Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A Saudi Arabia Telecom's Surveillance Pitch

thoughtcrime.org

Post reply on HN
Print view View original

61–70 of 115 posts

Re: A Saudi Arabia Telecom's Surveillance Pitch

#61

Post by tptacek »

throwaway2048 wrote: post #54
tptacek wrote: post #17

Earlier quoted context omitted.

This boils down to a semantic disagreement. You say people "trust" CAs because they don't know or care about them. I say that to "trust" a CA, you have to know what one is, and nobody who knows what a CA is trusts them anymore. The distinction between these two vantage points isn't particularly relevant to my point; at least, I don't think it is.

The difference is explicit and implicit trust. Even if you explicitly distrust CAs, almost everything on your system implicitly trusts them.

Sure, that's a good way to put it, and I'm obviously aware of this, but it's not the point I'm making. :)

Re: A Saudi Arabia Telecom's Surveillance Pitch

#62

Post by spindritf »

droopyEyelids wrote: post #56
spindritf wrote: post #49

Earlier quoted context omitted.

> dictatorships will inevitably acquire exploits That's not what I mean. Even if you somehow stop them from acquiring exploits, they will remain in power because it's not derived from subtle technological advantages.

If the technological advantages do not help them stay in power, why do you think they would pursue them? And what 'advantage' would they be?

Why do people eat themselves into morbid obesity? Why did soviets reverse rivers? Why are American prosecutors trying to jail kids for sexting?

Is eating not obviously beneficial? Is there something wrong with large-scale engineering? Shouldn't we fight child pornography?

Drives, rules, and organisations outlive and outgrow their usefulness all the time. Why would surveillance be an exception?

Re: A Saudi Arabia Telecom's Surveillance Pitch

#63

Post by tptacek »

ComputerGuru wrote: post #55
moxie wrote: post #24

Earlier quoted context omitted.

In this case I was mostly referring to the inclusion of certificate pinning (ex: https://github.com/moxie0/AndroidPinning ) in the mobile apps, which would theoretically prevent them from using a UAE or Saudi controlled CA to do the interception. In addition to iOS and Android, we also refused to compromise with low-end platforms like MediaTek, and made sure those clients were also all-TLS and that they employed cert…

If you really want the world to be a more secure place, can I please ask that you relicense the AndroidPinning code as BSD or something less viral than GPLv3? I don't see Instagram, Facebook, etc. using that code to secure their apps, they won't license their Android clients as GPLv3 just to use the Android pinning library. While it is easy enough to re-create your code (though I have not looked at it), given that we…

If he hadn't taken the time to publish this code, you wouldn't have even known to try to zing him for using the "wrong" license. Perhaps the most rational solution for people like Moxie would simply be to never publish their code, and simply continue to write forcefully and effectively about technical controls and privacy.

Then they wouldn't have to jump through silly hoops to prove whether they "really want the world to be a more secure place".

Or, how about this: if you really want the world to be a more secure place, why don't you take the time to learn how to implement certificate pinning for Android apps and publish your own MIT-licensed implementation? I'm sure Moxie would join the rest of us in cheering you on.

Re: A Saudi Arabia Telecom's Surveillance Pitch

#64

Post by ianlevesque »

tedks wrote: post #60
ComputerGuru wrote: post #55

Earlier quoted context omitted.

If you really want the world to be a more secure place, can I please ask that you relicense the AndroidPinning code as BSD or something less viral than GPLv3? I don't see Instagram, Facebook, etc. using that code to secure their apps, they won't license their Android clients as GPLv3 just to use the Android pinning library. While it is easy enough to re-create your code (though I have not looked at it), given that we…

From the README: >Please contact me if this license doesn't work for you. I see no reason why Moxie should give Facebook and Instagram this valuable feature for free. When did open-source hackers become the unpaid laborers for silicon valley? If they want it, they can either release the source code for their applications and liberate their users, or they can pay (hopefully) through the nose for it. Maybe that'll buy…

Facebook or Instagram will just reimplement it themselves if they care. Smaller developers will just remain insecure. GPLv3 harms adoption of something like this.

Re: A Saudi Arabia Telecom's Surveillance Pitch

#65

Post by moxie »

spindritf wrote: post #49
tptacek wrote: post #44

Earlier quoted context omitted.

It is possible to believe both things at the same time: that dictatorships will inevitably acquire exploits, backdoors, and monitoring tools, and that it's unconscionable for companies to sell these things to dictatorships. The story is perhaps clearer on exploit markets. The alternative to markets is publication, which burns the vulnerability by hastening its patch deployment. Dictatorships will inevitably acquire m…

> dictatorships will inevitably acquire exploits That's not what I mean. Even if you somehow stop them from acquiring exploits, they will remain in power because it's not derived from subtle technological advantages.

Perhaps the way to phrase it is that the soviet surveillance apparatus was an expression of power, just as the modern technological surveillance apparatus is an expression of modern power.

