“New: In 2010, KPN commissioned a study into the behavior of Huawei in the mobile network. The findings were so serious that it was feared for the continued existence of KPN Mobiel if the conclusions were to be leaked”
I can’t access the reporting (paywall and in Dutch) or the actual report. But it sounds like Huawei retained admin access to eavesdrop on calls in the Dutch network, against explicit agreements.
I’ve seen this pattern of story, and I know that it will be hailed by some as “the smoking gun proof of malice” and others will point out that the Huawei code was just a smoking pile of sloppiness, and really: it doesn’t matter.
If you don’t trust the person who builds your communications infrastructure, then you can’t expect secure communications infrastructure. Stories like this are just reminders of that basic fact, not proof of malice.
Someone more ambitious than me offers a translation :) What I don’t see in the article is any evidence that “eavesdropping” actually happened. Just a capability. Am I missing it?
If I’m China and I really am using Huawei to infiltrate Western networks, my incentive is to *not* blow the op during the early stages when carriers can still choose other options. That’s why I read these stories as incompetence, not malice.
Anyway here’s the story in English and the key graph. You can believe Huawei or not, but if they were obviously lying I imagine the reporting would say so.
The impression I get is that these news stories are engineered by people who are opposed to Huawei. And I think there are legitimate arguments for their position.
But I also think if these folks had any concrete evidence of wiretapping, you’d be reading about it.
• • •
Missing some Tweet in this thread? You can try to
force a refresh
The extra barriers Apple is throwing up in the way of security researchers make me much more nervous about using their stuff.
It’s not totally the case that security researchers are (today) locked out of iOS. But it’s definitely getting harder. The work that P0 had to do to RE iMessage is an example. googleprojectzero.blogspot.com/2021/01/a-look…
Does it make me nervous that Apple had to write a “firewall” to protect iMessage from malicious payloads (because they’re not confident it can be secured)? Hell yes it does. Would it be nice to have more people banging on this? Yes!
The more I read about the development of electronic payment tech from 1990-2010, the more it looks like a scam designed to ensure that only existing banking (and those few tech companies the banks selected) were viable options.
Apropos a 2010 post by Paul Graham on why the PayPal founders were geniuses. Maybe this is true, but what did PayPal actually do brilliantly? They built anti-fraud tech so that people could use 1970s credit card tech online.
Why weren’t there dozens or hundreds of PayPals, or people doing more sophisticated cash-like payments on the Internet? Well? There were some of the latter but their doors all got kicked in by the Feds. en.m.wikipedia.org/wiki/Liberty_R…
So it looks like NYC is deploying some half-cooked “blockchain” solution for vaccine passports. theintercept.com/2021/03/24/and…
Thank you to @samfbiddle for only using the G-rated quotes.
At one point @samfbiddle told me that IBM claimed to have a technical document explaining how their system worked, and it (in all apparent seriousness) proposed this diagram as a “system architecture” or something. I nearly blew milk out of my nose.
Me: surely everyone else has been a little slower on publishing during the pandemic.
Me: *stupidly checks the websites of my theory friends*
Also me: *vanishes into a tailspin of insecurity*
Advice to new faculty: it is very important to make a friend in your field who will reassure you about why everyone else’s work is easy and yours is both harder and uniquely important. This does not need to actually be true for it to help.
For most of my life I’ve waited for someone to post a credible claim that they’ve broken a major cryptosystem like RSA, and I’m pretty sure tomorrow I’ll still be waiting.
But that doesn’t make it any less fun to think about what a real (implemented) RSA break would look like. Imagine you were a genius who found an efficient factoring algorithm. You have so much opportunity for drama.
Obviously you could just post your algorithm but that’s boring and anyway practical people won’t be able to tell if it works, especially if it’s complicated and you’re not one of a very small number of researchers.
Ok so let’s try these checklists out and see what it’s like to lock a phone down. I assume I’m concerned about someone else accessing my iCloud account as well as apps being evil.
Here’s step 1.
Ok this works pretty well, but it gives me the following confusing exception.