Plus they are a Shanghai-based company and can be compelled by the Chinese government to place hardware back doors.
(They are great for makers though, very affordable, lots of features.)
(They are great for makers though, very affordable, lots of features.)
(1) it may seem absurd, sort of sci-fi, but having access to the underlying hardware and its firmware would make it not that hard to do. In that case, the only way to safely analyze network traffic would require very fast logic analyzers that wouldn't use any dedicated network chipsets.
The point is: security through obscurity usually doesn't work well, unless the untrusted party is the hardware maker itself, or whoever decides what they put in the hardware; in that case security through obscurity becomes a lot more about obscurity than security, which makes it near 100% effective.
This is false. In most western countries governments cant force HW makers to add backdoor.
Even in China, they might not need to rely on explicit state security authority, just tie it up with state sponsored funding or other softer measures.
They can't do that.
It can only compel the release of collected metadata to agencies.
It's great that you can make claims like this based on zero evidence or even allegations, but there is no basis in fact for it.
What's more the number of 3rd party people that have to be involved in something like this make it virtually impossible that the national security letter structure could keep them all silent, especially since there are numerous foreign nationals in the supply chains.
Go read the huge amount of ACLU coverage of these, or the many articles linked, or the congressional testimony. There are no allegations that this mechanism is being used to do what you say.
That doesn’t prove they have done it. But arguing they can’t is crazy.
Care to state your belief about the relations between the TLAs and the larger networking and communications firms in the US?
Not the OP, but I think that addressing specific parts of the claim is extremely important.
We've seen this around the PRISM program, where the allegations of support by tech companies were confused by their support for lawful law enforcment warrants (as opposed to the NSA's dragnet surveillance via PRISM). This confusion has reached the point where I saw a lecturer claiming Google helped the NSA collect data as part of PRISM, where the NSA's own slides[1] show the opposite[2].
[1] The famous "smiley slide" https://arstechnica.com/tech-policy/2013/10/new-docs-show-ns... or https://slate.com/technology/2013/10/nsa-muscular-program-sp...
[2] https://arstechnica.com/information-technology/2013/11/googl...
I'm not aware of anything that would prevent the court from ordering a vendor to implement features to effectuate surveillance ordered by the court.
And that's a pretty weak compulsion, since the people who are bound are the people who would ordinarily prosecute any federal crime, and they probably aren't interested in prosecuting themselves.
The fact that some government agent applies for the warrant does not alter the fact that the warrant, once granted, is an order nor does it remove the power of the writ for further orders to effectuate the warrant.
How about the risk to their business when a multinational corporation is X-raying their cores for backdoors (as one does) and finds the state backdoor, and then decides to no longer do business with the hardware manufacturer because of it—and also publicizes the existence of the backdoor, such that other multinationals pull out as well?
(I say "multinationals" because, presumably, purely-domestic corporations could be compelled by the state to accept the backdoor and say nothing about it.)
Edit: it was for sure SuperMicro and Amazon.
https://www.bloomberg.com/news/features/2018-10-04/the-big-h...
Plus Broadcom is a US-based company and can be compelled by the US government to place hardware back doors.
Sadly this isn't a tin foil hat possibility.