Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A Saudi Arabia Telecom's Surveillance Pitch

thoughtcrime.org

Post reply on HN
Print view View original

41–50 of 115 posts

Re: A Saudi Arabia Telecom's Surveillance Pitch

#41

Post by spindritf »

tptacek wrote: post #2

This stuff happens more than anyone in infosec wants to admit; it's (ironically) what got me into professional software security to begin with, after being upset by what a commercial network monitoring tool would have allowed us to do to our customers at an ISP I helped run. It's especially funny to see a government sponsored telecom reaching out to Moxie Marlinspike. Also: this isn't like that time a random Microsof…

> money buys technology

I don't think it matters. He quickly noticed that the problem is cultural, that

>> I’d much rather think about the question of exploit sales in terms of who we welcome to our conferences, who we choose to associate with, and who we choose to exclude, than in terms of legal regulations. I think the contextual shift we’ve seen over the past few years requires that we think critically about what’s still cool and what’s not.

But the problem with/in Saudi Arabia is also cultural, or social, not technological. It doesn't really matter that they can buy exploits or intercept communications. What matters is that those in power can stay in power while doing all that.

Mao and Stalin built some of the most repressive regimes the world has seen with 1930s technology, and even then they were behind the times. Do you think those would have been rocked by secure Twitter? On the other hand, Greeks ran fairly decent democracies when the closest thing to mass communications was shouting in a place with good acoustics.

I'm not saying the west should just provide scum of the world with access to modern technology. Let's not kid ourselves though. Whether we do or not, it won't change much.

Re: A Saudi Arabia Telecom's Surveillance Pitch

#42

Post by minimax »

tptacek wrote: post #37
minimax wrote: post #34

Earlier quoted context omitted.

Like Moxie says, money buys technology, and they will eventually find someone to rig up a workable solution for what they're trying to do. Governments are in a unique position here. They can always just move up the stack. Can't break the crypto? That's fine. They can just require the mobile phone companies to sell phones with spyware already included.

That problem is, I think, a showstopper for "anti-circumvention" tools like whatever- the- next- generation- of - Tor will be. Dictatorships have little to lose by backdooring or rootkitting devices; they'll laugh off any outrage stirred up by the discovery of these methods. But the economics flip around in Europe, Japan, the US, &c: governments there do have something to lose by surreptitiously backdooring huge numb…

The US government is a special case again. Since most of the companies mentioned here are headquartered in the US, the US government can resort to the no-tech solution of just asking for the data and presenting a subpoena (or so was my experience working for a large US telecom carrier).

Re: A Saudi Arabia Telecom's Surveillance Pitch

#43

Post by josh2600 »

moxie wrote: post #27
luser001 wrote: post #12

I'm very curious what aspect of Twitter's TLS code makes hard to intercept whereas other websites can be easily intercepted? I'm also very curious about how they intercepted Whatsapp. Does it do something stupid like eval'ing code received over regular HTTP? Quoting the paragraph, in case my paraphrasing is inaccurate: "What’s depressing is that I could have easily helped them intercept basically all of the traffic t…

WhatsApp doesn't use TLS, and their protocol has a fairly long history of criticism.

http://www.neowin.net/forum/topic/1148702-realized-that-what...

I seem to remember their authentication was a combination of your phone number and the IMEI of your handset, which is woeful security through obscurity at best.

Re: A Saudi Arabia Telecom's Surveillance Pitch

#44

Post by tptacek »

spindritf wrote: post #41
tptacek wrote: post #2

This stuff happens more than anyone in infosec wants to admit; it's (ironically) what got me into professional software security to begin with, after being upset by what a commercial network monitoring tool would have allowed us to do to our customers at an ISP I helped run. It's especially funny to see a government sponsored telecom reaching out to Moxie Marlinspike. Also: this isn't like that time a random Microsof…

> money buys technology I don't think it matters. He quickly noticed that the problem is cultural, that >> I’d much rather think about the question of exploit sales in terms of who we welcome to our conferences, who we choose to associate with, and who we choose to exclude, than in terms of legal regulations. I think the contextual shift we’ve seen over the past few years requires that we think critically about what’…

It is possible to believe both things at the same time: that dictatorships will inevitably acquire exploits, backdoors, and monitoring tools, and that it's unconscionable for companies to sell these things to dictatorships.

The story is perhaps clearer on exploit markets. The alternative to markets is publication, which burns the vulnerability by hastening its patch deployment. Dictatorships will inevitably acquire more exploits, but they are in a race against everyone in else discovering vulnerabilities.

Re: A Saudi Arabia Telecom's Surveillance Pitch

#45

Post by tptacek »

minimax wrote: post #42
tptacek wrote: post #37

Earlier quoted context omitted.

