Master
ThoughtWorks
菜单
关闭
  • 产品及服务
    • 概况
    • "客户体验、产品及设计业务线 "
    • 数据战略、工程及分析业务线
    • 数字化转型及运营业务线
    • 现代化企业、平台及云业务线
  • 合作伙伴
    • 概况
    • 汽车企业
    • 医疗企业
    • 公共服务机构
    • 清洁技术,能源与公用事业
    • 媒体和出版业
    • 零售业和电商
    • 金融和保险企业
    • 非盈利性组织
    • 旅游业和运输业
  • 洞见
    • 概况
    • 特色

      • 技术

        深入探索企业技术与卓越工程管理

      • 商业

        及时了解数字领导者的最新业务和行业见解

      • 文化

        分享职业发展心得,以及我们对社会公正和包容性的见解

    • 数字出版物和工具

      • 技术雷达

        对前沿技术提供意见和指引

      • 视野

        服务数字读者的出版物

      • 数字化流畅度模型

        可以将应对不确定性所需的数字能力进行优先级划分的模型

      • 解码器

        业务主管的A-Z技术指南

    • 所有洞见

      • 文章

        助力商业的专业洞见

      • 博客

        ThoughtWorks 全球员工的洞见及观点

      • 书籍

        浏览更多我们的书籍

      • 播客

        分析商业和技术最新趋势的精彩对话

  • 加入我们
    • 概况
    • 申请流程

      面试准备

    • 毕业生和变换职业者

      正确开启技术生涯

    • 搜索工作

      在您所在的区域寻找正在招聘的岗位

    • 保持联系

      订阅我们的月度新闻简报

  • 关于我们
    • 概况
    • 我们的宗旨
    • 奖项与荣誉
    • 多元与包容
    • 领导层
    • 合作伙伴
    • 辅助功能
    • 新闻
  • 联系我们
China | 中文
  • United States United States
    English
  • China China
    中文 | English
  • India India
    English
  • Canada Canada
    English
  • Singapore Singapore
    English
  • United Kingdom United Kingdom
    English
  • Australia Australia
    English
  • Germany Germany
    English | Deutsch
  • Brazil Brazil
    English | Português
  • Spain Spain
    English | Español
  • Global Global
    English
博客
选择主题
查看所有话题关闭
技术 
敏捷项目管理 云 持续交付 数据科学与工程 捍卫网络自由 演进式架构 体验设计 物联网 语言、工具与框架 遗留资产现代化 Machine Learning & Artificial Intelligence 微服务 平台 安全 软件测试 技术策略 
商业 
金融服务 全球医疗 创新 零售行业 转型 
招聘 
职业心得 多元与融合 社会改变 
博客

话题

选择主题
  • 技术
    技术
  • 技术 概观
  • 敏捷项目管理
  • 云
  • 持续交付
  • 数据科学与工程
  • 捍卫网络自由
  • 演进式架构
  • 体验设计
  • 物联网
  • 语言、工具与框架
  • 遗留资产现代化
  • Machine Learning & Artificial Intelligence
  • 微服务
  • 平台
  • 安全
  • 软件测试
  • 技术策略
  • 商业
    商业
  • 商业 概观
  • 金融服务
  • 全球医疗
  • 创新
  • 零售行业
  • 转型
  • 招聘
    招聘
  • 招聘 概观
  • 职业心得
  • 多元与融合
  • 社会改变
安全捍卫网络自由社会改变多元与融合技术招聘

Is Encryption Broken? REDUX

Ola Bini Ola Bini

Published: Feb 5, 2015

I spent the days between Christmas and New Years in Hamburg, Germany at the Chaos Communication Congress. I had a fantastic time as usual, and there were a lot of great discussions and talks. I wanted to quickly cover the new revelations that Jake Appelbaum and Laura Poitras dropped on us on a Sunday evening. The video can be found here. At the same time, Der Spiegel published two articles about this subject. They also dropped over 600 pages of documents from the Snowden archive about it.

There are a lot of potentially scary revelations in these documents and the presentation. An observer might want to ask the question if encryption is broken and whether we should give up right now. I would like to put some context on some of these findings based on a few days of thinking and talking about these issues. What does it all really mean?

Let us begin with the really simple pieces. Skype is completely broken, and has been for a significant amount of time. This shouldn't come as a surprise - the truth is we should trust Skype as much as we trust a postcard for keeping our information secret. Another one that is problematic is the VPN technology called PPTP - it should never be used because it is completely broken.

The more dangerous thing seems to be that a lot of other VPN technologies are also broken in one way or another. If you depend on VPNs for security, you should be careful - and compose it with other encryption in order to be safer.

Let's take a break and talk about some of the good news. Tor still seems to cause a lot of problems for even the strongest attackers - and Tails is even better. This confirms our hopes. Of course, the intelligence services are working to break Tor and Tails, and they are trying out a lot of different methods for this. However, it doesn't seem to have been successful so far.

It also seems that the intelligence services aren't attacking AES very successfully. Of course they have studies and methods against it, but not to a very large degree, and nothing that seems like real breaks.

OK, what about SSL/TLS then? It's a bit more unclear. Some decrypts of SSL/TLS traffic definitely seem to be happening, but it's still unclear if this is something that is done by stealing keys from providers, doing man-in-the-middle attacks with fake certificates, directly breaking some crypto in real time, or anything inbetween. Occam's razor tells us that we should assume that mostly there are no major breaks involved, although I wouldn't be surprised if for example RC4 can be decrypted on the fly.

So what about SSH? This one is potentially scary. The real problem is that the published documents don't contain all the information that the journalists used to come to the conclusion that some SSH sessions can be broken. After talking with some of them about this, it seems that we don't know exactly what is broken and what is not - it's unclear. However, it seems to indicate that there are specific issues. Not all SSH connections are possible to decrypt. So what can happen? Well, first a MITM attack can be used. People don't necessarily always check the fingerprints. There could be a weakness in one of the algorithms used, but this is not very likely, since most of them are used in other settings where they seem to be secure. The most likely thing is that there is a vulnerability in one of the specific implementations of SSH. This could have to do with how the intelligence services steal keys for VPN appliances and things like that. So, in other words it doesn't seem like the SSH breaks are against your server or client machine SSH. How can you protect yourself? Use layers. The easiest way is to expose your SSH over a Tor hidden service and connect to that.

Finally we come to OTR and GPG. The articles claim that these are safe. However, what the documents say is that there are circumstances where OTR and GPG were not possible to decrypt - that is not exactly the same thing. I would feel cautiously optimistic about these things - but we should be careful to not overstate the case. Security and crypto in depth is still very important, and every precaution will fall down if you make other mistakes or if the endpoint is owned.

Finally - nothing in here that really would change our behavior in most cases if we are doing things correctly already. Soft indications about how to build and think about systems are quite useful though.

Master
政策声明 | 现代奴役声明 | 辅助功能
Connect with us
×

WeChat

QR code to ThoughtWorks China WeChat subscription account
© 2021 ThoughtWorks, Inc.