NCC Group

https://www.nccgroup.trust/globalassets/our-research/us/whitepapers/cryptopocalypse_reference_paper.pdf

remember this presentation from a few years ago?

The Factoring Dead: Preparing for the Coming Cryptopocalypse.

the only reason global mass surveillance is even technically possible os because turnkey mass scale crypto exists.

if NSA and FVEYs could not conceal their own penetration and exfiltration of all the world's data, then they would not be able to do it on a scale like we saw reveales in Snowden's leaks. cryptography PROTECTS the Surveillance State MORE than it protects us Plebians. the asymmetrical advantage of weilding cryptographic supremacy is what makes NSA's regime physically possible.

all modern crypto is based on a handful of crypto primitive math algorithms. we blindly trust them to be secure because nobody yet knows how to crack them. but if some lone wolf math genius pulled an Isaac Newton and invented a solution to FACTOR and proved P=NP, then crypto as we know it would cease to exist. no more RSA, no more ECC, no more AES, no more SHA3.

this wont even require quantum computers, because it is presently unknown whether there exists a classical solution to insoluble problems like FACTOR and P=NP.

what if a classical solution does exist? what if it is found in the next 10 years?

i believe it will be found.

i agree with Snowden's sentiments. the mass surveillance state is an anomaly, a blip of time where a lack of mathematical progress was met with…

NCC Group (formerly Matasano Security, iSEC Partners, and Intrepidus Group) - Atlanta, Austin, Boston, Chicago, Houston, New York, San Francisco, Seattle, and Sunnyvale, CA

It's the time of year when we welcome back the sun, the cherry blossoms, and crippling seasonal allergies. 2 of out 3 ain't bad. Searching for a job that goes 3 for 3? Consider NCC. Cutting-edge research, continuous learning & training, and contributing on interesting client engagements. The elusive triple threat.

NCC Group is currently looking for passionate security minds to join our merry crew! We are looking for great people to join our pentesting, DFIR, and Risk Management & Governance teams!

What do we do exactly? Penetration testing, security analysis, DFIR, and cutting-edge research into current technologies and attacks (breaking things). You spend most of your day thinking about security systems and how they can break. You get to be creative and have a lot of freedom to be clever while learning new technologies at a very fast pace. Engagements are usually 2-4 weeks long and in a year you will be exposed to 15-20 products and technology stacks. Your work will typically initiate person-months of security improvements in products millions of people use. You will have access to senior engineers/architects and your findings/ideas will be heard by senior decision makers. You will have enormous impact in making the software and products people use safer!

All of our consultants are also security…

NCC Group (formerly Matasano Security, iSEC Partners, and Intrepidus Group) - Atlanta, Austin, Chicago, New York, San Francisco, Seattle, and Sunnyvale, CA

It's nearly time to cease our incessant complaining about the winter cold and begin our incessant complaining about allergy season. Yes, change is in the air. If the return of the warm weather doesn't lift you up like you had hoped, maybe it's time for a bigger change. Consider making a move to a new career path, or transitioning to a growing organization doing important and exciting work... NCC Group!

If you’re a tinkerer, you enjoy breaking more than building, or someone who wonders “why” and ends up down the rabbit hole 36 hours later with a disassembled air conditioning unit surrounding them... we’d love to hear from you! Our process welcomes those with years of experience, as well as those with little to no direct experience in what we do.

The bottom line: if you love security and research, NCC Group just may be a perfect fit for you.

What do we do exactly? Penetration testing, security analysis, and cutting-edge research into current technologies and attacks (breaking things). You spend most of your day thinking about security systems and how they can break. You get to be creative and have a lot of freedom to be clever while learning new technologies at a very fast pace. Engagements are usually 2-4 weeks long and in a year you will be exposed to 15-20 products and technology stacks. Your work will typically…

Sending code to a desktop is easy to detect. Sending code to a non-web-based mobile app is easy to detect. Sending code to a browser isn't even detectable. In practice, no one audits JavaScript. If browsers offered the means to detect changes to cached content, security experts[1][2][3] would be less grim about webpage security.

Encryption done in untrusted JavaScript is security theater. If these websites offered privacy policies claiming to never read your data, like Riseup does, the end-result would be the same. Safer, actually, because deploying unnecessary crypto increases the vulnerability risks.

Recommending these websites is actively dangerous. Journalists and whistleblowers who take these claims of fraudulent security seriously, are going to be killed. Getting them to understand that email cannot be secured in-browser, is the entire point. That if you have important information to protect, you should be moving onto different approaches.

WhatsApp is literally safer than this, and it's more accessible.

[1] https://www.schneier.com/blog/archives/2012/08/cryptocat.html

[2] https://www.nccgroup.trust/us/about-us/newsroom-and-events/blog/2011/august/javascript-cryptography-considered-harmful/

[3] https://rdist.root.org/2010/11/29/final-post-on-javascript-crypto/

A concrete argument for this: Qualcomm recently released a patch for a vulnerability that makes it possible to access private data stored in the TrustZone of many of its SoCs: https://www.nccgroup.trust/us/our-research/private-key-extraction-qualcomm-keystore/

The patch needs to be provided by phone and tablet manufacturers. Except that many otherwise capable phones are not supported anymore and will not be fixed.

Were the firmware of these devices open source, the community could fix this (given that the firmware does not have to be signed, or a signing key can be added). But no, many devices will remain forever vulnerable.
Including my phone, 4G RAM, 32G internal storage, excellent battery and screen, great computing capabilities, in a excellent physical shape. Will probably last a few years more. Last updated on November 2017 by its manufacturer. Some parts will never be updated again and there is no way to audit this stuff.
This is a shame.

Edit: and I'm lucky my phone resembles an Android One phone, so some stuff can be taken from this phone to update mine.

"We are currently utilizing advanced protocols including double salted hashes"

Shudder. Whenever someone starts talking about double salting, triple salting or even just salting, it's usually a sign that they are doing password storage all wrong.

Salting only thwarts attacks against pre-computed lookup (i.e rainbow) tables and most attackers don't use rainbow tables nowadays to reverse hashes. Increases in GPU power have meant that it's more practical to just enumerate through all password permutations on-the-fly than do a lookup in an enormous file.

If a company is using a modern hashing algorithm purposefully designed for password storage (e.g. PBKDF2, bycrypt or scrypt), they need not even consider salts because they are automatically incorporated into the algorithm and are transparent to the implementor.

In my opinion, the best article describing the current state of play with respect to password storage is the following:

https://www.nccgroup.trust/us/about-us/newsroom-and-events/blog/2015/march/enough-with-the-salts-updates-on-secure-password-schemes/