Green argues that after two decades of debate, governments never got their mandated backdoors but no longer need them. A parallel procurement pipeline for zero-day exploits — with vendors like NSO, Intellexa, Paragon, Candiru, and Cytrox — lets law enforcement and intelligence services hack endpoints directly, making the 'going dark' rhetoric obsolete.
By submitting Green's essay to HN and driving it to 261 points, the submitter amplifies the thesis that the encryption debate has quietly resolved into a device-exploitation regime rather than a backdoor regime. The high engagement signals broad agreement that this framing captures the current reality.
Green frames this as a 'third option' the industry accidentally invented: encryption stays cryptographically strong, but security collapses at the device level where CVEs are purchased one at a time. He points to Citizen Lab's forensic work showing Pegasus and Paragon repeatedly deployed against journalists, dissidents, and EU parliamentarians — including by NATO governments against NATO citizens — as evidence that endpoint compromise has normalized.
Green highlights that a small, familiar vendor ecosystem — NSO, Intellexa, Paragon (now US PE-owned), Candiru, Cytrox — services multiple governments under standing contracts, with full-chain iOS zero-clicks going for low millions. The 2023 Pegasus infections of EU parliamentarians and 2024 Paragon targeting of Italian journalists demonstrate this is the pattern, not the exception, and reflects a durable shift in how states conduct surveillance.
Matthew Green — the Johns Hopkins cryptographer who's spent a decade arguing against encryption backdoors — published a piece on August 14 with a striking concession: the fight he's been having is basically over, and the outcome isn't what either side predicted. Governments didn't get their backdoors, but they didn't need them; they built a parallel procurement pipeline for zero-day exploits and now hack devices directly.
The post traces the arc from the 1990s Crypto Wars through the 2016 Apple–FBI standoff to the current landscape, where end-to-end encryption is table stakes in consumer messaging (iMessage, WhatsApp, Signal, RCS) and law enforcement rhetoric about "going dark" has largely gone quiet. Green's read: the quiet isn't victory for privacy advocates. It's the sound of a different tool being sharpened. The FBI paid roughly $900,000 to unlock the San Bernardino iPhone in 2016. The going rate for a full-chain iOS zero-click is now in the low millions on the grey market, and multiple governments have standing contracts.
The named ecosystem is small and familiar: NSO Group (Pegasus), Intellexa (Predator), Paragon (Graphite, recently sold to a US PE firm), Candiru, Cytrox. Citizen Lab's forensic work has repeatedly caught these tools deployed against journalists, dissidents, and — increasingly — against targets inside NATO countries by NATO governments. The 2023 discovery of Pegasus on the phones of EU parliamentarians and the 2024 Paragon infections of Italian journalists are the pattern, not the exception.
The policy debate for twenty years assumed a binary: either encryption is strong and law enforcement is blind, or encryption has a backdoor and everyone is exposed. Green's argument is that the industry accidentally invented a third option — encryption stays strong at the protocol layer, but the endpoints are treated as adversarial terrain, and the state buys its way in one CVE at a time.
This matters technically because it inverts where the security budget has to go. Signal-style protocols are, at this point, extremely well-analyzed; the interesting bugs aren't in Double Ratchet, they're in the image parser your messaging app hands untrusted bytes to. The 2023 BLASTPASS chain that Apple patched was a PassKit image-parsing bug feeding into a WebP heap overflow. FORCEDENTRY in 2021 was a PDF-in-a-GIF trick against CoreGraphics. Neither touched cryptography. Both got you full remote code execution and, from there, plaintext.
The commercial market makes this economically stable in a way most defenders haven't internalized. When a single working iOS chain sells for $2M+ and a single Chrome sandbox escape sells for $500K–$1M, there is a durable, well-capitalized bid for exactly the kind of bugs that ship in every non-trivial codebase every quarter. Zerodium's public price list is a lower bound; the real market is opaque and larger. The HN thread on Green's post surfaced the practitioner-side version of this: several commenters noted that their security teams now assume any high-value target is compromised at the device level and design around it (out-of-band verification, ephemeral devices for sensitive work, hardware attestation), rather than trying to make the endpoint trustworthy.
