[117551] in Cypherpunks
Re: IP: two more on NSA KEy one from Spafford and one from MS
daemon@ATHENA.MIT.EDU (landon dyer)
Sun Sep 5 21:44:50 1999
Message-Id: <4.1.19990905120604.00aed940@shell9.ba.best.com>
Message-Id: <4.1.19990905120604.00aed940@shell9.ba.best.com>
Date: Sun, 05 Sep 1999 18:18:58 -0700
To: Adam Shostack <adam@homeport.org>
From: landon dyer <landon@best.com>
Cc: cypherpunks@cyberpass.net
In-Reply-To: <19990905143523.A4789@weathership.homeport.org>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Reply-To: landon dyer <landon@best.com>
>Lastly, I'll point out that this extra key has been in Windows since
>(at least) SP3. It was only with SP5 that its name was released in a
>debugging table.
i've got an original NT4 CD that has "NSAKEY" in its debugging
symbols. so, as far as i can tell, the symbol has been in there
since the day NT4 shipped
i'd *love* to see a disinterested third party do a code review
(including check-in history) of the CAPI. however, it's probably
moot -- NT is so full of holes at the Win32 API level [see what
PGP 6.0 hooks, for instance! i just *had* to disassemble that
stuff...] that all you really have to do is stick a trojan into
some popular application
i'll bet the Quicken folks have been talked to, too. just guessing
i don't know what's worse: a corrupt or suborned group that is
persuing an evil orwellian agenda, or a group that honestly thinks
it is doing the Right Thing. either way, the results are virtually
indistinguishable. does it matter if the guys who tap your computer
or do the dynamic entry thing and kill your dog are wearing white
cowboy hats, black face paint, or microsoft tee-shirts?
wierd-ass custom hardware is your best bet. even applying "merely
adequate" crypto to stuff stored in a gnarly wire-wrapped ball of
custom logic and firmware and battery-backed SRAM chips hung off a
parallel port will make any spook agency tech say, "oh, shit" [really
freak 'em out and stick a couple of mercury switches in there, just
for giggles... :-) ]
-landon [re-lurking]
