Multiple people who have seen the entire Snowden dump claim that various files leaked by specific sources were not contained within the Snowden dump.

Yes, the idea that the "second source" and TSB are the one and the same is necessarily based on conjecture. Nobody is presenting it as a fact, but as a rather likely option based on analysis of data released by TSB and NSA leaks which cannot be attributed to Snowden.

Both TSB leaks and "second source" leaks originate from the same time period, and the same locations within the NSA. That does not mean that they were leaked by the same person(s), but it is a fairly likely option.

>NSA does not have magic tools to break modern encryption.

They don't. But they have other options.

For example, Cloudflare is an American company that has plaintext access to the traffic of many sites. Cloudflare can be compelled to secretly share anything the NSA want.

They don't break encryption, they circumvent it. They get into people's computers and access the stored data after it's been decrypted. They stockpile zero day vulnerabilities and use them against their targets in order to install persistent malware. They intercept equipment and literally implant hardware onto the PCBs that let them access the networks. They have access to hordes of government CCTVs. They have real time satellite imaging. They have cellphone tower data.

1) They don't necessarily need to break all encryption, just knowing who is talking to who and then delivering a tailored payload is their M.O.; The Tailored Access Operations division exists just for this.

2) They didn't build a Yottabyte-scale datacenter for no reason

3) They have the capability to compromise certificate authorities. Pinned certs aren't universal.

4) Speculation, but, Snowden's revelations probably set off an "arms race" of sorts for developing this capability. Lots more people started using Tor, VPNs, and more, so it would almost be dereliction of duty on their part if they didn't dramatically increase their capability, because the threats they are there to stop didn't disappear.

5) ML/LLM/AI has been around for a while, machine learning analysis has been mainstream for over a decade now. All that immense data a human can never wade through can be processed by ML. I would be surprised if they aren't using an LLM to answer questions and query real-time and historical internet data.

6) You know all the concerns regarding Huawei and Tiktok being backdoored by the Chinese government? That's because we're doing it ourselves already.

7) I hope you don't think TAO is less capable than well known notorious spyware companies like the NSO group? dragnet collection is used to find patterns for follow-up tailored access.

This is naive to the point where it is indistinguishable from disinformation.

Aside from a tiny minority of people applying their own encryption (with offline confirmed public keys) at end points with securely stored air gapped private keys, this information is available to the US government, it’s the god damn job of the NSA.

So instead of collecting at AT&T Room 631 you now collect at Google Room Whatever.

The NSA has spent no small amount of time in the last decade obviously interfering with NIST and public encryption standards. The obvious reason is they _want_ to have the magic tools to break some modern encryption.

They surely don't have any kind of access to letsencrypt root certs whatsoever

You should read about Project Cloudflare

Dont need to break encryption if you read data from the source -- O/S vendors will do it for you.

store now... decrypt later...

Israel produced Pegasus for hacking smartphones and taking them over. You don't think NSA can do that? They control all the endpoints they want.

Could you be more specific? It's really hard to have an useful conversation based on a comment like this, but really easy to have one based on a comment which links to specific cases and perhaps even explains how the obvious parallel construction appears.

Because Wikipedia. My edit got immediately auto-bot-reverted[1] by some anti-vandalism crusader. Insert bell-curve meme[1] where "just edit wikipedia" is the middle of the bell-curve.

[0] https://en.wikipedia.org/wiki/User_talk:Discospinster#WTF_ed...?

[1] https://imgflip.com/memegenerator/533936279/Bell-Curve

I mean if I create an offline private key and encrypt my message to be only read with my public key and I’ve learned about math and encryption. I can be assured that my receiver would need to be compromised.

I don’t like these general observation comments. This kind of makes it unappealing to learn about encryption, but it’s worth it and makes you choose either a proper encrypted software or use a key for secret messages.