Re: library/binding for sftp?

[Stefan.Lucks@uni-weimar.de]

On Fri, 9 Aug 2013, Randy Brukardt wrote:

>>>>> Firstly, there is no protection against targeted attack. Secondly,
>>>>> regarding spies, they aren't any good in programming. Obscuring is
>>>>> the best method against unfocused surveillance which works only
>>>>> with known protocols.
>>>>
>>>> Four false statements in a row.
>>>
>>> There are only three here,
>>
>> Three sentences, but I see two statements in the third sentence.
>
> There is only one in the third sentence that I see. "best method". The rest
> is a definition.

Randy, I see two statements in the third sentence, and no definition:

1. obscuring is the best method against unfocused surveillance
2. unfocused surveillance works only with known protocols.

I question the first statement.

The second one is dangerously wrong, and there are plenty of 
counterexamples.

One common error frequently found in homegrown protocols is encrypting 
some stuff while leaving other sensitive information in the clear. E.g., 
older versions of WinZip did support the encryption of files, while 
including plain filenames in the archives. (I am not sure about recent 
versions of WinZip.) Any protocol based on sending "encrypted" archives 
would trivially leave the filenames open even for unfocused surveillance 
operations -- if that was fishing for filenames.


------  I  love  the  taste  of  Cryptanalysis  in  the morning!  ------
     <http://www.uni-weimar.de/cms/medien/mediensicherheit/home.html>
--Stefan.Lucks (at) uni-weimar.de, Bauhaus-Universität Weimar, Germany--