[clug] DIY cloud services?

[Alex Satrapa]

On 16 Feb 2015, at 10:19, George at Clug <Clug at goproject.info> wrote:
> Data encryption is a deterrent to accessing your data, it does not
> mean that the data cannot be accessed.

Two ways that the NSA can break your encryption without resorting to super-computer equivalents of the Bletchley Park Bombes:

1) The “rubber-hose” workaround (i.e.: physically abuse you until you cough up the code) http://xkcd.com/538/

2) Compromise the computation path of the encryption, everything from proposing dodgy encryption standards through to “influencing” processor design. One example discussed was persuading a chip fabricator to fabricate the exact design required but to “accidentally” leave certain transistors poorly doped. This would ensure that the “random” numbers generated by the chip looked random to casual observers, but anyone who knew the secret could reduce the entropy of the generated numbers by a few orders of magnitude (i.e.: the numbers follow a more-easily-guessable pattern).

Alex

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 189 bytes
Desc: Message signed with OpenPGP using GPGMail
URL: <http://lists.samba.org/pipermail/linux/attachments/20150217/7c3c3f0c/attachment.pgp>