Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Gmail security warnings for suspected state-sponsored attacks

googleonlinesecurity.blogspot.com

Post reply on HN
Print view View original

51–60 of 123 posts

Re: Gmail security warnings for suspected state-sponsored attacks

#51

Post by munin »

AJ007 wrote: post #46
tptacek wrote: post #39

Earlier quoted context omitted.

'haberman's comment includes actual information. Can we not punish people for posting information? I doubt very much that 'haberman approves of NSLs, especially since he said as much. Moreover, your comment may actually be incorrect; a good chunk of all the mail Gmail handles is never on the wire in a format that can be decrypted with any known attack without access to Google's (often pinned) secret keys. The NSA's a…

This "good chunk" is what? gmail to gmail? As far as I'm aware the majority of internet users are still using unencrypted plain text email.

when I receive email from people on non-Google hosted domains, I sometimes check the headers and see that mail was delivered to my gmail with ESMTPS, using TLS. so a lot of non-google hosted mail on the internet will use ESMTPS for delivery between servers, silently.

you can check this too by looking at the SMTP headers on some mail in your inbox.

Re: Gmail security warnings for suspected state-sponsored attacks

#52

Post by dfc »

twoodfin wrote: post #19
dfc wrote: post #16

Why the emphasis on state sponsored attacks? (I am aware of stuxnet/flame/sanger's book) If google knows I am being targeted by a non-state actor are they choosing not to notify me? Are we going back to a cold war mentality where the only credible attacks are state sponsored?

Presumably if it's a serious attack by a non-state actor, Google's lawyers are on the job in the relevant state(s) getting police involved, for whatever that's worth. In the state actor case, there's little or nothing they can do to make it stop happening, hence the special warning. It's also a high-profile jab at the unnamed state actors, which is nice.

So its not worth letting me know I am 0wned because google's lawyers are on the case?

Re: Gmail security warnings for suspected state-sponsored attacks

#53

Post by sneak »

haberman wrote: post #47
tomjen3 wrote: post #44

Earlier quoted context omitted.

I understand as a hacker that you want to provide the truth, but the way to stop these letters isn't to downplay their danger, but to make people scared to death of them.

If someone appeals to me to care about X but lies about the facts of X, their credibility is damaged in my eyes and I am inclined to think that they are overplaying the danger. For example, "sneak" replied to my comment with lots of CAPITAL LETTERS and links to other information. But I'm already less inclined to trust sneak, since he/she is already known to play fast and loose with the facts.

I don't mean to appear to be playing fast and loose with the facts. Certainly, the NSA tapping exchanges is a different issue than whatever restrictions the government has placed on itself when issuing NSLs for message metadata.

The fact is, message metadata is enough. I have friends and acquaintances that have been harassed and detained by officials based on their names appearing in contact lists of other suspected-but-not-charged-with-anything individuals. We're not even talking about evidence of actual communications such as message headers or metadata.

The fact that they can (and do) pull thousands of people's message headers and have access to the communications graph and traffic frequency without ANY JUDICIAL OVERSIGHT WHATSOEVER means that their ability to conduct state-sponsored extrajudicial harassment is way out of control.

It truly doesn't matter if NSLs allow them to get the body of the messages or not. If you're on the radar, you and everyone you communicate with regularly is a target. There are no legal remedies for this sort of stuff anymore.

If you do anything of import non-anonymously, you can expect to have your hardware stolen and never returned (under the guise of a search), your travel impeded, your accounts inaccessible (google "civil asset forfeiture"), your social network harassed and detained similarly, and your access to legal remedies hindered in every conceivable way.

A half-dozen examples known to me personally come to mind immediately. I'm sure there are more that I don't know about.

The threat is very real, and trying to split hairs about whether or not "reading your email" means message bodies or just headers is not productive.

Re: Gmail security warnings for suspected state-sponsored attacks

#54

Post by tomjen3 »

chc wrote: post #49
tomjen3 wrote: post #44

Earlier quoted context omitted.

I understand as a hacker that you want to provide the truth, but the way to stop these letters isn't to downplay their danger, but to make people scared to death of them.

I'm sorry if the truth is inconvenient, but that's no excuse for suppressing it and spreading lies in its place. If they really are so bad, you shouldn't need to subvert the truth in order to prove it — because their badness is the truth. If they aren't that bad, I don't see why it's so important to make people scared to death of them that I'd sacrifice my good name to do so.

