• PhilipTheBucket@ponder.catOP
    link
    fedilink
    arrow-up
    3
    ·
    7 days ago

    I wouldn’t be completely sure.

    1. The NSA doesn’t just do whatever is the worst thing for everyone at every given time. There’s no particular guarantee that the NSA will share any given communication with any given UK agency that wants it at the drop of a hat, although for major problems (like climate activists! those awful people /s) they may share pretty freely. E2EE is still a significant obstacle even if the NSA has it broken completely.
    2. There’s no guarantee that the NSA has broken it completely. Edward Snowden’s leaks about how the NSA had HTTPS broken are a fascinating and rare window into what the reality of their secret capabilities actually are. TL;DR, they either couldn’t or didn’t want to spend the resources to break the core encryption, so instead they arranged to smuggle subtly insecure master keys into vital places in the supply chain, so that they could exploit the flaws in those keys and read a significant fraction but not all HTTPS traffic (the fraction that was derived from those insecure keys). Of course their capabilities have improved since then, but so have the standards of encryption. I think the assumption “they can read some but not all encrypted traffic” is probably a good ballpark to use for their present-day capabilities, after however many years of both sides of the arms race continuing to evolve in tandem from that point.