The tag has no wiki summary.

learn more… | top users | synonyms

2
votes
1answer
39 views

Possibility of using CA as an attack point by governmental organizations under their pressure

I was always concerned about the model of trust behind CA stuff we use . Well, for most of us, it is OK to trust them, since they are reliable organizations with a bunch of solid experience. ...
1
vote
3answers
235 views

How can the NSA remotely turn on your iPhone?

If the iPhone is actually off and not in sleep mode, how can it be remotely turned on if no software is running and network communications aren't even activated until the device boots?
32
votes
5answers
4k views

HTTPS still NSA-safe? [closed]

There are exerpts, that say that using https can be broken by the NSA by now. So is https still a solution for secure web-browsing? source: ...
9
votes
2answers
411 views

Snowden: “The NSA can remotely turn on your iPhone.”

Watching the Snowden interview last night, Brian Williams asks him what degree of control the NSA has over smartphones -- in particular, whether or not they can remotely turn them on in order to ...
3
votes
2answers
389 views

How can NSA implants and backdoors be detected? [closed]

It has been a while now since the Snowden revelations of various NSA malware and backdoors. For instance: March 12, 2014: NSA has developed implants to take over targeted computers’ microphones ...
2
votes
1answer
157 views

How does the NSA restrict public access to cryptography?

In Bruce Schneier's book Applied Cryptography (1994?) he writes The NSA uses its power to restrict the public availability of cryptography, so as to prevent national enemies from employing ...
1
vote
2answers
297 views

Is 1password vulnerable to NSA spying? [closed]

In light of the recent heartbleed vulnerability, I'm thinking of switching to a service like 1Password. However, I don't know how to evaluate the risk of NSA (or other government) spying. So, two ...
2
votes
3answers
130 views

How can NSA see everything without us noticing that? [closed]

Here's one thing that keeps bugging me ever since I heard about the NSA revelations. From what I heard, NSA built a system that basically sees most of the internet, made of many subsystems which ...
0
votes
4answers
348 views

Are Truecrypt volumes safe from the government agencies? [closed]

I have some Truecrypt volumes stored on my USB drive and I would like to know if they are safe from being cracked by the FBI or any government agencies? Some people say Full Disk Encryption will ...
0
votes
3answers
536 views

Any alternative available for RSA? Is the web still visible to NSA?

After the Snowden revelations, is there any mass change being carried out to HTTPS protocol? As far as I understood, any HTTPS communication is still visible to NSA as they can compromise the RSA ...
0
votes
1answer
105 views

Do the Linux binary blobs contain any intentional security holes?

This question covers the risks of accepting Binary blobs in one's distribution. This may be a very paranoid conspiracy question. But considering all the topics regarding the NSA in 2013 one cannot ...
3
votes
2answers
224 views

Tor traffic correlation attacks by global adversaries

I recently came across a paper called "Users Get Routed: Traffic Correlation on Tor by Realistic Adversaries" (Aaron Johnson et al) ... which seems to be saying that adversaries (like the NSA) that ...
0
votes
2answers
463 views

How secure is XMPP with self-signed SSL certificates?

I'm looking for an easy way to set up a simple IM infrastructure that protects messages in transit as well as avoids having logs in places that neither I nor someone I trust controls. I'm based in ...
7
votes
2answers
461 views

How to circumvent compromised CPUs in major FOSS operating systems

As Matthew Green puts it, "the NSA has been ... Working with hardware ... vendors to weaken encryption and random number generators." At this stage, however, there is little public knowledge of which ...
0
votes
2answers
185 views

Can Tor browser bundle be attacked like this?

When using the Tor browser bundle, you load the check.torproject.org on start. It tells you when there is a security update to downloads, and let's you click a link to get it. The way for users to ...
-1
votes
4answers
210 views

Is it possible to digitally sign information with a password?

I'm creating a cloud storage service and need to have the ability to provide reliable security for clients. In my previous question, I used a different schematic and said I would post a new question. ...
3
votes
1answer
679 views

Are there any holes in this security design?

This design is for transport security between a client and a server. I'm planning on using it for a cloud storage system. I would like it to be secure against you-know-who. I'm trying to prevent the ...
0
votes
3answers
254 views

How did Snowden do it? [closed]

We've all read about how Edward Snowden got access to thousands of classified documents and shared them with reporters. But how did he do it? He got access to tons of documents that he was not ...
1
vote
4answers
361 views

Which encryption schemes have been designed without involvement from the NSA [closed]

What are the main stream crypto algorithms that have been designed without known involvement from the NSA? I know that twofish has been designed by Bruce Scheier, but which are the other ...
34
votes
2answers
7k views

Best practices for Tor use, in light of released NSA slides

It has been known in the security community that a tool as versatile as Tor is likely the target of intense interest from intelligence agencies. While the FBI has admitted responsibility for a Tor ...
-1
votes
1answer
69 views

What are the security features of the proposed “secure email” from Brazil? [closed]

Brazil has announced that they will create a secure email alternative in light of NSA spy programs. The company Correios will be implementing the contract over the next year or so. What are the ...
4
votes
3answers
700 views

Does Google's SSL encryption for searches thwart NSA spying?

Given everything that is suspected about NSA (and GCHQ, DGSE, etc.) access to user data: Avoiding speculation, can and do we know whether Google's recent action to make all searches use SSL ...
3
votes
4answers
459 views

What are the features of Dual EC DRBG that are lost when using a different cipher?

Due to a potential NSA backdoor, the NIST is now recommending that implementor no longer use ECC-based PRNG Dual EC DRBG. (As described in Wired.com) this PRNG has certain features such as: ...
3
votes
3answers
425 views

Attack on Tor with stolen private keys of main nodes

What could attacker do with stolen private keys of main nodes? Tor is based on 10 main nodes: moria1, tor26, dizum, Tonga, etc. IP Addresses of this nodes hard-coded into client. ./src/or/config.c: ...
6
votes
3answers
482 views

What can a web application developer do to protect user information from powerful adversaries like the NSA or China

Some well funded intelligence services with potentially untrustworthy employees intercept and store encrypted data for years, in hopes of cracking it with future technology. What can I do to make this ...
2
votes
1answer
206 views

Using only private non-government resources, how can something be sent such that the NSA will see it? [closed]

Supposing you want the NSA to see something, what does one have to do to guarantee it. This means in their normal data collection it will be swept up, not in a targeted probe of an individual or with ...
11
votes
2answers
1k views

RdRand from /dev/random

"Linus Torvalds, in response to a petition on Change.org to remove RdRand from /dev/random, has lambasted the petitioner by called him ignorant for not understanding the code in Linux Kernel. ...
67
votes
3answers
3k views

Did US and UK spy agencies defeat privacy and security on the internet?

This question is meant as a canonical question in regard to the US and UK spy agencies compromising end nodes and encryption between nodes to spy on people they suspect to be terrorists. However, this ...