Hacker News Reader

Comment by plopilop | Hacker News Reader

We are migrating all of PKI to the more costly and less efficient postquantum cryptography, even though nobody will reasonably use a quantum computer to snoop on your home IoT daily reports. I mean, I assume that what you are doing on your free time is not worth governmental attention.

The rationale of mass migration is that if you don't impose it, nobody migrates. This has notably been the case with famously insecure SSL parameters (512 bits RSA keys, PKCSv1.5...). And many companies may believe they are not critical, which might be true until it is not.

Case in point: you manufacture walkie talkies and suddenly your products have bombs inside. Or you maintain a compression library for free and suddenly you are shipping a backdoor to all Linux products.

View on HN

Exactly. Reasonably speaking, nobody tries to pierce encryption at all, ever. That doesn't mean we should stick with 3DES. Reasonably speaking, nobody will try to break in to your house at all, ever. That doesn't mean you shouldn't lock your door. Security is already about protecting against infrequent events.

> And many companies may believe they are not critical, which might be true until it is not.

I'm at a K-12 public school. That shouldn't be on the front lines of a war with Iran, but, in cybersecurity terms, we are. If you disrupt a school district, you disrupt one of the largest employers in the area. You also disrupt the largest childcare facility in the area. The amount of economic damage you could inflict on a community by disrupting the public school system is pretty extreme compared to the amount of funding provided to protect it.

> nobody will reasonably use a quantum computer to snoop on your home IoT daily reports

Feel free to tell that to journalists investigating corruption ...

Literally the next sentence:

> I assume that what you are doing on your free time is not worth governmental attention.

Definitely does not apply to journalists investigating corruption.

>> > I assume that what you are doing on your free time is not worth governmental attention.

> Definitely does not apply to journalists investigating corruption.

And that bring to mind another aspect - When strong security is not the default, anyone using it looks suspicious in some eyes.

My reply did not exhibit a lack of understanding of this mechanism.

It instead questioned to which degree execution of them is reasonable in a world that does not contain infinite resources.

Everything is a trade-off. Not all of them make sense.

Sure, but here I guess the main idea is that everything is linked, especially how libraries package managers work nowadays.

In order to compromise the big player, you only have to compromise the weakest link in its supply chain. In effect that means that leaving the migration optional is as useless as doing nothing.

Let me put it differently:

It is not of my concern to live in ways that are harder for me, just so that big tech can have it easier.

Big tech being compromised will also make your life harder. The opposition small/big players is not as clear cut as one would like.

Sure, buddy. Let's just not question anything at all. Move along, don't cause friction.

Jesus man.

It does make sense to set sha256 as the default. I would like even strong to future proof things a bit, but sha256 is a good upgrade.

Yeah that argument you completely imagined and nobody implied is ridiculous!

This is the whole concept of Defense in Depth.

> I assume that what you are doing on your free time is not worth governmental attention.

https://www.change.org/p/stop-the-chat-control-european-regu... is worth a read, IMO!

As for "nobody will reasonably use a quantum computer to snoop on your home IoT daily reports", they already have access to your data one way or another, so really no need for a quantum computer. :P

I don’t understand your comparison with walkie talkies. What are you trying to highlight here? In the case of the pager attack in Lebanon the devices were booby-trapped. Are you trying to say that the device designers should have somehow done something about it? I cannot really make sense of it

My point is that the business of pagers is rarely seen as something likely to be booby trapped by a nation state. Yet in the context of Lebanon it happened.

I don't remember where the compromise happened (factory, distribution, sell point), but very clearly at least one of them did not expect to be a critical asset in the Israel - Lebanon war.

> I mean, I assume that what you are doing on your free time is not worth governmental attention.

> Or you maintain a compression library for free and suddenly you are shipping a backdoor to all Linux products.

You already showed yourself that your naive assumption is wrong for a relevant group that uses Git.

Yes, that's exactly the point I'm trying to make?

Assets are non critical until they become critical.

Reply on news.ycombinator.com