Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google Chief Architect: we only respond to specific orders about individuals

plus.google.com

Post reply on HN
Print view View original

61–70 of 107 posts

Re: Google Chief Architect: we only respond to specific orders about individuals

#61

Post by jcampbell1 »

kalmi10 wrote: post #52
jcampbell1 wrote: post #47

Earlier quoted context omitted.

This is exactly the conclusion I came to. My guess is they have the SSL/TLS keys. That being said, tptacek thinks we are wrong, and he is a subject matter expert, so I am not sure.

The linked quora answer (from the co-author of Firesheep) says that even in that case one can't launch a passive man in the middle attack if perfect forward secrecy is used. Google.com uses Diffie–Hellman key exchange which provides perfect forward secrecy. So... If I understand everything correctly, it should be impossible to decrypt passively captured HTTPS traffic to/from google.com. http://www.quora.com/SSL-Secur…

We are not disagreeing with anything he says. We are saying the NSA has the private key.

Ian Gallager: > so if you have the private key, you can decrypt that key, and then use it to decrypt the bulk-encrypted data.

Like he says, if you have the key, wireshark can decrypt the data trivially.

If you have the CA master keys, then the only thing you can do is perform a MITM attack, but not silently decrypt the raw data. A MITM attack would eventually get detected.

Re: Google Chief Architect: we only respond to specific orders about individuals

#62

Post by Dylan16807 »

jcampbell1 wrote: post #61
kalmi10 wrote: post #52

Earlier quoted context omitted.

The linked quora answer (from the co-author of Firesheep) says that even in that case one can't launch a passive man in the middle attack if perfect forward secrecy is used. Google.com uses Diffie–Hellman key exchange which provides perfect forward secrecy. So... If I understand everything correctly, it should be impossible to decrypt passively captured HTTPS traffic to/from google.com. http://www.quora.com/SSL-Secur…

We are not disagreeing with anything he says. We are saying the NSA has the private key. Ian Gallager: > so if you have the private key, you can decrypt that key, and then use it to decrypt the bulk-encrypted data. Like he says, if you have the key, wireshark can decrypt the data trivially. If you have the CA master keys, then the only thing you can do is perform a MITM attack, but not silently decrypt the raw data.…

Ephemeral Diffie-Hellman creates a new key per connection in a public-safe manner. You cannot eavesdrop on such a connection, even if you have the signing key. The question then becomes, are the SSL sessions actually using that mode.

Re: Google Chief Architect: we only respond to specific orders about individuals

#63

Post by saalweachter »

icambron wrote: post #30

This denial is a lot stronger than Page's, which was full of weasel words. Unless Zunger is just lying, which somehow seems unlikely (forgive my naiveté), it'll be interesting to know how PRISM actually works. But I will say that his faith in his company sounds misplaced, since Google's more official denials are so weak. edit: clarity

He hints at a couple of reasons for his confidence in his post.

One of his assumptions was that people would notice surreptitiously installed hardware or software doing the monitoring. I don't think this is unreasonable. Hoovering up all the private data in Google is bound to be a big job, regardless of whether you are sieving it on site or transferring it off site. Even if it would only take a few people to install and manage, everyone else would probably be tripping over it constantly. Accessing all of Google's data means you'd be tied into nearly every system.

It's possible to keep projects secret inside a large company like Google, but only if an exceedingly few number of people know about it, and have good reasons to not tell anyone else. A system with as much surface area as you'd probably need to hoover off all of Google's data would be vulnerable to almost every engineer and datacenter worker accidentally running across while debugging other problems. Even -- especially? -- if they didn't realize the significance of it immediately, they'd probably ask their coworkers about this weird extra code/jobs/hardware, and pretty soon everyone would have heard about it. Once everyone inside of Google had heard of it, I think you'd have a very hard time keeping the secret from leaking into the outside world.

Re: Google Chief Architect: we only respond to specific orders about individuals

#64

Post by [deleted] »

ihsw wrote: post #41
jmgao wrote: post #39

Earlier quoted context omitted.

A target's phone call, e-mail or chat will take the cheapest path, not the physically most direct path - you can't always predict the path Dates When PRISM Collection Began For Each Provider This is complete conjecture, but this reads to me like the NSA set up its own backhauls and set up peering agreements at artifically low prices to get traffic going over their pipes. Is there historical data for route announcemen…

This is expounded upon in some news articles, particularly that data is routed not by the most efficient geographic route but by the cheapest by dollar price. It's a very important tidbit of information that divulges the heart of the matter -- the NSA is a backbone operator[1]. It's a tall claim to make, however their involvement in internet exchange points (and other regional network access points) would be far more…

[deleted]

Re: Google Chief Architect: we only respond to specific orders about individuals

#65

Post by jcampbell1 »

Dylan16807 wrote: post #62
jcampbell1 wrote: post #61

Earlier quoted context omitted.

We are not disagreeing with anything he says. We are saying the NSA has the private key. Ian Gallager: > so if you have the private key, you can decrypt that key, and then use it to decrypt the bulk-encrypted data. Like he says, if you have the key, wireshark can decrypt the data trivially. If you have the CA master keys, then the only thing you can do is perform a MITM attack, but not silently decrypt the raw data.…

Ephemeral Diffie-Hellman creates a new key per connection in a public-safe manner. You cannot eavesdrop on such a connection, even if you have the signing key. The question then becomes, are the SSL sessions actually using that mode.

