Section 702, internal codename PRISM, reported in FAANG transparency reports as FISA orders
[3]: https://www.epsilontheory.com/harvey-weinstein-common-knowle... and https://www.epsilontheory.com/sheep-logic/
A5/2 (for voice communication, incl 2G) was known as a purposefully weakened variant of A5/1 for a very long time, and is probably what you remember. A5/3 (3G) and A5/4 (4G) are assumed not to be purposefully weakened, but are theoretically broken and, for related keys, practically broken.
But what this research was about, was GEA/1 and GEA/2 (for data encryption in EDGE/2G). It was known to be practically broken, but not purposefully broken until now.
At that point it’s not weaker crypto, more a back door.
Always was kinda baffled by apparent massive interest in controlling undersea cables and things like that, surely there are ungodly amounts of encrypted data which is of no real use to anyone? Apparently not.
What's interesting is that this practice continues in more recent systems:
https://en.wikipedia.org/wiki/KASUMI
Notice how KASUMI is a result of modifying a known but obscure block cipher MISTY1. It was modified to "meet other requirements set for 3G mobile communications security". Well, who said those requirements were for more security? And sure enough KASUMI is much more vulnerable than MISTY1.