AT&T has a fiberoptic splitter copying our data to NSA • Hacker News Board

Re: AT&T has a fiberoptic splitter copying our data to NSA

#111

Post by davidandgoliath » Mon, Mar 21, 2011, 9:51 AM UTC

jedsmith wrote: post #49

holdenc wrote: post #46

Earlier quoted context omitted.

In principal it's quite wrong and scary, but in reality I have to believe the government is too incompetent to actually do anything with their mountains of AT&T collected data.

According to paperwork leaked by Mark Klein, they have/had a "Narus STA 6400" in the room. It's described as a supercomputer that sounds, to my ears, similar to Carnivore. I doubt that they even try to collect (too much data), and instead specifically look for things to grab from the firehose. http://en.wikipedia.org/wiki/Narus http://narus.com/index.php/solutions/intercept

Or, according to TIA, compile giant banks of information on every user based on their traffic & purchasing habits. Combine this with your other online data & there's quite a bit on every person.

Re: AT&T has a fiberoptic splitter copying our data to NSA

#112

Post by VladRussian » Mon, Mar 21, 2011, 11:14 AM UTC

zmblum wrote: post #2

What about the following paragraph is not clear? "The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and Warrants shall not be issued, but upon probable cause, supported by Oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized." Am I missing something? Of cour…

Lets look into the precedents. Modern interpretation used by courts is that automated weapons didn't exist when 2nd Amendment was written. The same way it will be with email didn't exist back then.

It doesn't matter that rifles of the time were the assault weapons of the time and the meaning of "papers" of the time can be extended to email.

Re: AT&T has a fiberoptic splitter copying our data to NSA

#113

Post by cjeane » Mon, Mar 21, 2011, 11:31 AM UTC

zmblum wrote: post #2

What about the following paragraph is not clear? "The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and Warrants shall not be issued, but upon probable cause, supported by Oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized." Am I missing something? Of cour…

The key here is that the data is obtained via a 3rd party. Once you as an individual share any information with a 3rd party you lose any expectation of privacy. In the digital world there are specific carve outs for email, but not much else.

These actions are terrible, but completely legal.

Re: AT&T has a fiberoptic splitter copying our data to NSA

#114

Post by JonnieCache » Mon, Mar 21, 2011, 11:33 AM UTC

thematt wrote: post #17

kjksf wrote: post #11

Earlier quoted context omitted.

In which other countries, exactly, does that happen? UK? Canada? Sweden?

Actually, yes...all those minus Sweden. The US, UK, Canada, Australia and New Zealand all cooperate together. See the Ecehlon program: http://en.wikipedia.org/wiki/Echelon_%28signals_intelligence...

>Echelon

Get with the programme ;) The new hotness in european wiretapping is called the INDECT project. Here's a presentation from CCC where a representative of one of the firms contracted to build it gets into an argument with the assembled hackers during the Q&A. It's pretty entertaining.

http://media.ccc.de/browse/congress/2010/27c3-4237-en-indect...

Re: AT&T has a fiberoptic splitter copying our data to NSA

#115

Post by asharp » Mon, Mar 21, 2011, 11:44 AM UTC

Mafana0 wrote: post #103

fugue88 wrote: post #30

Earlier quoted context omitted.

We could use GPG for normal e-mail correspondence. But I really don't know if this would do anything more than delay any problems. In a similar vein, I've deleted all the trusted root CA certs from my computer, and am now marking individual certs trusted as I hit them. Not fail-safe, but safer, I think.

>In a similar vein, I've deleted all the trusted root CA certs from my computer, and am now marking individual certs trusted as I hit them. Not fail-safe, but safer, I think. Excuse my ignorance, could you tell why it's useful to remove the certs from a PC. I've heard about root certs a couple of times already but don't understand what they really are.

Basically if you see a certificate on the interwebs, it goes through and says:

"This particular website is X". And it can back this up with all sorts of fancy math.

The problem then, is how do you know that the particular certificate is correct? I can go through and make a certificate saying that i'm santa clause. How you get around that is by using another certificate that you already have, and using that to certify the websites certificate. Ie. if you trust godaddy (or the hong kong post office), and I have a certificate saying that i'm me, signed by godaddy, then you can trust that i'm me.

The collection of certificates that you trust are then called the "root ca", and having random certificates there is a problem because if one of them was to produce a forged certificate, you'd never know about it. ie. by adding in untrusted certificates to your root ca, you lose trust in the whole certificate chain of trust process.

Re: AT&T has a fiberoptic splitter copying our data to NSA

#116

Post by khafra » Mon, Mar 21, 2011, 11:55 AM UTC

pyre wrote: post #78

mburns wrote: post #74

Earlier quoted context omitted.

