Hacker News Reader

Comment by kome | Hacker News Reader

[flagged]

Huawei stuff is proven to be compromised, just not by NSA, instead by China.

If anything, you probably need several layers of different, non-aligned country vendors to have some Swiss cheese model security. So some Huawei stuff, somewhere, as long as it isn't only Huawei stuff.

checkpoint firewall (Israel), PAN/fortinet firewall (US), and huawei firewall (china) daisy chained - should keep each other in sync and provide defense in depth :D

Network designs i have seen often include this for much the same reason. A perimeter firewall is from one vendor and an internal firewall is from another. If there is a security issue with one device the other should not be effected in the same way.

lmao it's like using a multi-hop VPN to hop through multiple jurisdictions, but in your own home!

This is a great idea in that they’ll likely also patch their stuff when they discover the other team has exploited it.

To my knowledge, no proof has actually been publicly presented for this claim. There have been a few stories that didn't pan out (like the one that boiled down to, "Huawei devices have telnet installed"), but no actual evidence of backdoors has come to light yet.

This is despite the fact that Huawei has been under an extraordinary level of scrutiny for years. British intelligence was given extensive access to Huawei's hardware and code, as a condition of Huawei equipment being installed in the UK. We know from Snowden that the NSA hacked into Huawei HQ, but there's no indication that they found any evidence of backdoors. And despite running a global campaign to convince/pressure other countries not to use Huawei, the US hasn't publicly unveiled any evidence of Huawei backdoors. British officials have even admitted that the UK's decision to ban Huawei was based on pressure from the US, not evidence of wrongdoing.[0,1] This all makes me think that the US, UK et al. don't actually have proof of backdoors.

0. https://www.theguardian.com/technology/2020/jul/18/pressure-...

1. https://www.euractiv.com/section/politics/short_news/uk-bann...

Great post. Seeing similar with TikTok and DJI FUD

Isn't that just the US speaking in order to get more control? How is it proven? I've never seen any evidence of that, but there has been much evidence that the US does what they blames others of doing, like this and Cisco.

At this point it seems the US is accusing others for doing bad things because that's what they themselves do.

Huawei was growing really fast, threatening both Apple and Google. Then the US said it was not safe while trying to sabotage both smart phone sales and mobile networks sales. The US pressured allied countries to not choose Huawei for 5G, and didn't let companies work with them.

Huawei was also willing to compromise by giving network operators acces to source code.

Is Huawei bad? I don't know, and I've yet to see any evidence. Does the US do exactly what they are accusing other for? Yes, that has been proven multiple times.

We live in a day where we talk about privacy and security, while giving large corporations full control over our iOS and Android devices. How useful is e.g. E2E encryption really when the os itself has a direct connection to the mothership?

China has a LOT to gain from industrial espionage, is extremely well known for its industrial espionage, and also happens to effectively own EU telecoms (the 5G thing was like a decade too late).

It would be astounding if they didn't take advantage of this.

There is ample evidence of China's intentions and capability to install backdoors. Everything made in China or a heavily influenced Chinese country should be assumed to be compromised, even if 'proven' otherwise. Chances are we just haven't found the backdoor yet.

Sure - but all that is equally true of the US.

True of the US yes. Equally? I probably wouldn't say that. The US govt doesn't have the same control over media the the Chinese govt has. So they have to work harder to keep things out of public view. The US also has to massage the way they work to be somewhat within the bounds of the constitution.

It was never proven to be compromised though. GCHQ concluded after many years that they were sloppy, not malicious. All of the fear mongering by the US is what gave everyone the impression they were compromised.

China is way less dangerous to me than the NSA

How is the NSA personally dangerous to you?

If you live in the US, you're under US federal jurisdiction.

Unless you're regularly traveling to China or unearthing info that can seriously harm China, they're not going to send anyone after you.

I rather be spied on by a foreign government than my own.

Compared to any TLAs in China, the NSA is far more likely to take action against a US citizen for a thing that citizen chose to say. It's likely there's a low amount of actual danger but it's greater than that of what China poses.

As a non US citizen living in a western country, the NSA has no qualms analyzing everything I do/say/think, including in my activism, and tell on me to the government of my country.

Where is the proof?

Chinese law requires Huawei to cooperate with their intelligence agencies.

