Westpac Scam Notice

That’s correct and with many agencies now having ‘backdoors’, it is becoming more challenging to know what is fully secure.

A good friend in Seattle told me about the NSA center (deliberate US spelling) and how it intercepts most communications. And how data is routed through the center. I since chose to avoid communication systems which are US centric.

Telstra would be off your list most likely (some of the links offer a complementary view then paywalled so please be aware of the limitations)

Finally a submission by Telstra into the data retention laws in Australia (these laws encompass all telcos). Telstra started doing a data request transparency report but I think that stopped as of 2015.

Oops. :slight_smile:

These days it is almost impossible to distinguish between the most extreme parody and real life. Regardless, most of that article is accurate.

Two comments.

  1. I think you are exaggerating the strength of 3DES. It is considered deprecated and has been for about 5 years. You should not use 3DES (or DES).

  2. The point of the Utah Data Center is that what is effectively safe from brute force today may become vulnerable at an unpredictable time in the future, whether due to cryptanalytic attack or growing brute force or quantum computers. So they store it in the hope that it will be able to be decrypted in the future.

It is bold to assert what a useful time-frame is. It depends very very much on the target.

Yes. Actual capabilities are likely running ahead of disclosed capabilities.

We have now reached the point (in Oz) that if I were to discover a cryptanalytic weakness in e.g. AES then I would be legally prevented from publishing it or otherwise disclosing it. (Fortunately, the chances of this are zero.) You can argue about how effective this actually would be but the legal framework is there.

Depends what you mean by ‘backdoor’. If you mean “backdoor to hoover up all traffic” then most definitely. You should assume that anything transmitted on the internet is hoovered up by someone.

If you mean “backdoor in the crypto algorithm itself” then, while this is always going to be a topic for speculation, it is by no means established as fact.

Unless “literally meaningless random packets that I intentionally transit the US so that the packets can be stored in Utah”. :wink:

Telstra would be off my list anyway. :wink:

You should assume that anything transmitted on the internet is hoovered up by someone. It doesn’t matter whether you use Telstra or you don’t use Telstra.

Well nothing wrong with the DES encrytion algorithm. It was the US standard, but with a key length deliberately nobbled by the NSA to something crackable by their computers. Triple DES increased the effective key length by encrypting three times with at least two keys. But it is very inefficient and requires a lot of computation.

The new US standard is AES. So that is what should be used.

A lot of communications are easily decrypted right now. Like mobile phones, or radio, or pretty much all stream ciphers. The block ciphers like AES are much harder.
But often the metadata is just as useful for the snoopers, and that is not encrypted.