Sunday, April 13, 2014

It's Not a Bug, It's a Feature

The latest and greatest from the most transparent administration evar:
This week, it came to light that a small error in the open-source OpenSSL implementation of the SSL encryption protocol opened a gaping hole in the security of hundreds of thousands websites and networking equipment across the Net—and that hole had been wide open and exploitable for years. Passwords could be easily grabbed. User names matching those passwords could be easily grabbed. Heck, userdata could be easily grabbed. The “Heartbleed” moniker attached to the devastating bug seemed all too apt.

And Friday afternoon, Bloomberg reported that the National Security Agency has been aware of and actively exploiting the Heartbleed bug for at least two full years, citing “two people familiar with the matter.”

....

Leaked NSA documents provided to reporters by Snowden have revealed an agency casting a wide—and often domestic—surveillance dragnet, spying on American emails and web searches, gobbling up metadata from smartphones en masse, and even tapping into the internal communication infrastructures of Internet giants like Yahoo and Google.

A September Snowden-supplied revelation revealed that the NSA can easily defeat many of today’s encryption technologies, and in an aside that now seems precognizant, the SSL protocol was then rumored to be a particular favored target for the Agency.
Keep that in mind next time you're "choosing" between Candidate Coke and Candidate Pepsi.

No comments:

Post a Comment