I wonder if MLK would exist if this were around 50 years ago.
Whistleblower Binney says the NSA has dossiers on nearly every US citizen
11–20 of 228 posts
Re: Whistleblower Binney says the NSA has dossiers on nearly every US citizen
#12Ethics, morality and legality aside, I'd be really curious to see what information is actually stored in these "dossiers", besides (presumably) one's name, address, and other details that other branches of the government legitimately have.
Oh, don't worry: ethics, morality and legality are being very much set aside.
Well, yes, I know that. ;) I meant that ethically, morally, and legally, I wouldn't want to know what they have (the NSA knowing is enough; better to destroy it than make it all public, probably), but I'm curious nonetheless.
Re: Whistleblower Binney says the NSA has dossiers on nearly every US citizen
#13Well of course they do. I would be really surprised if they didn't. That's why we should ENCRYPT EVERYTHING possible. Use HTTPS as much as you can.
I have a question about this -- maybe I'm ignorant. But using https without self-signed keys actually allows the government to peer into your communications, doesn't it? We are worried about third parties stealing your data between you and your bank for example. A bank might be a bad example as they probably already have access to their databases for compliance reasons. Can't the US government ask for the keys of the…
Having the Certificate Authority private keys would allow an attacker to sign certificates allowing the impersonation of any entity... but it does not make other sessions, boostrapped from other legitimate certificates, transparent to passive eavesdropping.
So no, government pressure on CAs wouldn't make all https like plaintext, but it does make active impersonation possible. Some initiatives like the 'SSL Observatory' or the EFF's 'Sovereign Keys' proposal could make it possible for clients to notice when a fishy new certificate is introduced for a previously-known identity -- much like the 'key has changed' warnings you may have seen when SSHing to a host whose keys have changed since your last session.
Re: Whistleblower Binney says the NSA has dossiers on nearly every US citizen
#14Well of course they do. I would be really surprised if they didn't. That's why we should ENCRYPT EVERYTHING possible. Use HTTPS as much as you can.
I have a question about this -- maybe I'm ignorant. But using https without self-signed keys actually allows the government to peer into your communications, doesn't it? We are worried about third parties stealing your data between you and your bank for example. A bank might be a bad example as they probably already have access to their databases for compliance reasons. Can't the US government ask for the keys of the…
It's not quite that bad. Even with a compromised certificate authority, it's not an invisible attack to do a man in the middle and inject their own certificate. Someone knowledgable could notice this discrepancy and raise a stink.
Furthermore, Chrome (and soon Firefox) ships some known certificates for privacy important widely used sites (e.g. the major webmail services, torproject, etc) which prevents even this attack. This defense has already caught Iran using a compromised CA.
(I'm not a cryptographer though, so please correct me if I'm wrong.)
Re: Whistleblower Binney says the NSA has dossiers on nearly every US citizen
#15Well of course they do. I would be really surprised if they didn't. That's why we should ENCRYPT EVERYTHING possible. Use HTTPS as much as you can.
That's bringing a knife to a tank fight, my man. Better, IMO, to just assume they read and listen to everything digital, and work around it.
Re: Whistleblower Binney says the NSA has dossiers on nearly every US citizen
#16Ethics, morality and legality aside, I'd be really curious to see what information is actually stored in these "dossiers", besides (presumably) one's name, address, and other details that other branches of the government legitimately have.
Is that the sort of thing you can ask for with a FOIA request?
If you have some spare time it might be worth trying--it certainly couldn't hurt. I'm not familiar enough with the actual procedure to say if it would be particularly difficult or not.
Re: Whistleblower Binney says the NSA has dossiers on nearly every US citizen
#17Well of course they do. I would be really surprised if they didn't. That's why we should ENCRYPT EVERYTHING possible. Use HTTPS as much as you can.
I have a question about this -- maybe I'm ignorant. But using https without self-signed keys actually allows the government to peer into your communications, doesn't it? We are worried about third parties stealing your data between you and your bank for example. A bank might be a bad example as they probably already have access to their databases for compliance reasons. Can't the US government ask for the keys of the…
No, it's not equivalent to plain text. If they had access to certificate authority keys (or the ability to compel CAs to issue certificates on demand), they would still need to pull off an active man-in-the-middle attack to be able to decrypt communications. Practically speaking, it seems like this would be harder to accomplish on an Internet scale than simply intercepting communications. So using HTTPS as much as possible probably helps, though you're correct that if you want to be completely certain your communications are secure you should not trust the certificate authorities.
Re: Whistleblower Binney says the NSA has dossiers on nearly every US citizen
#18Sure, they have all data about someone. But, what is the use? It is like searching a needle in a haystack.
Or like searching for a web page on the internet!
Not to mention all the fun machine learning and analysis that could be done.
Re: Whistleblower Binney says the NSA has dossiers on nearly every US citizen
#19Well of course they do. I would be really surprised if they didn't. That's why we should ENCRYPT EVERYTHING possible. Use HTTPS as much as you can.
I have a question about this -- maybe I'm ignorant. But using https without self-signed keys actually allows the government to peer into your communications, doesn't it? We are worried about third parties stealing your data between you and your bank for example. A bank might be a bad example as they probably already have access to their databases for compliance reasons. Can't the US government ask for the keys of the…
They don't even need to ask for the keys.
Pretty much every OS/browser comes with root CAs belonging to the U.S. government (on OS X I see "DoD Root CA 2" and "DoD CLASS 3 Root CA", see also http://support.apple.com/kb/HT4415). As I understand it, if they wanted to, they could MITM any HTTPS connection by forging a certificate using their root CAs.
This is why people were upset when a root CA for some Chinese government agency was added to certain browsers. We don't trust the Chinese government, but we do trust the US government, I guess.
Of course, if they regularly forged certificates someone would notice. Right?
Which begs the question, how would we notice? If you diligently check certificates for sites you visit you might happen to notice facebook.com's CA suddenly changes from Verisign to the U.S. DoD.
Is there a better way? How can we automatically check that the certificates we get are legitimate?
At a minimum it would be nice if there was a warning when a cert doesn't match a previously seen one (similar to SSH)
I feel like a "web of trust" needs to be layered on top of the certificate authorities to really solve this problem. If 10 of my friends have seen the same certificate for a given website I'm inclined to believe it's legitimate. I'm also likely to trust certain organizations (EFF, etc)
Of course it's also a user interface issue. The average user wouldn't understand a single sentence I wrote above.
Re: Whistleblower Binney says the NSA has dossiers on nearly every US citizen
#20Earlier quoted context omitted.
I have a question about this -- maybe I'm ignorant. But using https without self-signed keys actually allows the government to peer into your communications, doesn't it? We are worried about third parties stealing your data between you and your bank for example. A bank might be a bad example as they probably already have access to their databases for compliance reasons. Can't the US government ask for the keys of the…
It's not quite that bad. Even with a compromised certificate authority, it's not an invisible attack to do a man in the middle and inject their own certificate. Someone knowledgable could notice this discrepancy and raise a stink. Furthermore, Chrome (and soon Firefox) ships some known certificates for privacy important widely used sites (e.g. the major webmail services, torproject, etc) which prevents even this atta…
I think it's only a handful of certificats that are pinned (they call it "HSTS preloading" here: http://www.imperialviolet.org/2011/05/04/pinning.html). While this does include gmail and some other Google properties, it doesn't seem to include any other major webmail services.
Check out http://src.chromium.org/viewvc/chrome/trunk/src/net/base/tra... for the list of what's in there (linked to indirectly from http://dev.chromium.org/sts).