Re: Hackers invade DOJ web site

[...]
Will Day (willday@rom.oit.gatech.edu) wrote:
>I understand how it affects their claim for the security of escrowed
>keys, but I'm afraid I don't follow the other argument.  How would the
>wide availability of strong encryption have helped prevent the breakin?
>How would encryption in general prevent breakins?  I'd love to use this
>as an argument for strong encryption, but I don't see how it really
>applies.

Since we don't know how the intruders broke in, we can only speculate.  I
can think of several scenarios where cryptographic techniques could help.
I can also think of several where they wouldn't.  When you've only got 20
seconds to explain to a non-technical audience, I don't think it's dishonest
to say that it might have prevented it.

Off the top of my head, here are a couple examples:

   1. It's possible that a DOJ employee logged in from a remote site while
      the intruders were snooping somewhere along the way.  If the link had
      been encrypted, that would have made things much more difficult or
      impossible for the attackers.

   2. Perhpas the intruders used IP spoofing and .rhosts to break in.  If
      machines had to be cryptographically authenticated, a rsh from the
      wrong machine wouldn't work.

I think my 20 seconds are up.  :>

                          | (Douglas) Hofstadter's Law:
                          | It always takes longer than you expect, even 
Frank Stuart              | when you take into account Hofstadter's Law.

> Since we don't know how the intruders broke in, we can only speculate.  I
> can think of several scenarios where cryptographic techniques could help.
> I can also think of several where they wouldn't.  When you've only got 20
> seconds to explain to a non-technical audience, I don't think it's dishonest
> to say that it might have prevented it.

All webservers (except maybe Spinner?) are riddled with buffer overrun
bugs and other similar security holes.  If you run a webserver, you
should basically assume that anyone who really wants a shell on your
machine can get one.  Grab your favorite webserver and grep for
sprintf.

Crypto?  Get real.  The lock on the door matters little when you've
left the window wide open.