Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Yahoo installed a backdoor for the NSA behind the back of the security team

diracdeltas.github.io

Post reply on HN
Print view View original

141–150 of 302 posts

Re: Yahoo installed a backdoor for the NSA behind the back of the security team

#141

Post by avdempsey »

uiri wrote: post #103
peterkelly wrote: post #32

I know this is from October, but it warrants re-reading now. Today, Yahoo announced a hack of 1B accounts. They say they don't know who it is, but we can conclude it's not the US government because Yahoo is willing and legally able to publicly disclose it. Previously, Yahoo willingly assisted an attacker in compromising 1B accounts. In this case, they did not disclose the attack publicly, or even to their own chief i…

Given its government's track record, I would think that data centers in the US should be walled off in much the same way as data centers in China. It is frankly surprising that American companies are blind to their own government's track record for indiscriminately spying on its citizens and people around the world.

You mean American companies like Apple? Whether you trust them or not they've certainly brought it up. Though they might not label the spying indiscriminate; maybe still 'criminate.

Or are Chinese companies doing some interesting walling-off?

Re: Yahoo installed a backdoor for the NSA behind the back of the security team

#143

Post by CapacitorSet »

nnq wrote: post #138
wildmusings wrote: post #52

Earlier quoted context omitted.

If you want to quit to refuse to help, fine, but I take serious issue with what you're suggesting beyond that. These are the legal actions of the United States government, executing the authority given to them to the people's elected representatives, and overseen by a judiciary duly selected according the constitutional procedures. Their legal and democratic authority is unassailable. Further, you don't know what mot…

Not an american, but the idea is that passive aggressiveness / mild-sabotage from citizens is just another way of expression, just like voting. And it works for the purpose and/or towards democracy! This is imho the untold truth about why most communist / socialist regimes failed: people at all levels of society started doing their work gradually worse and worse, pissed off and stressed out by the lack of freedom and…

That's an extremely rose-tinted narrative.

Re: Yahoo installed a backdoor for the NSA behind the back of the security team

#144

Post by grub5000 »

avdempsey wrote: post #142

Taking the headline literally "Yahoo installed a backdoor for the NSA behind the back of the security team" is as much an indictment of then-Yahoo's security team as a reminder that's it's a possibility for other companies to consider.

The OP does specify that Yahoo's Security Team caught the backdoor within a few weeks, so they can't be wholly incompetent.

Re: Yahoo installed a backdoor for the NSA behind the back of the security team

#145

Post by benevol »

polack wrote: post #129
electic wrote: post #76

If they are doing this at Yahoo, what proof do we have they are not doing this at Google...right at this moment?

One would have to be really naive to believe that Google, Apple and the other big ones aren't backdoored by the three letter agencies by now.

You'd be surprised that there are still (technically competent) HN users who seem to be that naive. Or to promote gv't propaganda.

Our only solution is to go 100% open-source and 100% end-to-end encryption.

Re: Yahoo installed a backdoor for the NSA behind the back of the security team

#146

Post by Snowdax »

walrus01 wrote: post #22

I seriously think that to get a CS or EE degree (or similar) B.Sci degree, you should be required to take at least one full term length ethics course. Same idea as the ethics courses taught to junior law students. The internet is already fucked up enough with governments and rogue corporations messing with its AS-adjacency topology in non-free ways at OSI layers 1-3 , before you even get into stuff like writing backd…

Here in Ireland anyway for a university to be accredited at all ethics has to be part of the engineering curriculum.

First Semester of our first year we got a dedicated ethics class.

Re: Yahoo installed a backdoor for the NSA behind the back of the security team

#147

Post by toothbrush »

derefr wrote: post #60
imjustsaying wrote: post #43

Earlier quoted context omitted.

> When there are few professional consequences for unethical behavior at the behest of your employer, taking an ethical stand is ineffective and quixotic. You will be fired and another engineer will likely complete the job. Well quitting a job as a concentration camp gas chamber constructor may merely slow down the operation a bit, but that could mean more lives saved until VE day arrives. And yes I did just make tha…

That assumes your job has a very low bus factor. Presuming a company of the scale required for a state to need its assistance, your absence (and that of however many people there are who agree with you) likely won't slow down the operation at all.

...which is a good argument to give up and continue building, how exactly?

Re: Yahoo installed a backdoor for the NSA behind the back of the security team

#148

Post by simonh »

wildmusings wrote: post #52
kabdib wrote: post #46

Earlier quoted context omitted.

Options: - Refuse to take action. They want engineering done, they can bloody well do it themselves. Don't type a single keystroke in the direction of helping them. - Announce what is going on anonymously. Plenty of avenues for this. - Announce what is going on, publicly. See if they do indeed want to take you to court. - Quit. - Take down the service. Much easier if the service is only a part of your company. Helps…

If you want to quit to refuse to help, fine, but I take serious issue with what you're suggesting beyond that. These are the legal actions of the United States government, executing the authority given to them to the people's elected representatives, and overseen by a judiciary duly selected according the constitutional procedures. Their legal and democratic authority is unassailable. Further, you don't know what mot…

Their legal and democratic authority is absolutely assailable, within the laws of the United States and within it's democratic processes. That's why the US system of governance contains within it checks and balances between the different institutions.

There absolutely should be mechanisms to challenge or appeal against any action of government, and when there isn't as seemed to be the case with NSLs that's a very good indication that the system is being grossly abused by government agencies.

Re: Yahoo installed a backdoor for the NSA behind the back of the security team

#149

Post by _puk »

Animats wrote: post #125
kabdib wrote: post #46

Earlier quoted context omitted.

Options: - Refuse to take action. They want engineering done, they can bloody well do it themselves. Don't type a single keystroke in the direction of helping them. - Announce what is going on anonymously. Plenty of avenues for this. - Announce what is going on, publicly. See if they do indeed want to take you to court. - Quit. - Take down the service. Much easier if the service is only a part of your company. Helps…

In a large company, a useful thing to do if something fishy is going on is to go see the company's general counsel.[1] If they didn't know about it, they should be told. Their job is to keep the company out of legal trouble. In many cases they have a legal obligation to do something about it. An attorney will rarely tell you to do something illegal; they can be disbarred for that. If they tell you it's OK, then they'…

I'd suggest following up any conversation of substance with general counsel (or even the likes of HR for that matter) with an email detailing the conversation you just had.

Don't do it in an obtuse manner; let them know in advance that you will be sending it following the meeting, maybe even get them to suggest the wording of it if you aren't convinced of the security of internal mail.

It's easy for either side to forget the exact points raised during a conversation like that, so good for everyone to have a written record.

Re: Yahoo installed a backdoor for the NSA behind the back of the security team

#150

Post by mindcrime »

bbarn wrote: post #53
hbt wrote: post #50

Earlier quoted context omitted.

This is why we (as a community/industry) need to have the equivalent of a prison/death threat. The government wins by making it personal, by threatening prison and death for your obedience. It's not an abstract threat. It is directed to a specific person not a company or security team. The people who comply can quit those companies but they don't. I'm not referring to the ones down the chain (e.g the security team wh…

Wow. This is probably the worst comment I've ever seen on HN. You're suggesting that people who follow the law, which you disagree with, get blacklisted, following the model of criminals killing other criminals who follow the law. If you want to change the government, there are far better ways than retaliating against citizens unwilling to risk life and limb for your ideology. I think you need to learn to direct your…

Not everyone is in so privileged of a position to be taking your specific moral high ground over their own well being.

"Privilege" doesn't enter into it. Everybody has the option to do the right thing, if they're willing to accept the consequences. Not everybody will of course, but there's nothing truly preventing one from doing so.

Post reply on HN