In recent news, CNET has reported requests for passwords, hashing and/or encryption algorithms and salts from U.S. government agencies:
The U.S. government has demanded that major Internet companies divulge users' stored passwords, according to two industry sources familiar with these orders, which represent an escalation in surveillance techniques that has not previously been disclosed.
While I'm only mildly worried that they can impersonate users at will, it strikes me as a major concern that enterprising private or non-U.S. APT-affiliated blackhats may attempt to impersonate U.S. government and get access to the data. Maybe I'm overthinking this...
- Does Centralisation Decrease the Probability but Increase the Damage of Exploits?
- Is there any security benefit of not using email services recently associated with PRISM?
- Can cloud based password managing services be trusted?
- What are the implications of NSA surveillance on the average internet user?