101–107 of 107 posts
one thing crossed my mind : could the fact that this things blows up right when china's president is coming to the US to talk about cyber espionage and individual liberties be a coincidence ?
His comments are actually the most insightful points I've seen about the discussion regarding PRISM: I have my own suspicions -- which I won't go into here -- about what PRISM was actually about. I'll just say that there are ways to intercept people's Google, Facebook, etc., traffic in bulk without sticking any moles into the org -- or directly tapping their lines. You may find some interesting hints in the leaked PR…
Here's a much simpler explanation: The Feds submit a FISA order for specific data collection. The companies' lawyers approve it. Then the NSA has a convenient user interface for accessing that data (perhaps real-time?) somehow from the companies' servers (possibly through an intermediary). How else is this data being sent to Ft. Mead? Thumb drives via FedEx? The dates on the slides might be when a company has erected…
http://cdn.theatlantic.com/static/mt/assets/science/assets_c...
For only $20M/yr (which is nothing by government standards), I could definitely see that being a roadmap for building the user friendly endpoint to obtain the relatively small number of legally obtained records from each provider.
Earlier quoted context omitted.
Beam splitters (prisms?) inside the backbone providers. All traffic goes to its destination unharmed, but the NSA gets all the packets. SSL is harder, but all you need is the private keys. Those are hard to get but not impossible for someone with the resources of the government. This is the only scalable way to do what they are supposed to be doing and not involve lots of outsiders. Note that the people who have real…
Ok so they split and copy all the packets, nobody else is concerned with the complexity of tagging, filtering, rebuilding and contextualizing this conceptual volume of packet data? Beam splitters are not enough, they would need something to interpret this traffic. Something is missing here.
Earlier quoted context omitted.
I was clearly wrong. But I am still lost on how it would be detectable? From Google's end, some client just disconnected. From the client's end, the internet just got a tiny bit more latency.
If you had Google's certificate private key, you can pretend to be Google. It's undetectable from the user's perspective. I think we should trust Google to keep their private keys safe, although it would help a lot if the published in general terms how they accomplish this.
Really, I would think it would be easy for the NSA, etc to get an operative inside Google, FB etc and steal these. Intelligence organizations are very good at this after all..
Two things that cannot be true at the same time: this Google+ post, and the idea that Google coughed up their TLS keys to the government.
Only if you assumed he is fully informed. Do you think Google chief software architect would fall within "need to know", if Google had been ordered to hand over their SSL private keys? I doubt it.
Earlier quoted context omitted.
How are they getting the DH keys without cooperation from at least one of the SSL endpoints involved? They're newly generated at every SSL handshake, you can't just get a mole to hand you the keys once and be done with it. If you had the certificate private key, you could do a MITM, but this requires a LOT more resources and would be much more easily detectable.
I was clearly wrong. But I am still lost on how it would be detectable? From Google's end, some client just disconnected. From the client's end, the internet just got a tiny bit more latency.
Earlier quoted context omitted.
If you had Google's certificate private key, you can pretend to be Google. It's undetectable from the user's perspective. I think we should trust Google to keep their private keys safe, although it would help a lot if the published in general terms how they accomplish this.
The signing key for Gmail's certificate is a 1024-bit RSA key. That key size is simply not safe against an attacker like the NSA today, so we may as well assume they have the private key even if Google didn't voluntarily give it to them. But while the signing key may allow them to impersonate Google in some circumstances, it doesn't really help decrypting passively recorded TLS traffic to the real Google. For that, t…
