Member Avatar for The Dude

Heiss - A CARELESS mistake by Microsoft programmers has revealed that special access codes prepared by the US National Security Agency have been secretly built into Windows. The NSA access system is built into every version of the Windows operating system now in use, except early releases of Windows 95 (and its predecessors). The discovery comes close on the heels of the revelations earlier this year that another US software giant, Lotus, had built an NSA "help information" trapdoor into its Notes system, and that security functions on other software systems had been deliberately crippled. [more]

Dont know if anyone DIDNT KNOW THIS but felt i'd post it anyway..

Source:

  • 2 Contributors
  • 2 Replies
  • 132 Views
  • 1 Day Discussion Span
  • Latest Post Latest Post by The Dude

Dani AI

Generated

This story is the old "NSAKEY" controversy (first widely noticed in 1999) — someone found a symbol named NSAKEY in Microsoft’s CryptoAPI binary and some outlets spun that into a secret NSA backdoor. is right that it’s been discussed for years, and ’s link is one of many reprints of the original sensational claims. A quick refresher and some practical context are useful.

What actually happened: the NSAKEY name appeared in advapi32.dll and referred to a second code‑signing public key used by CryptoAPI to validate third‑party cryptographic providers. Microsoft said the extra key was for key rollover/compatibility reasons; critics worried it could let a third party install a signed provider that bypassed controls. Public technical analyses and Microsoft’s responses never produced verifiable proof that the NSA had a universal decryption key or a built‑in mechanism to break Windows encryption. The presence of a symbol name alone is not proof of ownership or a "master key."

Current, practical takeaway: this episode belongs to a long history of crypto policy debates (Clipper chip, export controls) and it highlights why transparency and audits matter. If strong, verifiable trust is required, prefer audited/open crypto stacks, keep systems fully patched, use well‑reviewed disk and communication encryption (and FIPS‑validated or publicly audited modules where needed), and require reproducible builds or supplier attestation in high‑risk environments. For those who want to inspect a Windows build, basic checks (binary signatures, strings/sigcheck/dumpbin on relevant DLLs) can reveal symbol names, but real assurance requires source‑level review or independent audits rather than media reports.

Recommended Answers

All 2 Replies

Member Avatar for jbennet

old news...

Member Avatar for The Dude

What i figured...........

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.