• ERROR: Earth.exe has crashed@lemmy.dbzer0.com
    link
    fedilink
    English
    arrow-up
    61
    arrow-down
    1
    ·
    9 days ago

    Make them spend more resources doing deanonymizations. First they have to get the IP from instance admins, then trace the tor routing, then the VPN that I use, then ask for my ISP. Make them do all that work.

    (Or maybe they already have access by simply activating their backdoors within Intel ME, AMD PSP, and whatever baseband backdoor on the phones they have, and have just gotten everyone’s real identities in an instant, we can’t know for sure.)

    • Pennomi@lemmy.world
      link
      fedilink
      English
      arrow-up
      20
      arrow-down
      8
      ·
      9 days ago

      They also have backdoors in most implementations of TLS, according to a person I know who worked government security.

      • ERROR: Earth.exe has crashed@lemmy.dbzer0.com
        link
        fedilink
        English
        arrow-up
        35
        ·
        9 days ago

        It wouldn’t be impossible. There are like so many different certificate issuers, any one of them collaborating with a government would allow them to create a certificate that would be accepted by your browser.

      • AtHeartEngineer@lemmy.world
        link
        fedilink
        English
        arrow-up
        12
        ·
        7 days ago

        I work in cryptography, and I guarantee if that’s true “some person you know who worked in government security” would not tell you if they did know, or they are pulling shit out of their ass. There have been so many people that have looked at or worked on SSL/TLS implementations (including some of my coworkers), any vulnerabilities would have to be pretty subtle or clever, and that would be kept highly classified. Quit making shit up or repeating bullshit you heard.

        • Pennomi@lemmy.world
          link
          fedilink
          English
          arrow-up
          1
          arrow-down
          3
          ·
          7 days ago

          Sure, if we’re talking about code vulnerabilities only. It’s most likely a compromised root cert though.

          • AtHeartEngineer@lemmy.world
            link
            fedilink
            English
            arrow-up
            3
            ·
            7 days ago

            That just would allow a malicious attacker to fake being the server, it doesn’t actually compromise the TLS session. So you are talking about a much more sophisticated multi stage attack that needs to be actively executed. This wouldn’t at all allow them to record traffic and decrypt later.

            The certs authenticate that you are talking to the real server, the symmetric session keys that are usually derived from a diffie helman key exchange have nothing to do with certs. That’s two separate (but connected) parts of the transaction to build a TLS session.

            • Pennomi@lemmy.world
              link
              fedilink
              English
              arrow-up
              1
              arrow-down
              2
              ·
              7 days ago

              Right, this would be a MitM vulnerability, which could be reasonably viable for targeted attacks.