<story><title>Some new snippets from the Snowden documents</title><url>https://www.electrospaces.net/2023/09/some-new-snippets-from-snowden-documents.html</url></story><parent_chain><item><author>jdougan</author><text>I&amp;#x27;m curious as to how successful they were at subverting the IETF process.  It wouldn&amp;#x27;t be impossible, but since much of the process is in the open it could be difficult, especially if they did it under their own name.&lt;p&gt;I suspect most of it was done under different corporate identities, and probaby just managed to slow adoption  of systematic security architectures. Of course, once the Snowden papers came out, all that effort was rendered moot as the IETF reacted pretty hard.</text></item><item><author>neilv</author><text>&amp;gt; &lt;i&gt;&amp;quot;How do they accomplish their goals with project BULLRUN? One way is that United States National Security Agency (NSA) participates in Internet Engineering Task Force (IETF) community protocol standardization meetings with the explicit goal of sabotaging protocol security to enhance NSA surveillance capabilities.&amp;quot; &amp;quot;Discussions with insiders confirmed what is claimed in as of yet unpublished classified documents from the Snowden archive and other sources.&amp;quot; (page 6-7, note 8)&lt;/i&gt;&lt;p&gt;There&amp;#x27;s long been stories about meddling in other standards orgs (both to strengthen and to weaken them), but I don&amp;#x27;t recall hearing rumors about sabotage of &lt;i&gt;IETF&lt;/i&gt; standards.</text></item></parent_chain><comment><author>gustavus</author><text>Ya ever heard of the OAuth2 protocol? I spent almost half a decade working on identity stuff, and spending a lot of time in OAuth land. OAuth is an overly complicated mess that has many many ways to go wrong and very few ways to go right.&lt;p&gt;If you told me the NSA&amp;#x2F;CIA had purposefully sabotaged the development of the OAuth2 protocol to make it so complex that no one can implement it securely it&amp;#x27;d be the best explanation I&amp;#x27;ve heard yet about why it is the monstrosity it is.</text></comment>
<story><title>Some new snippets from the Snowden documents</title><url>https://www.electrospaces.net/2023/09/some-new-snippets-from-snowden-documents.html</url></story><parent_chain><item><author>jdougan</author><text>I&amp;#x27;m curious as to how successful they were at subverting the IETF process.  It wouldn&amp;#x27;t be impossible, but since much of the process is in the open it could be difficult, especially if they did it under their own name.&lt;p&gt;I suspect most of it was done under different corporate identities, and probaby just managed to slow adoption  of systematic security architectures. Of course, once the Snowden papers came out, all that effort was rendered moot as the IETF reacted pretty hard.</text></item><item><author>neilv</author><text>&amp;gt; &lt;i&gt;&amp;quot;How do they accomplish their goals with project BULLRUN? One way is that United States National Security Agency (NSA) participates in Internet Engineering Task Force (IETF) community protocol standardization meetings with the explicit goal of sabotaging protocol security to enhance NSA surveillance capabilities.&amp;quot; &amp;quot;Discussions with insiders confirmed what is claimed in as of yet unpublished classified documents from the Snowden archive and other sources.&amp;quot; (page 6-7, note 8)&lt;/i&gt;&lt;p&gt;There&amp;#x27;s long been stories about meddling in other standards orgs (both to strengthen and to weaken them), but I don&amp;#x27;t recall hearing rumors about sabotage of &lt;i&gt;IETF&lt;/i&gt; standards.</text></item></parent_chain><comment><author>eddythompson80</author><text>sabotaging a design is remarkably easy. We have several individuals that almost do it effortlessly. It&amp;#x27;s almost a talent for some. I suspect that doing it maliciously while hiding behind some odd corner scenario or some compatibility requirements can&amp;#x27;t be that hard and will be almost impossible to prove or detect.</text></comment>