Yahoo installed a backdoor for the NSA behind the back of the security team

Post by willstrafach » Thu, Dec 15, 2016, 4:59 PM UTC

djsumdog wrote: post #101

dmix wrote: post #71

Earlier quoted context omitted.

PRISM (Yahoo joined 2nd in 2008 after Microsoft in 2007) would basically defeat the purpose of doing this without permission... Did Yahoo Mail even use HTTPS? In that case a FISA warrant would just be an extra level of assurance that they got everything from that person's inbox (plus inboxes of 3 hops of everyone they ever emailed). Otherwise they were just an XKeyscore query, probably filtered by US geodata, away fr…

I feel like everyone has forgotten about PRISM. All the big companies denied they participated in PRISM. Is it real, and if so, why have Americans been so complacent about its existence?

Post by [deleted] » Thu, Dec 15, 2016, 5:21 PM UTC

ralfn wrote: post #156

wallace_f wrote: post #114

Earlier quoted context omitted.

> US intelligence activities are actively harmful to American commercial interests because they destroy trust, particularly from customers elsewhere in the world. We already stand as the most powerful country on earth. It's a great testament to ineptitude in government that this is the current reality.

Yes. And dangerous in the long term because the US wont be the most powerfull country forever. High trees catch a lot of wind. People are more likely to hate the US. When the tides change and the power inbalance goes away the hate and mistrust will still be there. But maybe society is wiser this time around.

Post by AnthonyMouse » Thu, Dec 15, 2016, 5:36 PM UTC

Kalium wrote: post #249

AnthonyMouse wrote: post #113

Earlier quoted context omitted.

> Create a climate of "snitches get stitches" and maybe they will think twice before selling out the lives of a billion people. Committing crimes against people who defect is obviously not going to work. They'll just arrest you for it. But suppose we create a certification. To get certified all you have to do is promise not to work on a specific list of things: Mass surveillance, backdoors, etc. To lose certification…

> But suppose we create a certification. To get certified all you have to do is promise not to work on a specific list of things: Mass surveillance, backdoors, etc. To lose certification forever all you have to do is work on one of those things. I fear you may be making a potentially dangerous assumption about how engineering works in a compartmentalized environment. Engineers do not always know the purpose of the sy…

Post by binaryblitz » Thu, Dec 15, 2016, 5:40 PM UTC

walrus01 wrote: post #22

I seriously think that to get a CS or EE degree (or similar) B.Sci degree, you should be required to take at least one full term length ethics course. Same idea as the ethics courses taught to junior law students. The internet is already fucked up enough with governments and rogue corporations messing with its AS-adjacency topology in non-free ways at OSI layers 1-3 , before you even get into stuff like writing backd…

Post by FlailFast » Thu, Dec 15, 2016, 5:43 PM UTC

Jach wrote: post #176

walrus01 wrote: post #22

I seriously think that to get a CS or EE degree (or similar) B.Sci degree, you should be required to take at least one full term length ethics course. Same idea as the ethics courses taught to junior law students. The internet is already fucked up enough with governments and rogue corporations messing with its AS-adjacency topology in non-free ways at OSI layers 1-3 , before you even get into stuff like writing backd…

Save it for the MBAs instead, or even as an onboarding requirement along with other training for new management hires. It's not generally the engineers making these decisions. Sometimes it's an active issue and at the end of the day someone must implement something terrible (knowingly or not -- direct a junior engineer to do some complex task with the expectation they'll leave behind security vulnerabilities, just as…