No SSL/TLS, great job. Well, I assume AES crypto wouldn't bother them anyway. ;) Because it wouldn't be smart to make standard crypto which would blind them.
FOIA the PRISM tech stack
21–30 of 30 posts
Re: FOIA the PRISM tech stack
#22Good chances they are using http://en.wikipedia.org/wiki/Apache_Accumulo
Do you have any specific reason to believe that?
Re: FOIA the PRISM tech stack
#23For all you PGP fanatics, consider (from http://33bits.org/2011/03/09/link-prediction-by-de-anonymiza..., a blog which I highly recommend) the sentence "During (...) 2007-2009, Shmatikov and I (...) showed how to take two graphs representing social networks and map the nodes to each other based on the graph structure alone—no usernames, no nothing."
Tinfoil won't save you this time.
Re: FOIA the PRISM tech stack
#24No SSL/TLS, great job. Well, I assume AES crypto wouldn't bother them anyway. ;) Because it wouldn't be smart to make standard crypto which would blind them.
If I remember correctly, Verisign has indicated they would be willing to create a trusted root level certificate for the government to spoof the ssl of any domain... so I don't know if SSL is enough, unless you only allow CAs you've created or you trust.
Re: FOIA the PRISM tech stack
#25I'm not sure what this is all about, but even though it is _my_ government, I feel like submitting this form would add me to some monitoring list.
So, sadly true. I was sending a friend an email today about this entire thing and for the first time ever I questioned whether my email would be eavesdropped on by my own government. It was a horrible feeling.
They don't need credibility, the chilling effects of knowing you are being watched are enough. You prevented yourself from actualizing your thought crime.
Re: FOIA the PRISM tech stack
#26I'm not sure what this is all about, but even though it is _my_ government, I feel like submitting this form would add me to some monitoring list.
Don't worry about it. Everyone's on the monitoring list.
The nice thing about exposing what was already "known" is now so many people are talking about it openly. It is hard for the wolves to attack so many moving targets. What we need is for hundreds to file very narrowly focused FOIA requests that do not probe too deeply. They need to be fulfillable.
Re: FOIA the PRISM tech stack
#27Unfortunately, despite the disturbing fact that we are reading about PRISM (disturbing both that it exists and that our government can't keep highly sensitive secrets), it is classified Top Secret until September 1, 2036. I could be wrong but I believe that FOIA requests regarding it will fail until then.
Or it was leaked on purpose to let everyone know that they should, "shut the fuck up." Or be watched?
Re: FOIA the PRISM tech stack
#28I just submitted the form and got the following error. Might be time to upgrade that ColdFusion formmail script, guys.
http://www.nsa.gov/applications/forms/foiaemail.cfm
Internal Server Error - Read
The server encountered an internal error or misconfiguration and was unable to complete your request. Reference #3.a447da3f.1370606557.3a7abfb
Re: FOIA the PRISM tech stack
#29I just submitted the form and got the following error. Might be time to upgrade that ColdFusion formmail script, guys. http://www.nsa.gov/applications/forms/foiaemail.cfm Internal Server Error - Read The server encountered an internal error or misconfiguration and was unable to complete your request. Reference #3.a447da3f.1370606557.3a7abfb
Also, they appear to be redirecting all HTTPS requests to HTTP. Try it: https://www.nsa.gov/public_info/foia/submit_foia_request/foi...
Configuration mistake or force of habit?
Re: FOIA the PRISM tech stack
#30Earlier quoted context omitted.
> disturbing both that it exists and that our government can't keep highly sensitive secrets Why could it be disturbing that a government's officials can't keep secrets about cases where they abuse their power or act against the public interest? Isn't that how democratic institutions are supposed to be designed?
It's disturbing because if things as sensitive as this are leaking, it means other things will leak that could cost lives.
You're assuming that all sensitive information has the same probability of leaking. Anecdotally, that's not really true. Most of these systems depend on honest citizens to keep the information secret, and honest citizens are more likely to leak "secret" evidence of abuse than information that will cost innocent people their lives.