Freenet, Phantom or Tor. Pick one and make it easier for people to use. Designing a whole new system isn't what we need, a "just works" system is.

How do you know that the NSA isn't listening to those? It would seem more appropriate to make public-key encryption easier to use. There are already well-defined ways to use it with email, and there's OTR for IM that could be applied to multiple protocols. Granted, only the contents of the communications are hidden in these cases, but that's a big step forwards.

I'm sure the NSA is listening to Freenet, but it doesn't matter. That's the advantage of Freenet.

Among the disadvantages of Freenet are that it's incredibly slow, difficult to find content on, and cannot access content on the regular internet.

Re: AT&T has a fiberoptic splitter copying our data to NSA

#117

Post by halfasleep » Mon, Mar 21, 2011, 12:21 PM UTC

kjksf wrote: post #13

rbranson wrote: post #9

So? This isn't the equivalent to papers secured in your household, it's data sent over someone else's network. I'm not a huge fan, but saying it's the same as the government walking into your house and examining all your documents is ridiculous. Either way, call me when someone finds out they can decrypt and examine all the SSL traffic in real-time.

It is, however, the same as government opening and reading all of the mail you send through the post office. And that government cannot do.

>Even if you're completely awesome and use SSL everything (like, say, Gmail), eventually that e-mail you sent is going to find its way from Google's servers to its final destination. That, with almost no exception, is plaintext. Gmail sends mail out using TLS where available (though I agree with your point).

Re: AT&T has a fiberoptic splitter copying our data to NSA

#118

Post by mhb » Mon, Mar 21, 2011, 12:35 PM UTC

fugue88 wrote: post #30

fingerprinter wrote: post #21

One thing I see people saying on here is that people should care....and I do...but I don't know _what_ to do with it! Can someone show/tell me what I, an average person, can do? It feels a bit overwhelming and things like this point out how powerless we really are. I hope I'm wrong and there are things we can do...I just don't know what they are. EDIT - Asking two more specific questions: 1. What can we do technicall…

We could use GPG for normal e-mail correspondence. But I really don't know if this would do anything more than delay any problems. In a similar vein, I've deleted all the trusted root CA certs from my computer, and am now marking individual certs trusted as I hit them. Not fail-safe, but safer, I think.

I don't understand what you're doing. When you get an individual cert, are you adding another trusted authority to verify that cert? If you're just trusting the individual cert, you're exposed to MITM.

Re: AT&T has a fiberoptic splitter copying our data to NSA

#119

Post by asharp » Mon, Mar 21, 2011, 1:08 PM UTC

Splines wrote: post #68

phlux wrote: post #61

Earlier quoted context omitted.

So after applying to YC today (worried that I borked my app) I had the following idea - which is an evolutionary idea from the one I applied to YC with, I dont know if this is possible - but I want to throw it out to HN: I would like to see mobile end-to-end secure communications apps that allow for users to have completely encrypted message passing. I had the following idea - please tell me if this would work: You h…

I think you're trying too hard. There are existing protocols (S/MIME, PGP, Jabber, etc.) for transferring messages in a secure manner. I'd pick the one that fits your scenario and wrap it up in a shiny app. AFAIK, there are several IM apps that could support encryption, but I don't think they are actually doing so (and if they are, they aren't advertising it). As it is, end-end secure communications is not (I think)…

eh, there exist plenty of things that are nice and shiny.

I can take pidgin and OTR and with about three minutes worth of "You should click here", have it set up easily enough that even a complete non techy can use it.

The problem is 1) It requires installation and 2) People don't know it exists. (Strangely enough, once it's installed i've never had anybody move back, mostly as pidgin is a fair amount nicer to use then MSN)

Re: AT&T has a fiberoptic splitter copying our data to NSA

#120

Post by Mafana0 » Mon, Mar 21, 2011, 1:20 PM UTC

asharp wrote: post #115

Mafana0 wrote: post #103

Earlier quoted context omitted.

>In a similar vein, I've deleted all the trusted root CA certs from my computer, and am now marking individual certs trusted as I hit them. Not fail-safe, but safer, I think. Excuse my ignorance, could you tell why it's useful to remove the certs from a PC. I've heard about root certs a couple of times already but don't understand what they really are.

Basically if you see a certificate on the interwebs, it goes through and says: "This particular website is X". And it can back this up with all sorts of fancy math. The problem then, is how do you know that the particular certificate is correct? I can go through and make a certificate saying that i'm santa clause. How you get around that is by using another certificate that you already have, and using that to certify…

Thanks for the explanation. After taking a look at the certificates that come with Windows, I can see that there are dozens of trusted root certificates, issued by some organizations that I've never heard of. Can I really trust those "root ca"? especially that I noticed some differences between the two PCs that I've checked!