[UVB-76]

If this scandal has taught us anything, it's that the services you use don't matter.

You have to assume everything sent over HTTP(S) is insecure. If it cannot be MITMd now, it can be stored and decrypted later.

Even if you connect via more secure means, you cannot trust service providers to tell the truth about the data they collect or store.

In short, you can't trust anyone or anything anymore. Trust is a weakness.

[cenhyperion]

You also can't trust the low level components of your computer. http://c2.com/cgi/wiki?TheKenThompsonHack

[mindslight]

You've got to draw the line somewhere, unless you're fine with the conclusion that you can't trust any form of computing technology (which leaves you powerless against mechanized systems of control).

It seems like we should be able to progress on this front, but I haven't seen much work towards it. Trustable computers are necessary but clearly not sufficient to push back against tyranny, which is why I (like everyone else) just assume my computing base is solid (or at least not infecting the software I'm writing), while working on software to help get us out of this VC-fueled "web 2.0" trap.

[qnr]

> You've got to draw the line somewhere

This is the heuristics I use:

1) You can generally trust network equipment because there are many types of it, produced by many companies all over the world.

2) This means any backdoor in your computer that transmits information over the network would be trivial to detect and therefore useless for NSA et al.

With that in mind, the most dangerous backdoor that could feasibly exist is probably the one that subverts the RNG. Here is a discussion about a hypothetical backdoor in the hardware RNG built into new Intel CPUs: http://crypto.stackexchange.com/questions/9210/technical-fea...

[mindslight]

There'd be plenty of ways to use existing network traffic as a side channel when you've tapped the network a few hops away (eg adjusting packet timings or sequence numbers). Also, a backdoor doesn't have to be active all the time (although that would hinder dragnet surveillance)

https://news.ycombinator.com/item?id=6149345