You assume that people agree with me. Most people are far more interested in security than freedom. Which a valid choice so long as that choice is made for them alone, and they don't make it for me.

I don't have the speaking skills to convince the world of this, but coming of age after 9/11, I have seen first-hand the awesome power of fear.

Re: Gmail security warnings for suspected state-sponsored attacks

#55

Post by sneak »

munin wrote: post #51
AJ007 wrote: post #46

Earlier quoted context omitted.

This "good chunk" is what? gmail to gmail? As far as I'm aware the majority of internet users are still using unencrypted plain text email.

when I receive email from people on non-Google hosted domains, I sometimes check the headers and see that mail was delivered to my gmail with ESMTPS, using TLS. so a lot of non-google hosted mail on the internet will use ESMTPS for delivery between servers, silently. you can check this too by looking at the SMTP headers on some mail in your inbox.

The PKI is broken, and I bet a lot of client SMTP plays fast and loose with certificate checking anyway, even if it wasn't. DNSSEC can't come fast enough.

It helps against passive adversaries, but if someone's got access to the sending mailserver's network there are active MITM attacks that will probably defeat this.

Option 1: Try doing MITM and sending a self-signed cert for Google. The client smtpd may accept it anyway. (Cost: free)

Option 2: Spend resources to obtain a legitimate intermediate CA cert, and issue a valid cert for Google's mailserver, and MITM with that. (Cost: ca $25k-$100k, maybe less with proper connections.)

The only thing worse than self-censorship after assuming an insecure channel is a false sense of security.

Re: Gmail security warnings for suspected state-sponsored attacks

#56

Post by tptacek »

sneak wrote: post #55
munin wrote: post #51

Earlier quoted context omitted.

when I receive email from people on non-Google hosted domains, I sometimes check the headers and see that mail was delivered to my gmail with ESMTPS, using TLS. so a lot of non-google hosted mail on the internet will use ESMTPS for delivery between servers, silently. you can check this too by looking at the SMTP headers on some mail in your inbox.

The PKI is broken, and I bet a lot of client SMTP plays fast and loose with certificate checking anyway, even if it wasn't. DNSSEC can't come fast enough. It helps against passive adversaries, but if someone's got access to the sending mailserver's network there are active MITM attacks that will probably defeat this. Option 1: Try doing MITM and sending a self-signed cert for Google. The client smtpd may accept it an…

DNSSEC is a PKI run by governments. If DNSSEC had been deployed and used to run the TLS PKI a couple years ago, Ghadafi would have effectively controlled Bit.ly's SSL keys.

DNSSEC is a debacle. Reprising an older comment:

* Amazingly, contrary to everything you'd expect about "secure DNS", DNSSEC does not in fact secure DNS queries from your machine. Instead, it delegates securing DNS to DNSSEC-enabled resolver servers. For securing the actual queries your computer makes, your browser is on its own. There's a whole different protocol, TSIG, intended to address that problem.

* DNSSEC has zero successful real-world deployments, and no existing integration with any TLS stack. DNSSEC obviously does nothing to secure your actual traffic; all it does is try to protect the name lookup. TLS protects both.

* DNSSEC does nothing to address all the other intercepts, from ARP to BGP4, that real traffic has to contend with. Once you go from name to IP address (or "cert" in the fairytale world where DNSSEC has replaced the CAs), you're on your own. TLS addresses all of these issues except for CA configuration.

* DNSSEC actually reduces the security of DNS in some ways: in order to authenticate "no such host", DNSSEC publishes a sort-of-encrypted list of all your hosts. There's a whole other standards group drama surrounding the proposals to resolve this problem (NSEC3, whitelies, etc).

* DNSSEC fails badly compared to TLS. When keys inevitably get screwed up in TLS, you get a browser click-through. There is no API support to recover from a "gethostbyname()" failure caused by DNSSEC. This sounds like a reliability problem, but it's actually a security problem, in the same sense as "the little blue key icon isn't big enough" is a security problem for SSL. We just don't know what the exploit is, because nobody has designed the "solution" for this problem.

* TLS has 15+ years of formal review (it is the most reviewed cryptosystem ever published). We still find things in it. DNSSEC has received nothing resembling the same scrutiny. It's ludicrous to believe we won't find horrible problems with it. You'd be asserting that a protocol co-designed by Paul Kocher will eventually fare worse than one designed by the IETF DNS working group. The IETF DNS working group would basically have to crush some of the smartest practical crypto people in the world.

