Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Yahoo installed a backdoor for the NSA behind the back of the security team

diracdeltas.github.io

Post reply on HN
Print view View original

221–230 of 302 posts

Re: Yahoo installed a backdoor for the NSA behind the back of the security team

#221

Post by seren »

kabdib wrote: post #217
pjc50 wrote: post #160

Earlier quoted context omitted.

In the case of NSLs, or UK orders from the security services, it may be illegal to tell anyone who isn't mentioned in the order. Including the company's general counsel. In the event that you are asked to do something illegal, it may be illegal or inadmissible to mention that you were ordered to do so by the government (Matrix-Churchill trial passim)

I wonder how they think this is supposed to work. - CEO gets a Letter. Does the CEO start learning Python/C++/PHP and Cisco configuration? Or does he tell a worker bee "Shhh! And read this Letter" ? - Worker bee starts making changes to production code and systems. Suddenly he starts needing automated code reviews, and reconfiguration alerts go out when he frobs the firewalls. These changes are indistinguishable from…

The easiest way is probably to create a bullshit project with a few people. We are only creating a new dashboard for X, this is cost reduction project, etc.

I don't know how Yahoo is organized but if teams works in silos, without any visibility on other teams, it is probably not that hard to introduced changes that are undetected.

Re: Yahoo installed a backdoor for the NSA behind the back of the security team

#222

Post by kijin »

Fnoord wrote: post #200
kijin wrote: post #87

Earlier quoted context omitted.

You talk to your boss. Your boss talks to the NSA. The NSA will find a way to silence the white-hat. Problem solved. Philosophical dilemmas are fun to talk about, but only as long as you take the premises as granted. People who carry swords tend not to waste time trying to disentangle knots that they can simply cut in half. Most "technical" solutions to "human" problems suffer this vulnerability.

> You talk to your boss. Your boss talks to the NSA. The NSA will find a way to silence the white-hat. Problem solved. Seems you're assuming the white hat hacker is from USA. I'm not so sure the NSA is going to be able to silence a white hat hacker from say Russia, or anywhere out of USA for that matter.

Silencing somebody doesn't need to involve sending him a legally binding gag order. Nor does it necessarily require killing him.

There are lots of carrots (e.g. job offer, lucrative contract) and whips (e.g. a threat to ruin his business or professional reputation) that a government agency can use to persuade someone, even a foreigner, to keep something a secret for a certain length of time.

This obviously won't work on someone who is under Putin's protection, for example, but then we're talking about cyberwar, not a lone white-hat.

Re: Yahoo installed a backdoor for the NSA behind the back of the security team

#223

Post by nnq »

CapacitorSet wrote: post #143
nnq wrote: post #138

Earlier quoted context omitted.

Not an american, but the idea is that passive aggressiveness / mild-sabotage from citizens is just another way of expression, just like voting. And it works for the purpose and/or towards democracy! This is imho the untold truth about why most communist / socialist regimes failed: people at all levels of society started doing their work gradually worse and worse, pissed off and stressed out by the lack of freedom and…

That's an extremely rose-tinted narrative.

Nothing rose tinted about it... yeah, the system got from state A to a less bad state B. And millions of people suffered and died in the process.

Probably one of the worse and most mentally damaging ways to enact social change. Now you have democracy, but also a society with 50% of the seniors infected with a toxic mentality that will stay with them until they die - once you do something over and over again it becomes a habit and a habit of subtle systemic and self sabotage is horrible. And some of it managed to pass it on to younger generations, hence extra laziness and crime. Almost like the fallout of a "mental nuclear war" that keeps lingering and "irradiating people's minds" long after the old problems disappeared.

I'm just remarking that in its slow and lives-wrecking way, this... works!

Re: Yahoo installed a backdoor for the NSA behind the back of the security team

#224

Post by mikebay »

Whoooa!! I would like in this point of privacy terrorism to ask everyone to log out from yahoo, twitter, google and facebook. They are gonna terrorise your privacy totally. When people start to care ? Is there some mass hypnosis going on ?

Google, Facebook, Twitter and Yahoo. - no thanks.

