this post was submitted on 24 Feb 2025
101 points (96.3% liked)

Privacy

1189 readers
720 users here now

Protect your privacy in the digital world

Welcome! This is a community for all those who are interested in protecting their privacy.

Rules

PS: Don't be a smartass and try to game the system, we'll know if you're breaking the rules when we see it!

  1. Be nice, civil and no bigotry/prejudice.
  2. No tankies/alt-right fascists. The former can be tolerated but the latter are banned.
  3. Stay on topic.
  4. Don't promote big-tech software.
  5. No reposting of news that was already posted. Even from different sources.
  6. No crypto, blockchain, etc.
  7. No Xitter links. (only allowed when can't fact check any other way, use xcancel)

Related communities:

founded 3 months ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
[–] [email protected] 0 points 1 week ago (1 children)

Eh, just doing it for the good PR I guess. UK is still going to get access to everyone's files through the NSA-to-UK pipeline.

[–] [email protected] 3 points 1 week ago (1 children)

I wouldn't be completely sure.

  1. The NSA doesn't just do whatever is the worst thing for everyone at every given time. There's no particular guarantee that the NSA will share any given communication with any given UK agency that wants it at the drop of a hat, although for major problems (like climate activists! those awful people /s) they may share pretty freely. E2EE is still a significant obstacle even if the NSA has it broken completely.
  2. There's no guarantee that the NSA has broken it completely. Edward Snowden's leaks about how the NSA had HTTPS broken are a fascinating and rare window into what the reality of their secret capabilities actually are. TL;DR, they either couldn't or didn't want to spend the resources to break the core encryption, so instead they arranged to smuggle subtly insecure master keys into vital places in the supply chain, so that they could exploit the flaws in those keys and read a significant fraction but not all HTTPS traffic (the fraction that was derived from those insecure keys). Of course their capabilities have improved since then, but so have the standards of encryption. I think the assumption "they can read some but not all encrypted traffic" is probably a good ballpark to use for their present-day capabilities, after however many years of both sides of the arms race continuing to evolve in tandem from that point.