Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Yahoo installed a backdoor for the NSA behind the back of the security team

diracdeltas.github.io

Post reply on HN
Print view View original

51–60 of 302 posts

Re: Yahoo installed a backdoor for the NSA behind the back of the security team

#51

Post by peterkelly »

eganist wrote: post #44
peterkelly wrote: post #32

I know this is from October, but it warrants re-reading now. Today, Yahoo announced a hack of 1B accounts. They say they don't know who it is, but we can conclude it's not the US government because Yahoo is willing and legally able to publicly disclose it. Previously, Yahoo willingly assisted an attacker in compromising 1B accounts. In this case, they did not disclose the attack publicly, or even to their own chief i…

> we can conclude it's not the US government because Yahoo is willing and legally able to publicly disclose it. This implies a potentially fatal assumption that IC agencies perform clandestine activities with prior notice to mission targets.

That's a very good point actually. Though in this case they say the tip-off came from a law enforcement agency (I assume they mean an American one).

It's possible however that agency doesn't realise it's a clandestine operation by another US agency. Or they do, but now the operation is complete (this was three years ago) and they want a way of informing yahoo about the breach without admitting who was behind it in the first place.

Re: Yahoo installed a backdoor for the NSA behind the back of the security team

#52

Post by wildmusings »

kabdib wrote: post #46
wildmusings wrote: post #26

Earlier quoted context omitted.

When you get a legally-binding order from the government of the United States of America, and exhaust your legal appeals, you either comply or go to prison. An ethics course won't do you any good.

Options: - Refuse to take action. They want engineering done, they can bloody well do it themselves. Don't type a single keystroke in the direction of helping them. - Announce what is going on anonymously. Plenty of avenues for this. - Announce what is going on, publicly. See if they do indeed want to take you to court. - Quit. - Take down the service. Much easier if the service is only a part of your company. Helps…

If you want to quit to refuse to help, fine, but I take serious issue with what you're suggesting beyond that.

These are the legal actions of the United States government, executing the authority given to them to the people's elected representatives, and overseen by a judiciary duly selected according the constitutional procedures. Their legal and democratic authority is unassailable.

Further, you don't know what motivated these actions. Is it intelligence about a specific threat? Has the government identified how a specific adversary operates? You could be impeding the investigation into a deadly plot. You have no way of knowing this.

This isn't a game. We have real enemies who would gladly kill all of us. We have processes as a society for deciding how we defend ourselves. If you don't like our current policies, then exercise your vote, exercise your right to speak and publish and assemble. But don't usurp the sovereignty of the people of this country.

Re: Yahoo installed a backdoor for the NSA behind the back of the security team

#53

Post by bbarn »

hbt wrote: post #50
wildmusings wrote: post #26

Earlier quoted context omitted.

When you get a legally-binding order from the government of the United States of America, and exhaust your legal appeals, you either comply or go to prison. An ethics course won't do you any good.

This is why we (as a community/industry) need to have the equivalent of a prison/death threat. The government wins by making it personal, by threatening prison and death for your obedience. It's not an abstract threat. It is directed to a specific person not a company or security team. The people who comply can quit those companies but they don't. I'm not referring to the ones down the chain (e.g the security team wh…

Wow. This is probably the worst comment I've ever seen on HN. You're suggesting that people who follow the law, which you disagree with, get blacklisted, following the model of criminals killing other criminals who follow the law.

If you want to change the government, there are far better ways than retaliating against citizens unwilling to risk life and limb for your ideology. I think you need to learn to direct your anger. Not everyone is in so privileged of a position to be taking your specific moral high ground over their own well being.

Re: Yahoo installed a backdoor for the NSA behind the back of the security team

#54

Post by normaljoe »

peterkelly wrote: post #51
eganist wrote: post #44

Earlier quoted context omitted.

> we can conclude it's not the US government because Yahoo is willing and legally able to publicly disclose it. This implies a potentially fatal assumption that IC agencies perform clandestine activities with prior notice to mission targets.

That's a very good point actually. Though in this case they say the tip-off came from a law enforcement agency (I assume they mean an American one). It's possible however that agency doesn't realise it's a clandestine operation by another US agency. Or they do, but now the operation is complete (this was three years ago) and they want a way of informing yahoo about the breach without admitting who was behind it in th…

It's not US. It's another state actor. Can't say more.

Re: Yahoo installed a backdoor for the NSA behind the back of the security team

#55

Post by raquo »

kabdib wrote: post #46
wildmusings wrote: post #26

Earlier quoted context omitted.