The uncomfortable part of Green's piece — the part he doesn't say out loud but is clearly implied — is that this outcome is arguably *worse* for civil liberties than the backdoor regime everyone was fighting about. A mandated backdoor at least comes with a legal framework, an auditable process, and a warrant requirement. The exploit market has none of that. Pegasus deployments in Poland, Spain, Greece, and Hungary have targeted opposition politicians and journalists without meaningful judicial oversight, because the tool doesn't need it — you buy it, you point it, you get the data. The recent U.S. executive order restricting commercial spyware procurement is real but narrow; it doesn't touch the FBI's or CIA's own capability development, and it doesn't stop allies from selling to each other.
If you build anything with a security boundary — a messaging app, a wallet, an enterprise SSO, a healthcare backend — your threat model changed and you probably haven't updated the doc. The relevant adversary is no longer "a smart attacker with a laptop"; it's "a nation-state customer of a $200M/year exploit vendor with a standing order for bugs in your language runtime." Concretely:
Attack surface reduction is the highest-leverage investment. Every format parser you ship is a liability. The BLASTPASS, FORCEDENTRY, and Cytrox chains all started at parsers for legacy image or document formats that nobody would design in today. Audit what your app opens without user interaction. iMessage's mitigation was BlastDoor — a sandboxed, memory-safe parser for incoming content. If your product accepts arbitrary user-supplied media, you need the same pattern, not "we run libwebp with the latest patch."
Memory-safe languages are now a threat-model requirement, not a preference. The exploit market runs on memory-corruption bugs in C/C++ codebases. Rust, Swift, and Kotlin/Java on the app side, and Rust/Go on the server side, don't eliminate the risk — logic bugs and sandbox escapes remain — but they collapse the price of your bugs on the grey market, which is the actual defender-side metric that matters. If you're still shipping new C++ that parses untrusted input in 2026, you are subsidizing NSO's margins.
Assume post-compromise for high-value users. If your product has journalists, dissidents, executives, or crypto whales as users, some of their devices are already owned. Design accordingly: contact-verification flows that assume the other endpoint may be malicious, per-device key transparency (Signal is shipping this), disappearing-message defaults, and — critically — a story for how a compromised account gets *recovered*, not just detected. Most account-recovery flows still assume the attacker doesn't have the device.
The next five years of this fight aren't about crypto policy; they're about exploit-market policy, and almost no one in the developer community is engaged with it. The interesting regulatory question isn't "should Signal have a backdoor" — that fight is done — it's "should a European PE firm be allowed to buy an Israeli exploit vendor and sell to whoever writes the check." Expect the pressure to shift toward export controls on 0-day research, mandatory vulnerability disclosure timelines, and liability regimes for vendors who ship parsers that eat untrusted bytes. Whether any of that actually shrinks the exploit market or just pushes it further offshore is the open question. Green's piece is worth reading in full; it's the clearest short statement of where the ground actually settled while everyone was still arguing about the map.
> In the real world, it does feel likely that we’re going to hit some sort of a ceiling on the number of useful bugs, and probably we’ll hit it soon.This doesn't resonate with me. I see companies adding more sloppily written features with AI. I see more bugs in the software I use, not less.
On one side, you have pieces like this, where seemingly there are constant fights between serious actors with large and properly distributed budgets, employing top tech and top minds; on the other - regular news of the hackz, where responsible person in charge of security with root access failed to
I've always loved the ridiculousness of the "going dark" label when law enforcement can't access encrypted chats or a back door isn't built into a piece of software. When there are security cameras on the vast majority of houses, stop lights and in people's hands, and w
I'm supposed to be concerned that the US government and Israel won't be able to hack everyone's phones?
Top 10 dev stories every morning at 8am UTC. AI-curated. Retro terminal HTML email.
It's worth realizing that, before computerized central offices, telephone wiretapping required running physical wires. Back when Rudi Giuliani was prosecuting organized time, not only did physical wires have to be run, the cops were billed for them as expensive private lines. His task force was