undefined | Better HN

0 pointsEdHominem9y ago0 comments

Do you really have a policy that would survive an NSA-directed evil-sysadmin attack from any of the participants in your chain of trust? As a civilian branch of the government?

It's pretty hard to setup a system that would survive an powerful adversary who simply didn't know your passwords, have access to your safes, etc. But to then make that system hardened against a malicious insider with get-of-of-jail card?!

0 comments

3 comments · 1 top-level

brainfire9y ago· 2 in thread

It would have to be one of the four people with root.

Multiply this by the number of groups that operate a .gov website (it's a lot) compounded by turnover (even more.) And account for the cat-herders needed to organize it and do it every time the private key rotates (no less than yearly for our internet-facing sites.)

There are a lot of ways you could do this on a small scale, but you really can't scale up this particular mechanism and keep it secret.

EdHominemOP9y ago

> It would have to be one of the four people with root.

Or anyone who'd ever gotten access to the computer, or installed a camera near it, etc.

The critical part of that answer though, is "one of the". The system fails if any of the individuals is be malicious. A more-robust system would require multiple malicious agents in various organizational silos (security, compliance, management) to fail.

> every time the private key rotates

Well, if I got in once it probably phones that home for me.

> you really can't scale up this particular mechanism and keep it secret

Well, it isn't secret. We know the NSA intercepts hardware to muck with it, when needed. Much easier even than planting something in your server room explicitly. Also, they wield NSLs compelling silence and cooperation. It's not like being discovered here or there would stop scare or stop them.

It would probably scale pretty well given that this is the extreme; most people just generate keys on the old debian box in the corner.

brainfire9y ago

> A more-robust system would require multiple malicious agents in various organizational silos (security, compliance, management) to fail.

Yes, and at that point the name for it is "policy". These are our own keys after all- nobody would blink an eye if they were supposed to be collected.

They're not.

1 more reply

j / k navigate · click thread line to collapse