Hacker News Reader

Comment by greyhair | Hacker News Reader

That isn't a praise of GUIs, it is a damnation of OpenSSL

The exact opposite of *NIX philosophy. Don't do just one thing well, be Swiss Army knife, the largest one you have ever seen, with a lot of the blades poking part way out, so you may lacerate yourself at any moment.

View on HN

I heard rumors on HN that security agencies had a hand in making the protocols overly complex, hoping that would cause bugs in implementations they could exploit.

Sounds unfalsifiable

I mean, that's almost a textbook conspiracy theory. "Heard from a friend", hard to prove, hard to disprove.

No conspiracy needed, they deliberately sabotaged certain standards to make them weak/easy to break, until it was caught by the security community and they were rightly rebuked for it. Like DES

"Heard a rumor" was there to provide an estimate of how (un)reliable the information was. My hope was someone would be able to confirm it, and it was not my intent to pass it off as confirmed fact. Regardless, as the sibling poster noted, they have already been caught weakening standards.

This may sound plausible at first, but if you've watched these kinds of things for a while there's an entirely plausible other explanation. Everyone wants to have their little special case feature in, and nobody says "No!". Very few people actively try to avoid complexity and favor simplicity in standardization processes, even fewer did up until a few years ago.

"Avoiding complexity is good for security" is the thing that everyone will claim to agree if you say it, but hardly anyone follows in practice.

Sprinkle in some security by obscurity; “If we just use our own variant of the algorithm , the hackers can not use common exploits!!”

Scare of liability is another plausible reason. Nobody wants to be famous for picking the wrong default algorithm that exposed the whole internet. Easier to blame each individual user for choosing the wrong exponent or number of padding-bits.

Security agencies have spent hundreds of millions of dollars per year in its efforts to undermine internet encryption standards and implementations. One well-known case is Dual_EC_DRBG, in which the NSA backdoored a NIST encryption standard and bribed companies to implement it in widely used products.

All of this is well documented by numerous major news outlets, especially since 2013. I wonder if people screaming "conspiracies!" are doing so in good faith.

[1]: https://www.theguardian.com/world/2013/sep/05/nsa-gchq-encry...

[2]: https://www.nytimes.com/2013/09/06/us/nsa-foils-much-interne...

[3]: https://finance.yahoo.com/news/juniper-breach-mystery-starts...

[4]: https://en.wikipedia.org/wiki/Dual_EC_DRBG

Dual_EC_DRBG was a little different. It introduced an asymmetric key that only the NSA had the private key for. So only the NSA was able to exploit it. If they were to make stuff complex generically with the hope of it being buggy, it would lead to bugs that other intelligence agencies could exploit.

This still assumes that intelligence agencies are good at keeping their backdoors to themselves, which is not necessarily the case.

Do they really care though? NSA's previous handling of zero days [1] suggest that they care more about advancing their offensive capabilities even if it means putting critical public infrastructure at risk.

[1]: https://news.ycombinator.com/item?id=12365629

This is what you get when you have something that's entirely in the application layer when part of it should be in lower layers. Cf. HTTP3/QUIC

However, it's good that it's there, so you can add it if the lower layers aren't providing.

I wish we had a layer 6-ish security protocol that "just worked" the way HTTP just works. Something analogous to an ssh tunnel, where once you establish the correct keys (via a single, simple operation), clients and servers can just talk with no extra application-level configuration.

Currently if I want to use HTTP2/3, I have to fuss with openssl, self-signed certs (which never seems to work reliably for me), messing with /etc/hosts... it's always just painful for me for some reason.

When using kubernetes you have Service Mesh. Not the most easy.

Outside of that there is like you say SSH tunnel or other forms of VPN. Except those are usually more global and expect all players inside the network to be dmz.

Reply on news.ycombinator.com