I think that this stuff matters, to the extent that I'd like to be in solidarity with those everywhere who are in a tension against authority. Not selling exploits is one small way that I can do that, and writing a blog post about it is one small contribution (I can hope) to creating a culture of doing that.

Re: A Saudi Arabia Telecom's Surveillance Pitch

#66

Post by tptacek »

ianlevesque wrote: post #64
tedks wrote: post #60

Earlier quoted context omitted.

From the README: >Please contact me if this license doesn't work for you. I see no reason why Moxie should give Facebook and Instagram this valuable feature for free. When did open-source hackers become the unpaid laborers for silicon valley? If they want it, they can either release the source code for their applications and liberate their users, or they can pay (hopefully) through the nose for it. Maybe that'll buy…

Facebook or Instagram will just reimplement it themselves if they care. Smaller developers will just remain insecure. GPLv3 harms adoption of something like this.

If you think that, go implement a MIT-licensed variant.

Re: A Saudi Arabia Telecom's Surveillance Pitch

#67

Post by ComputerGuru »

tptacek wrote: post #63
ComputerGuru wrote: post #55

Earlier quoted context omitted.

If you really want the world to be a more secure place, can I please ask that you relicense the AndroidPinning code as BSD or something less viral than GPLv3? I don't see Instagram, Facebook, etc. using that code to secure their apps, they won't license their Android clients as GPLv3 just to use the Android pinning library. While it is easy enough to re-create your code (though I have not looked at it), given that we…

If he hadn't taken the time to publish this code, you wouldn't have even known to try to zing him for using the "wrong" license. Perhaps the most rational solution for people like Moxie would simply be to never publish their code, and simply continue to write forcefully and effectively about technical controls and privacy. Then they wouldn't have to jump through silly hoops to prove whether they "really want the worl…

You don't have to be such an ass. I asked nicely enough.

I fully acknowledge Moxie is better at security than I ever will even dream of being. I just hoped he might see the value in releasing it under a more-amicable license. I don't have the numbers, but more-liberal licenses are by a wide margin the choice for open-source crypto.

I'm not speaking from the armchair, I've released open-source code under BSD/MIT myself. I don't have Moxie's skill for security, is it so wrong to point out the obstacle the license represents? He did release it to help secure the web, did he not? Why don't you let him reply.

Re: A Saudi Arabia Telecom's Surveillance Pitch

#68

Post by tomjen3 »

tptacek wrote: post #66
ianlevesque wrote: post #64

Earlier quoted context omitted.

Facebook or Instagram will just reimplement it themselves if they care. Smaller developers will just remain insecure. GPLv3 harms adoption of something like this.

If you think that, go implement a MIT-licensed variant.

Not that simple, you have often stated that normal programmers shouldn't be near security and now you are stating that they should go implement something that is specifically to enhance the security of the web.

The gp isn't asking for a change of license because he hate the GPL, he is (properly correctly) predicting what will happen if that license isn't changed: specifically, the thing that Moxie is trying to prevent won't be.

Re: A Saudi Arabia Telecom's Surveillance Pitch

#69

Post by tomjen3 »

tptacek wrote: post #32
luser001 wrote: post #12

I'm very curious what aspect of Twitter's TLS code makes hard to intercept whereas other websites can be easily intercepted? I'm also very curious about how they intercepted Whatsapp. Does it do something stupid like eval'ing code received over regular HTTP? Quoting the paragraph, in case my paraphrasing is inaccurate: "What’s depressing is that I could have easily helped them intercept basically all of the traffic t…

They pin the TLS certificate: to successfully create a connection to Twitter, their mobile apps will check not only the validity of the certificate the server presents, but also a hardcoded digest of the correct certificate, so that a "valid" certificate for Twitter from a CA Twitter has no relationship with will be rejected.

Wouldn't that break when they need to update the certificate, due to expiration?

Re: A Saudi Arabia Telecom's Surveillance Pitch

#70

Post by harshreality »

runjake wrote: post #6
tptacek wrote: post #4

Earlier quoted context omitted.

Nobody trusts CAs. There is a lot of work being done on layering more trustworthy authentication features on top of the TLS CA system, one good one being TACK: http://tack.io/draft.html The problem with simply abandoning CAs is that it creates a situation in which it's even easier for government sponsored agencies to mass-intercept traffic, at least for a window of time (probably several years), and all that window b…

> Nobody trusts CAs. No. The problem is that pretty much everyone trusts them, at this point in time. That was Peter's point. Sure, there are researchers and engineers who rightfully don't trust CAs. But we don't really matter. The users, the consumers, the parents, the grandparents, the activists do.

Everyone is forced to trust them by default because of liberal cert inclusion policies of browsers and other ssl-enabled software.

Ask some random people on the street if they trust a mainland Chinese entity with ensuring the security of their communication with their banks, however, and I think you'll get a different answer.

Post reply on HN