Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

There's just an important distinction that you're missing.

If the NSA is intercepting devices and bugging them, then it doesn't really matter which brand you buy - you're being targeted as an individual. Order a Huawei phone and they'll (presumably) try to intercept and compromise it. Country of origin doesn't really matter, because (presumably) the NSA isn't compromising the company producing the device, they're compromising the delivery chain which handles all (most) devices.

The reason to avoid Huawei (according to some US gov't sources, evidently) is that Chinese security services may have compromised the company's structure itself; thus all products they create may have backdoors/trojans already in them.

These two situations aren't even in the same universe.



>the NSA isn't compromising the company producing the device, they're compromising the delivery chain which handles all (most) devices.

We have substantial evidence that the NSA is doing this exactly this, in your words "compromising the company producing the device". For example in the case of RSA being paid to use Dual_EC_DRBG[1] or with the unspecified encryption chips that have been backdoored according to the Snowden documents[2].

>These two situations aren't even in the same universe.

From a policy standpoint it might be the same universe. We ban the use of chemical weapons in all circumstances, despite their effectiveness, because we believe the world is a better place without them.

Given the threat that hardware backdoors, either installed at the factory or during shipping, pose to both security and global trade there is an argument that such actions are off-limits. It was the public position of the US that the US did not do such actions but that China did. It appears that was PR.

1: http://arstechnica.com/security/2013/12/report-nsa-paid-rsa-...

2: "(TS//SI//REL TO USA, FVEY) Complete enable for [REDACTED] encryption chips used in Virtual Private Network and Web encryption devices [CCP_00009]" - (U) COMPUTER NETWORK OPERATIONS (U) SIGINT ENABLING http://www.nytimes.com/interactive/2013/09/05/us/documents-r...


Ok - what about the NSA paying RSA 10 million dollars to use a flawed algorithm for encryption that they had a backdoor for?




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: