Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Yahoo installed a backdoor for the NSA behind the back of the security team

diracdeltas.github.io

Post reply on HN
Print view View original

181–190 of 302 posts

Re: Yahoo installed a backdoor for the NSA behind the back of the security team

#181

Post by ethbro »

webmaven wrote: post #154
peterkelly wrote: post #32

I know this is from October, but it warrants re-reading now. Today, Yahoo announced a hack of 1B accounts. They say they don't know who it is, but we can conclude it's not the US government because Yahoo is willing and legally able to publicly disclose it. Previously, Yahoo willingly assisted an attacker in compromising 1B accounts. In this case, they did not disclose the attack publicly, or even to their own chief i…

> we can conclude it's not the US government because Yahoo is willing and legally able to publicly disclose it. That is the way to bet, but it is also possible (though not very likely) that Yahoo disclosed this publicly before the relevant USG agency could get an NSL out.

That doesn't make much sense though. If they could get an NSL for this with a gag order after the fact, then even a rubber stamp judge would no doubt be curious why they didn't get one before and notify Yahoo.

Re: Yahoo installed a backdoor for the NSA behind the back of the security team

#182

Post by ethbro »

pjc50 wrote: post #160
Animats wrote: post #125

Earlier quoted context omitted.

In a large company, a useful thing to do if something fishy is going on is to go see the company's general counsel.[1] If they didn't know about it, they should be told. Their job is to keep the company out of legal trouble. In many cases they have a legal obligation to do something about it. An attorney will rarely tell you to do something illegal; they can be disbarred for that. If they tell you it's OK, then they'…

In the case of NSLs, or UK orders from the security services, it may be illegal to tell anyone who isn't mentioned in the order. Including the company's general counsel. In the event that you are asked to do something illegal, it may be illegal or inadmissible to mention that you were ordered to do so by the government (Matrix-Churchill trial passim)

Would be interested to hear a legal opinion on this. In the US, you do have a constitutional right to counsel (Assistance of Counsel clause of the Sixth Amendment), generally of your choice.

From my reading of the case law, the crux would be that right to counsel can only be invoked "at or after the time that judicial proceedings have been initiated against him, whether by formal charge, preliminary hearing, indictment, information, or arraignment."

Does an NSL constitute adversarial proceedings? Also, how does right to counsel work with other legal gag orders (e.g. if I'm cooperating to provide information on a criminal case but have been ordered not to inform the targets)?

Re: Yahoo installed a backdoor for the NSA behind the back of the security team

#183

Post by angusp »

walrus01 wrote: post #22

I seriously think that to get a CS or EE degree (or similar) B.Sci degree, you should be required to take at least one full term length ethics course. Same idea as the ethics courses taught to junior law students. The internet is already fucked up enough with governments and rogue corporations messing with its AS-adjacency topology in non-free ways at OSI layers 1-3 , before you even get into stuff like writing backd…

can't speak for all CS students but we certainly have an ethics course. Unfortunately a lot of people see it as an insult to their intelligence yet need reminding of many of their professional obligations and that their 'cool hackathon idea' might be illegal

Re: Yahoo installed a backdoor for the NSA behind the back of the security team

#184

Post by coldcode »

benevol wrote: post #145
polack wrote: post #129

Earlier quoted context omitted.

One would have to be really naive to believe that Google, Apple and the other big ones aren't backdoored by the three letter agencies by now.

You'd be surprised that there are still (technically competent) HN users who seem to be that naive. Or to promote gv't propaganda. Our only solution is to go 100% open-source and 100% end-to-end encryption.

And the government has the power to ban open source and encrypted communications. It's not really all that difficult, if you eliminate any concern for the constitution. If all else fails, rubber hoses and bullets work well.

Re: Yahoo installed a backdoor for the NSA behind the back of the security team

#186

Post by mtreis86 »

nnq wrote: post #138
wildmusings wrote: post #52

Earlier quoted context omitted.

If you want to quit to refuse to help, fine, but I take serious issue with what you're suggesting beyond that. These are the legal actions of the United States government, executing the authority given to them to the people's elected representatives, and overseen by a judiciary duly selected according the constitutional procedures. Their legal and democratic authority is unassailable. Further, you don't know what mot…

Not an american, but the idea is that passive aggressiveness / mild-sabotage from citizens is just another way of expression, just like voting. And it works for the purpose and/or towards democracy! This is imho the untold truth about why most communist / socialist regimes failed: people at all levels of society started doing their work gradually worse and worse, pissed off and stressed out by the lack of freedom and…

How does the old Soviet saying go - "We pretend to work - they pretend to pay us"

Re: Yahoo installed a backdoor for the NSA behind the back of the security team

#187

Post by macspoofing »

walrus01 wrote: post #22

I seriously think that to get a CS or EE degree (or similar) B.Sci degree, you should be required to take at least one full term length ethics course. Same idea as the ethics courses taught to junior law students. The internet is already fucked up enough with governments and rogue corporations messing with its AS-adjacency topology in non-free ways at OSI layers 1-3 , before you even get into stuff like writing backd…

>I seriously think that to get a CS or EE degree (or similar) B.Sci degree, you should be required to take at least one full term length ethics coursev

Why limit to CS or EE? Why not ... everybody?

Re: Yahoo installed a backdoor for the NSA behind the back of the security team

#188

Post by macspoofing »

kabdib wrote: post #46
wildmusings wrote: post #26

Earlier quoted context omitted.

When you get a legally-binding order from the government of the United States of America, and exhaust your legal appeals, you either comply or go to prison. An ethics course won't do you any good.

Options: - Refuse to take action. They want engineering done, they can bloody well do it themselves. Don't type a single keystroke in the direction of helping them. - Announce what is going on anonymously. Plenty of avenues for this. - Announce what is going on, publicly. See if they do indeed want to take you to court. - Quit. - Take down the service. Much easier if the service is only a part of your company. Helps…

I think it's reasonable to expect a reasonable level of (legal) pushback from service providers against government warrants or mandates. It's unreasonable to expect of them to risk their entire business.

Re: Yahoo installed a backdoor for the NSA behind the back of the security team

#189

Post by jonahrd »

Jach wrote: post #176
walrus01 wrote: post #22

I seriously think that to get a CS or EE degree (or similar) B.Sci degree, you should be required to take at least one full term length ethics course. Same idea as the ethics courses taught to junior law students. The internet is already fucked up enough with governments and rogue corporations messing with its AS-adjacency topology in non-free ways at OSI layers 1-3 , before you even get into stuff like writing backd…

Save it for the MBAs instead, or even as an onboarding requirement along with other training for new management hires. It's not generally the engineers making these decisions. Sometimes it's an active issue and at the end of the day someone must implement something terrible (knowingly or not -- direct a junior engineer to do some complex task with the expectation they'll leave behind security vulnerabilities, just as…

I disagree strongly. If you from an engineering perspective are the only one who truly recognizes the implications of a management decision, you need to speak up about it.
Post reply on HN