• TimeSquirrel
    link
    fedilink
    1117 months ago

    You think having a fake online name will stop them from finding out who you are? Did you even pay attention to the Snowden leaks?

      • Pennomi
        link
        fedilink
        English
        127 months ago

        They also have backdoors in most implementations of TLS, according to a person I know who worked government security.

        • AtHeartEngineer
          link
          fedilink
          English
          137 months ago

          I work in cryptography, and I guarantee if that’s true “some person you know who worked in government security” would not tell you if they did know, or they are pulling shit out of their ass. There have been so many people that have looked at or worked on SSL/TLS implementations (including some of my coworkers), any vulnerabilities would have to be pretty subtle or clever, and that would be kept highly classified. Quit making shit up or repeating bullshit you heard.

          • Pennomi
            link
            fedilink
            English
            07 months ago

            Sure, if we’re talking about code vulnerabilities only. It’s most likely a compromised root cert though.

            • AtHeartEngineer
              link
              fedilink
              English
              57 months ago

              That just would allow a malicious attacker to fake being the server, it doesn’t actually compromise the TLS session. So you are talking about a much more sophisticated multi stage attack that needs to be actively executed. This wouldn’t at all allow them to record traffic and decrypt later.

              The certs authenticate that you are talking to the real server, the symmetric session keys that are usually derived from a diffie helman key exchange have nothing to do with certs. That’s two separate (but connected) parts of the transaction to build a TLS session.

              • Pennomi
                link
                fedilink
                English
                07 months ago

                Right, this would be a MitM vulnerability, which could be reasonably viable for targeted attacks.

    • u/lukmly013 💾 (lemmy.sdf.org)
      link
      fedilink
      English
      327 months ago

      It is almost never a question of whether it’s possible or not. You WILL make a mistake. It’s just a question of how much effort you’re worth as an individual.

    • paraphrand
      link
      fedilink
      English
      47 months ago

      No, they said we already knew about that and didn’t give it another thought.