As does the USA, so we shouldn't be using Windows or Yubico either, or virtually any other software/hardware from any other vendor because there's few countries that let you do illegal-over-there things without having a mechanism to force you

It's a "pick your poison" situation, not a "they've got national security letters and so you can't trust them" one

This is why security is not a "one size fits all" exercise. The first thing you must do is define your threat model.

The reason the Chinese government doesn't want to build their telecom system on Cisco hardware is the same exact reason the USG doesn't want to do the same with Huawei hardware. Because neither government is delusional enough to think that parts/service/updates wouldn't be immediately sanctioned in times of war.

The US and China are already sanctioning each other's tech. The risk of building critical infrastructure on it is obvious.

> The US and China are already sanctioning each other's tech.

It's not symmetrical. Since Trump, the US has been extraordinarily aggressive in its use of sanctions against Chinese companies, whereas China has been very reluctant to retaliate directly.

The US has sanctioned hundreds of Chinese tech companies. China has only recently begun to retaliate in kind, but has so far only sanctioned a few US companies (Micron is the only prominent example that comes to mind).

It isn't. And I didn't say it was. But the current state isn't the ultimate risk that is being considered. The ultimate risk is war, under which both the US and China would invoke defense powers to compel industry to act in their respective nations' interest, and would apply wide sanctions.

The zero-sum thinking of the Trump and Biden administrations, in which China is seen purely as a threat and all sorts of cooperation and economic integration are being rolled back, makes war more likely. The US is not compelled to ban Huawei and sanction all sorts of Chinese tech firms - that's a choice.

That doesn't prove anything. You're just saying that Huawei could theoretically be compromised, but the above commenter asked for evidence.

They are compromised in terms of governance, and their legal environment is the proof of this.

Nobody has ever claimed that Huawei devices have backdoors. The issue is that the supply chain is compromised by legal means, not the hardware or software currently being shipped has technical vulnerabilities.

If you're using that non-standard definition of "compromised" then anything substantially made in the US, Australia, South Korea, Israel or Kazakhstan (non-exhaustive list) should be considered compromised.

I'd love it if people actually stuck to some principles and stopped buying from any of these countries. But using that legal situation as a reason to single out China/Huawei is bullshit.

"compromised" might be a word used by the tech community to refer specifically to technical compromises, but the word means something much more broad outside of tech forums.

> then anything substantially made in the US, Australia, South Korea, Israel or Kazakhstan (non-exhaustive list) should be considered compromised.

Not really, because many of those countries you listed have mutual treaties of cooperation and are not hostile to each other.

> Not really, because many of those countries you listed have mutual treaties of cooperation and are not hostile to each other.

Doesn't seem to stop them from taking immensely hostile actions, e.g. the US spying on Merkel's emails, or helping killers and rapists who work for them evade arrest in "allied" countries. Governments are large and complex and have many competing interests. Why would/should one trust any of the ones I mentioned more than the government of China?

People/governments should trust whoever is more closely working in cooperation with their own interests over those who are working against them.

Agreed, so how do you get from that to mistrusting only China? Everyone, including China/Huawei, has an interest in growing the pie. Some entities have an interest in zero-sum competition with me and mine. That's more likely to be someone closer - Chinese companies aren't competing directly with my business, but American, Australian and Israeli ones are.

I don't. It's just that this thread was about Huawei.

> Nobody has ever claimed that Huawei devices have backdoors.

Just a few comments up in this thread, someone claimed definitively that Huawei equipment has been proven to be compromised, meaning backdoored.

> They are compromised in terms of governance

We don't have any known examples of Huawei being forced by the Chinese government to compromise its equipment. This is still a wholly theoretical discussion. In contrast, we know that the US government has inserted backdoors into American (and not just American) equipment, and is able to secretly compel companies to comply with US spying.

Since the Snowden leaks (and honestly since long before) it's been safe to assume that if a nation state has the means and motive to commit <insert form of illegal surveillance here>, then they will.

Proven?

Did they ever show any evidence?

I hear that claim pretty often but have never seen any proof unlike in Cisco hardware.

a CIA claim isn't "proof". I've never seen anything to prove it, just imperialist hysterics

It is fair to think that if the CIA is compromising US companies, then China is likely doing the same to Chinese companies. To assume otherwise is wishful thinking.

Reply on news.ycombinator.com