Re: Yahoo installed a backdoor for the NSA behind the back of the security team

#225

Post by milansuk »

mikegioia wrote: post #206
milansuk wrote: post #185

I'm wondering what will happen? More users will start using decentralized and open source programs? They will run their own mail server? Or They will hate NSA, but still push personal data to few big corporations?

Nothing will happen. "Users" don't even know what the majority of these things are, and this concern certainly doesn't even fly on their radar. I've spent 5 years now on this very topic and my conclusion is that the people just don't give a shit.

I feel it same. I've created new decentralized internet platform for 3years. But when I release it next month I will present different features than decentralization, because people who hate spying, but fear to change are really not the market.

Re: Yahoo installed a backdoor for the NSA behind the back of the security team

#226

Post by markman »

dpark wrote: post #211
markman wrote: post #205

Earlier quoted context omitted.

I'm still lost?

'criminate => criminal The "te with l" tip was for the original "'criminate" and not very clear.

Duh I'm sorry I thought that that was an "i". I kept thinking is that some Latin form of pluralizing the word. Oops. Where's my coffee...

Re: Yahoo installed a backdoor for the NSA behind the back of the security team

#227

Post by brbrodude »

titzer wrote: post #219

Face it, the US government is not operating like it has the best interests of the people as its core motivation.

`"That's not the way the world really works anymore." He continued "We're an empire now, and when we act, we create our own reality. And while you're studying that reality—judiciously, as you will—we'll act again, creating other new realities, which you can study too, and that's how things will sort out. We're history's actors … and you, all of you, will be left to just study what we do."`

https://en.wikiquote.org/wiki/Karl_Rove

Re: Yahoo installed a backdoor for the NSA behind the back of the security team

#228

Post by djsoosbnw »

Jach wrote: post #194
jonahrd wrote: post #189

Earlier quoted context omitted.

I disagree strongly. If you from an engineering perspective are the only one who truly recognizes the implications of a management decision, you need to speak up about it.

Engineers do speak up, frequently. For a famous example, see the Challenger disaster. Again, engineers aren't generally the problem. Still disagree?

The NSA don't seem to lack the technical talent to wantonly shit all over the Constitution.

Plenty of HN posts laud people for working for the government, the entity which engages in war crimes, torture, and mass surveillance.

Re: Yahoo installed a backdoor for the NSA behind the back of the security team

#229

Post by hollander »

neuland wrote: post #92
derefr wrote: post #66

Earlier quoted context omitted.

Let's say an unaffiliated third party (white-hat hacker) found the exploit and reported it to you under a Bug Bounty program. Let's also say that that third-party was someone who followed "responsible disclosure" rules, and said that they'd publicize the vulnerability if you didn't do so yourself within a short time-frame. You investigate (by asking your team, your boss, looking at the bug tracker, etc.) and figure o…

Whether or not the company is doing everything they can to resist the order, I think that NSL's are always accompanied by a clear communication channel between a company's counsel and the agency. So, after someone under the gag realizes the situation, they get the company's lawyers in contact with the agency to see what to do. The agency would then gag the white hat. IMO, that's a huge part of why NSL's are scary. Yo…

> So, after someone under the gag realizes the situation, they get the company's lawyers in contact with the agency to see what to do. The agency would then gag the white hat.

He doenn't live in the US. Once he realizes this is going on, he'll disclose.

Re: Yahoo installed a backdoor for the NSA behind the back of the security team

#230

Post by DennisP »

rodgerd wrote: post #99
hbt wrote: post #62

Earlier quoted context omitted.

So now, quitting your job (because you're asked to do something unethical) is the equivalent of losing your life and limbs? Let me guess, you believe all government actions are lawful. All lawful actions are righteous and justified. The only permissible way to change the system is through the system. Did I get the gist of your morality? In which case, keep voting and I'm sure you will see the changes you want reflect…

> So now, quitting your job (because you're asked to do something unethical) is the equivalent of losing your life and limbs? In a capitalist system, where your alternatives are "work or stave", yes.

Only if you can't get another job. That's not likely to be a problem for most people faced with this particular situation.
Post reply on HN