> Ephemeral Diffie-Hellman creates a new key per connection in a public-safe manner.

How does that make a difference when you have the Diffie-Hellman key? We are saying they have the Diffie-Hellman keys, not the signing keys, nor the block cipher key that is exchanged. They have the only key that matters.

Re: Google Chief Architect: we only respond to specific orders about individuals

#66

Post by bdonlan »

jcampbell1 wrote: post #65
Dylan16807 wrote: post #62

Earlier quoted context omitted.

Ephemeral Diffie-Hellman creates a new key per connection in a public-safe manner. You cannot eavesdrop on such a connection, even if you have the signing key. The question then becomes, are the SSL sessions actually using that mode.

> Ephemeral Diffie-Hellman creates a new key per connection in a public-safe manner. How does that make a difference when you have the Diffie-Hellman key? We are saying they have the Diffie-Hellman keys, not the signing keys, nor the block cipher key that is exchanged. They have the only key that matters.

How are they getting the DH keys without cooperation from at least one of the SSL endpoints involved? They're newly generated at every SSL handshake, you can't just get a mole to hand you the keys once and be done with it. If you had the certificate private key, you could do a MITM, but this requires a LOT more resources and would be much more easily detectable.

Re: Google Chief Architect: we only respond to specific orders about individuals

#67

Post by zaroth »

herf wrote: post #59
kalmi10 wrote: post #52

Earlier quoted context omitted.

The linked quora answer (from the co-author of Firesheep) says that even in that case one can't launch a passive man in the middle attack if perfect forward secrecy is used. Google.com uses Diffie–Hellman key exchange which provides perfect forward secrecy. So... If I understand everything correctly, it should be impossible to decrypt passively captured HTTPS traffic to/from google.com. http://www.quora.com/SSL-Secur…

actually everyone seems to have switched to the "fast" SSL ciphers instead - only dropbox defaults to DHE: > openssl s_client -connect google.com:443 RC4-SHA > openssl s_client -connect dropbox.com:443 DHE-RSA-AES256-SHA Again, this is usually done for speed, but all of the companies on the list are using "fast" SSL/TLS ciphers rather than more secure ones.

Thanks for this. "Dropbox coming soon" indeed.

Re: Google Chief Architect: we only respond to specific orders about individuals

#68

Post by kalmi10 »

herf wrote: post #59
kalmi10 wrote: post #52

Earlier quoted context omitted.

The linked quora answer (from the co-author of Firesheep) says that even in that case one can't launch a passive man in the middle attack if perfect forward secrecy is used. Google.com uses Diffie–Hellman key exchange which provides perfect forward secrecy. So... If I understand everything correctly, it should be impossible to decrypt passively captured HTTPS traffic to/from google.com. http://www.quora.com/SSL-Secur…

actually everyone seems to have switched to the "fast" SSL ciphers instead - only dropbox defaults to DHE: > openssl s_client -connect google.com:443 RC4-SHA > openssl s_client -connect dropbox.com:443 DHE-RSA-AES256-SHA Again, this is usually done for speed, but all of the companies on the list are using "fast" SSL/TLS ciphers rather than more secure ones.

I not really an expert in this at all, but we were not discussing ciphers, but key exchange methods.

I open google.com in Chrome, click on lockpad icon, go to the second tab, and it says: Key exchange method: ECDHE_ECDSA

Some googling turns up that: "ECDHE-ECDSA provide perfect forward secrecy" http://nmav.gnutls.org/2011/12/price-to-pay-for-perfect-forw...

Re: Google Chief Architect: we only respond to specific orders about individuals

#69

Post by jcrites »

I'd really like to know whether Google shared its SSL/TLS certificates with government agencies. I asked the author (Yonatan Zunger) a short question and he replied to say he doesn't know anything. I followed up with:

> It seems you care very much about user privacy:

>> I would no longer be working at Google [but for] the fact that we do stand up for individual users' privacy

> Will you be willing to find out whether Google has shared its SSL/TLS keys for public sites with government agencies? As a person interested in user privacy, I imagine this will be as of much interest as whether they have direct access to the data.

> As you mentioned, direct access would require Google to build something. Intercepting SSL/TLS traffic would not.

> If Google shared its SSL keys, then the NSA can intercept all inbound and outbound traffic, and would be able to capture virtually all Google user data. They can store the data and search it. They wouldn't particularly even benefit from direct access to Google's data, if they're planning to store it themselves anyway.

> I would be great to hear an affirmation from Google that it has not shared its encryption keys with governments.

I can't figure out how to link to my comment, but it appears in the comments on Yonatan Zunger's post. (See original post)

Re: Google Chief Architect: we only respond to specific orders about individuals

#70

Post by lifeguard »

"might have also denied knowledge of the full scope of cooperation with national security officials because employees whose job it is to comply with FISA requests are not allowed to discuss the details even with others at the company" http://www.nytimes.com/2013/06/08/technology/tech-companies-...

Welcome to evil google team. It was nice knowing you. You will not miss me, but good bye.

Post reply on HN