Hi Ted, Bob, On 10/03/17 22:53, Bob Hinden wrote: > Ted, > >> On Mar 10, 2017, at 1:46 PM, Ted Lemon <mellon@xxxxxxxxx> wrote: >> >> The one thing I wish you'd mentioned in this blog, but did not, is >> a point someone made earlier on this thread: that the fact that the >> CIA needs to hack individual devices to bypass end-to-end >> encryption means that what we are doing in promoting encryption is >> effective and worth doing: rather than everybody's communications >> being vulnerable, individuals must now be targeted. > > I think that’s a good point. > > To expand what you said, these tools are for targeted attacks, not > mass surveillance. I don't think your optimistic conclusion here follows, for two reasons. Firstly, we've seen that the adversary here is not driven by economic concerns and will attack not just a weakest link, but all possible targets they can afford given their very very large budgets. That I think means that these kinds of attacker will attempt both pervasive and targeted attacks, and the fact that they attempt the latter does not mean that the don't try both. Secondly, it may be that different kinds of attacker have different kinds of targets/goals and that some attackers here (such as the claimed source of these materials) are generally more interested in individuals and not in populations. So again, without further information, the interest in targeted attacks does not imply a technical or practical inability to mount pervasive monitoring attacks. And while I do think that the actions that many people in the Internet community and in the IETF have taken have probably made pervasive monitoring harder and/or more costly, I do not think that's really that relevant to this particular leak. In this case, I think the much more interesting thing is that this is yet another demonstration that attack code that is intended to be used for attacks (as opposed to demonstration) is in the end hugely counter-productive. (And immoral too IMO, but I'd not claim that we all need to agree with that last;-) > Encryption continues to be a strong protection > against mass surveillance. I totally agree encryption is a major tool in our armoury. But that's kind of orthogonal to issues arising from this incident I think. Cheers, S. > > Bob > >
Attachment:
signature.asc
Description: OpenPGP digital signature