When you get a legally-binding order from the government of the United States of America, and exhaust your legal appeals, you either comply or go to prison. An ethics course won't do you any good.

Options: - Refuse to take action. They want engineering done, they can bloody well do it themselves. Don't type a single keystroke in the direction of helping them. - Announce what is going on anonymously. Plenty of avenues for this. - Announce what is going on, publicly. See if they do indeed want to take you to court. - Quit. - Take down the service. Much easier if the service is only a part of your company. Helps…

All that would accomplish is that you and everyone you sent this letter to would now be subject to another NSL with a gag order, and your fix would be undone.

Re: Yahoo installed a backdoor for the NSA behind the back of the security team

#56

Post by throwaway21013 »

bbarn wrote: post #53
hbt wrote: post #50

Earlier quoted context omitted.

This is why we (as a community/industry) need to have the equivalent of a prison/death threat. The government wins by making it personal, by threatening prison and death for your obedience. It's not an abstract threat. It is directed to a specific person not a company or security team. The people who comply can quit those companies but they don't. I'm not referring to the ones down the chain (e.g the security team wh…

Wow. This is probably the worst comment I've ever seen on HN. You're suggesting that people who follow the law, which you disagree with, get blacklisted, following the model of criminals killing other criminals who follow the law. If you want to change the government, there are far better ways than retaliating against citizens unwilling to risk life and limb for your ideology. I think you need to learn to direct your…

Troll. Period.

Re: Yahoo installed a backdoor for the NSA behind the back of the security team

#57

Post by walrus01 »

kabdib wrote: post #46
wildmusings wrote: post #26

Earlier quoted context omitted.

When you get a legally-binding order from the government of the United States of America, and exhaust your legal appeals, you either comply or go to prison. An ethics course won't do you any good.

Options: - Refuse to take action. They want engineering done, they can bloody well do it themselves. Don't type a single keystroke in the direction of helping them. - Announce what is going on anonymously. Plenty of avenues for this. - Announce what is going on, publicly. See if they do indeed want to take you to court. - Quit. - Take down the service. Much easier if the service is only a part of your company. Helps…

> Delay

> Misunderstand

see also: https://www.schneier.com/blog/archives/2016/06/1944_cia_sabo...

https://www.cia.gov/news-information/featured-story-archive/...

http://www.joeydevilla.com/2015/10/15/how-to-sabotage-your-w...

"general interference with procedures"

Re: Yahoo installed a backdoor for the NSA behind the back of the security team

#58

Post by walrus01 »

wildmusings wrote: post #52
kabdib wrote: post #46

Earlier quoted context omitted.

Options: - Refuse to take action. They want engineering done, they can bloody well do it themselves. Don't type a single keystroke in the direction of helping them. - Announce what is going on anonymously. Plenty of avenues for this. - Announce what is going on, publicly. See if they do indeed want to take you to court. - Quit. - Take down the service. Much easier if the service is only a part of your company. Helps…

If you want to quit to refuse to help, fine, but I take serious issue with what you're suggesting beyond that. These are the legal actions of the United States government, executing the authority given to them to the people's elected representatives, and overseen by a judiciary duly selected according the constitutional procedures. Their legal and democratic authority is unassailable. Further, you don't know what mot…

> You could be impeding the investigation into a deadly plot.

problem is, that's the excuse that's always going to be given by the intelligence community for even the most obviously unconstitutional intrusive privacy invading stuff, like the NSA's "opticnerve" program.

Re: Yahoo installed a backdoor for the NSA behind the back of the security team

#60

Post by derefr »

imjustsaying wrote: post #43
rmcpherson wrote: post #29

Earlier quoted context omitted.

I don't know how common this is in general, but an ethics course was a required part of the engineering core curricula at my school (Case Western Reserve). Ultimately, though, an ethics course isn't going to make people stand up for their ethics. A professional organization along the lines of the American Medical Association (at least in terms of political strength) that stands up for its members and censures those w…

> When there are few professional consequences for unethical behavior at the behest of your employer, taking an ethical stand is ineffective and quixotic. You will be fired and another engineer will likely complete the job. Well quitting a job as a concentration camp gas chamber constructor may merely slow down the operation a bit, but that could mean more lives saved until VE day arrives. And yes I did just make tha…

That assumes your job has a very low bus factor. Presuming a company of the scale required for a state to need its assistance, your absence (and that of however many people there are who agree with you) likely won't slow down the operation at all.
Post reply on HN