* TLS is at least configurable (virtually all TLS problems are in fact user interface and configuration problems, not problems with the underlying system). You can nuke untrustworthy CAs. There is no clean way to opt in or out of different DNSSEC policies, as the drama surrounding DLV illustrates.

In the '90s, we designed web security to assume that DNS was insecure. That was a smart decision. "Security" means different things to different people. It's a policy decision. The end-to-end argument strongly suggests that it's something that can't be baked into the lower parts of the stack. DNSSEC is a step backwards. I think you can already see the indications of the problems it will cause just by looking at the places it already falls down. What we need is a concerted effort to solve the security UI and policy problems that browsers have.

If you're looking for protocol-level remediation for TLS's current CA policy problem, you want to pay attention to TACK:

http://tools.ietf.org/html/draft-perrin-tls-tack-00

This is Trevor Perrin and Moxie Marlinspike.

Re: Gmail security warnings for suspected state-sponsored attacks

#57

Post by sneak »

jws wrote: post #37
sneak wrote: post #31

Earlier quoted context omitted.

In other news: I offer 50 bitcoins to anyone who can get me at least 5 or 10 good screenshots of the features and UI of the (presumably web) interface that Google provides to the feds for NSL/PATRIOT (un)"lawful intercept". 10 bitcoins for each of any other Alexa-top-50 provider (e.g. hotmail, FB, etc). Anonymous mails accepted at sneak@datavibe.net. Include bitcoin address for payment. Don't bother with fakes - I've…

Wasn't the core of the ThinkSecret lawsuit related to enticing people to break confidentiality agreements? Maybe this offer should be restricted to legally obtained and propagated screenshots.

Civil lawsuit. You can expose yourself to great civil liability without doing anything illegal.

Re: Gmail security warnings for suspected state-sponsored attacks

#58

Post by tptacek »

sneak wrote: post #53
haberman wrote: post #47

Earlier quoted context omitted.

If someone appeals to me to care about X but lies about the facts of X, their credibility is damaged in my eyes and I am inclined to think that they are overplaying the danger. For example, "sneak" replied to my comment with lots of CAPITAL LETTERS and links to other information. But I'm already less inclined to trust sneak, since he/she is already known to play fast and loose with the facts.

I don't mean to appear to be playing fast and loose with the facts. Certainly, the NSA tapping exchanges is a different issue than whatever restrictions the government has placed on itself when issuing NSLs for message metadata. The fact is, message metadata is enough. I have friends and acquaintances that have been harassed and detained by officials based on their names appearing in contact lists of other suspected-…

I disagree that "It truly doesn't matter if NSLs allow them to get the body of the messages or not". It truly matters a whole hell of a lot to me if someone can see my messages, as versus my email headers.

Re: Gmail security warnings for suspected state-sponsored attacks

#59

Post by trotsky »

dfc wrote: post #52
twoodfin wrote: post #19

Earlier quoted context omitted.

Presumably if it's a serious attack by a non-state actor, Google's lawyers are on the job in the relevant state(s) getting police involved, for whatever that's worth. In the state actor case, there's little or nothing they can do to make it stop happening, hence the special warning. It's also a high-profile jab at the unnamed state actors, which is nice.

So its not worth letting me know I am 0wned because google's lawyers are on the case?

I assure you that the grandparent is misinformed, the chance of google's lawyers and/or the police being involved if some individual is sending you targeted malware (aka spear phishing) is essentially 0%.

Re: Gmail security warnings for suspected state-sponsored attacks

#60

Post by jahmed »

dfc wrote: post #52
twoodfin wrote: post #19

Earlier quoted context omitted.

Presumably if it's a serious attack by a non-state actor, Google's lawyers are on the job in the relevant state(s) getting police involved, for whatever that's worth. In the state actor case, there's little or nothing they can do to make it stop happening, hence the special warning. It's also a high-profile jab at the unnamed state actors, which is nice.

So its not worth letting me know I am 0wned because google's lawyers are on the case?

AFAIK you do get warned if Google thinks your account has been compromised by normal pishers and what not. This is just a more detailed message that I'm sure most people will never see.
Post reply on HN