Re: [cryptography] evidence for threat modelling -- street-sold hardware has been compromised

2013-07-31 Thread ianG
On 31/07/13 03:52 AM, Peter Gutmann wrote: Marcus Brinkmann marcus.brinkm...@ruhr-uni-bochum.de writes: If you trust anonymous leaks to the Financial Review by members of your favourite spying agency network, then I guess its evidence. More importantly, look at the dates: The ban was

Re: [cryptography] evidence for threat modelling -- street-sold hardware has been compromised

2013-07-31 Thread grarpamp
On IBM's watch, right. But the Thinkpads were manufactured by Lenova in China well before that; what IBM sold was the franchise rights. And so where does Cisco and Juniper gear come from again... ? ___ cryptography mailing list

Re: [cryptography] evidence for threat modelling -- street-sold hardware has been compromised

2013-07-31 Thread ianG
On 31/07/13 11:46 AM, grarpamp wrote: On IBM's watch, right. But the Thinkpads were manufactured by Lenova in China well before that; what IBM sold was the franchise rights. And so where does Cisco and Juniper gear come from again... ? Indeed. Methinks the Australian pollies have been

Re: [cryptography] evidence for threat modelling -- street-sold hardware has been compromised

2013-07-31 Thread Lodewijk andré de la porte
2013/7/31 grarpamp grarp...@gmail.com And so where does Cisco and Juniper gear come from again... ? Let's not argue about whether Taiwan is China or The People's Republic of China is China ;) They do use foxxcon, but it's not clear whatfor. I can imagine they use foxconn for non-sensitive

Re: [cryptography] evidence for threat modelling -- street-sold hardware has been compromised

2013-07-31 Thread Sandy Harris
grarpamp grarp...@gmail.com wrote: And so where does Cisco and Juniper gear come from again... ? Cisco has factories in China, in at least Suzhou Hefei. They also have RD centers in at least Shanghai Hefei: http://cisco-news.tmcnet.com/news/2011/11/25/5954051.htm

[cryptography] evidence for threat modelling -- street-sold hardware has been compromised

2013-07-30 Thread ianG
It might be important to get this into the record for threat modelling. The suggestion that normally-purchased hardware has been compromised by the bogeyman is often poo-pooed, and paying attention to this is often thought to be too black-helicopterish to be serious. E.g., recent discussions

Re: [cryptography] evidence for threat modelling -- street-sold hardware has been compromised

2013-07-30 Thread Marcus Brinkmann
On 07/30/2013 01:07 PM, ianG wrote: It might be important to get this into the record for threat modelling. The suggestion that normally-purchased hardware has been compromised by the bogeyman is often poo-pooed, and paying attention to this is often thought to be too black-helicopterish to

Re: [cryptography] evidence for threat modelling -- street-sold hardware has been compromised

2013-07-30 Thread Jon Callas
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On Jul 30, 2013, at 4:07 AM, ianG i...@iang.org wrote: It might be important to get this into the record for threat modelling. The suggestion that normally-purchased hardware has been compromised by the bogeyman is often poo-pooed, and paying

Re: [cryptography] evidence for threat modelling -- street-sold hardware has been compromised

2013-07-30 Thread Peter Gutmann
Marcus Brinkmann marcus.brinkm...@ruhr-uni-bochum.de writes: If you trust anonymous leaks to the Financial Review by members of your favourite spying agency network, then I guess its evidence. More importantly, look at the dates: The ban was introduced in the mid-2000s after intensive