That problem is, I think, a showstopper for "anti-circumvention" tools like whatever- the- next- generation- of - Tor will be. Dictatorships have little to lose by backdooring or rootkitting devices; they'll laugh off any outrage stirred up by the discovery of these methods. But the economics flip around in Europe, Japan, the US, &c: governments there do have something to lose by surreptitiously backdooring huge numb…

The US government is a special case again. Since most of the companies mentioned here are headquartered in the US, the US government can resort to the no-tech solution of just asking for the data and presenting a subpoena (or so was my experience working for a large US telecom carrier).

The difference is that a subpoena doesn't decrypt an EDH TLS session.

Re: A Saudi Arabia Telecom's Surveillance Pitch

#46

Post by mseebach »

peterwwillis wrote: post #3

There needs to be an RFC for Postcard Key Encryption - send each other public keys on hand-written postcards to single-use P.O. boxes to avoid mitm of the initial key exchange. I don't understand why anyone trusts CAs any more.

You could also just email your certificate and text or call with the fingerprint. You'd have to be very directly and very actively targeted by a very competent government for that to fail.

Re: A Saudi Arabia Telecom's Surveillance Pitch

#47

Post by peterwwillis »

tptacek wrote: post #30
peterwwillis wrote: post #29

Earlier quoted context omitted.

So, even though the government can snoop on us, we shouldn't stop using CAs, because then the government could snoop on us. With TACK you depend on CAs to establish the initial connection, set up a "pin", and then no longer rely on the CA for future connections. That initial connection is fungible by a MITM, so it's not secure. We need a term for connections that are "probably" secure, but for which there is no compl…

Yes, that is exactly what I am saying. The current CA situation is bad, the "abandon the CAs and come up with an interim plan" solution is worse. Meanwhile, the world in which most of the mainstream browsers support TACK is imperfect, but immediately better than what we have now. TACK also sets us up to continue decoupling ourselves from the CA system.

Nobody has to abandon CAs just because a new model is adopted. It's not like the old infrastructure will stop working (as long as there's a free market)

Pre-loaded public key pinning shipped by modern browsers is a better way forward IMHO. If you're trusting your browser enough to run their software, you might as well get your public keys from them, too. IMO, TACK works about as well as self-signed certs with the 'remember this certificate' option - just don't use a Starbucks connection the first time you browse the site.

Re: A Saudi Arabia Telecom's Surveillance Pitch

#48

Post by josh2600 »

ck2 wrote: post #14

I suddenly had a realization why someday in the future everyone is going to want their own personal satellite. Government interception/manipulation (or any other party) would become rather difficult.

To be fair, is there anyone that doesn't want their own personal satellite? C'mon, that's pretty cool, right?

And I don't think owning a satellite makes your communications secure simply by virtue of owning a satellite. I'd argue that you'd need to own the methods of communication to and from the satellite, which probably isn't realistic.

Re: A Saudi Arabia Telecom's Surveillance Pitch

#49

Post by spindritf »

tptacek wrote: post #44
spindritf wrote: post #41

Earlier quoted context omitted.

> money buys technology I don't think it matters. He quickly noticed that the problem is cultural, that >> I’d much rather think about the question of exploit sales in terms of who we welcome to our conferences, who we choose to associate with, and who we choose to exclude, than in terms of legal regulations. I think the contextual shift we’ve seen over the past few years requires that we think critically about what’…

It is possible to believe both things at the same time: that dictatorships will inevitably acquire exploits, backdoors, and monitoring tools, and that it's unconscionable for companies to sell these things to dictatorships. The story is perhaps clearer on exploit markets. The alternative to markets is publication, which burns the vulnerability by hastening its patch deployment. Dictatorships will inevitably acquire m…

> dictatorships will inevitably acquire exploits

That's not what I mean. Even if you somehow stop them from acquiring exploits, they will remain in power because it's not derived from subtle technological advantages.

Re: A Saudi Arabia Telecom's Surveillance Pitch

#50

Post by tptacek »

peterwwillis wrote: post #47
tptacek wrote: post #30

Earlier quoted context omitted.

Yes, that is exactly what I am saying. The current CA situation is bad, the "abandon the CAs and come up with an interim plan" solution is worse. Meanwhile, the world in which most of the mainstream browsers support TACK is imperfect, but immediately better than what we have now. TACK also sets us up to continue decoupling ourselves from the CA system.

Nobody has to abandon CAs just because a new model is adopted. It's not like the old infrastructure will stop working (as long as there's a free market) Pre-loaded public key pinning shipped by modern browsers is a better way forward IMHO. If you're trusting your browser enough to run their software, you might as well get your public keys from them, too. IMO, TACK works about as well as self-signed certs with the 're…

No, that's not true. When you bring your laptop to Starbucks and deal with a site with self-signed certs, you're susceptible every time to that MITM attack; on the other hand, you're susceptible only the first time you connect to a site using TACK.
Post reply on HN