Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Asking the U.S. to allow Google to publish more national security request data

googleblog.blogspot.com

Post reply on HN
Print view View original

51–60 of 189 posts

Re: Asking the U.S. to allow Google to publish more national security request data

#51

Post by yid »

tptacek wrote: post #35
haberman wrote: post #30

Earlier quoted context omitted.

Just to clarify, I think you are irritated with the inaccurate/sensationalist reporting of PRISM, and not that it was leaked to begin with?

My perspective on this is going to sound weird to you. 1. I am very irritated at inaccurate and sensationalized reporting. 2. I think the USG should have been much more open and forthcoming, at least in the aggregate, about how foreign signals intelligence was coming into contact with online services used mostly by citizens. 3. I think leaking details of signals intelligence programs should be a crime. 4. I hope Goog…

> 3. I think leaking details of signals intelligence programs should be a crime.

This one surprised me. Wouldn't the strongest signals intelligence program be one that doesn't need to depend on obfuscation?

Re: Asking the U.S. to allow Google to publish more national security request data

#52

Post by rdl »

mpyne wrote: post #44
rdl wrote: post #19

Earlier quoted context omitted.

1. Google probably should offer passive S/MIME on mail. START TLS goes a long way, but providing the same signals about message authenticity to people who IMAP from gmail as who use the web UI would be nice. A non-google-trusting way to do PGP with a better UI/UX would also be a nice feature for gmail. Just indicating "encrypted" at the message-list view or something. I have PGP working quite nicely in mutt, but a lo…

Everytime I think about the S/MIME and PGP issue I can't get away from the fact that you need to give your private key to the client-side JS. I'm not sure we've found all the security flaws we'll find in the browser JS model so that just seems risky to me (especially for digital signature purposes). And as you mention, you would still have to trust Google.

W3C webcrypto, done in a smart way, is probably one of the most critical pieces of security infrastructure to be built today.

I'm not talking about giving the real PGP or S/MIME to Google; just a UI flag saying "this message has special content, click here to download". And some kind of low-assurance S/MIME signature which just says "was downloaded from gmail" to protect from local modification. I'm not sure how mail clients deal with multiple s/mime signatures (or s/mime + PGP inside).

Re: Asking the U.S. to allow Google to publish more national security request data

#53

Post by tptacek »

rdl wrote: post #52
mpyne wrote: post #44

Earlier quoted context omitted.

Everytime I think about the S/MIME and PGP issue I can't get away from the fact that you need to give your private key to the client-side JS. I'm not sure we've found all the security flaws we'll find in the browser JS model so that just seems risky to me (especially for digital signature purposes). And as you mention, you would still have to trust Google.

W3C webcrypto, done in a smart way, is probably one of the most critical pieces of security infrastructure to be built today. I'm not talking about giving the real PGP or S/MIME to Google; just a UI flag saying "this message has special content, click here to download". And some kind of low-assurance S/MIME signature which just says "was downloaded from gmail" to protect from local modification. I'm not sure how mail…

It's not being done in a particularly smart way; Web Crypto has more to do with enabling pure-web plugin-free streaming media than with enabling secure browser-based PGP.

Re: Asking the U.S. to allow Google to publish more national security request data

#54

Post by tptacek »

haberman wrote: post #49
tptacek wrote: post #35

Earlier quoted context omitted.

My perspective on this is going to sound weird to you. 1. I am very irritated at inaccurate and sensationalized reporting. 2. I think the USG should have been much more open and forthcoming, at least in the aggregate, about how foreign signals intelligence was coming into contact with online services used mostly by citizens. 3. I think leaking details of signals intelligence programs should be a crime. 4. I hope Goog…

I agree with your perspective, with the exception of a slight modification to #3. I believe that leaking should be a crime, but I also believe that if the court of public opinion judges the original secret worse than the leak, that it should become politically out-of-bounds to actually prosecute the case. I think there's a world of difference between Bradley Manning and Edward Snowden. And while I think Manning's tre…

I don't know enough about what happened with Snowden to have an opinion about him one way or another; I'm just not of the opinion that leaks are by default heroic.

Re: Asking the U.S. to allow Google to publish more national security request data

#55

Post by anon1385 »

youngerdryas wrote: post #27
jlgreco wrote: post #17

Earlier quoted context omitted.

You really love that phrase, don't you? I'm sure in other communities it is a great way to marginalize those with interests that you do not share.

I really doubt Google is going to play chicken about something so serious as giving away all their user data. Is it incomprehensible to you that they are telling the truth?

The problem Google has is that a huge number of their users -- those in foreign countries -- have (finally) realised what has been public knowledge for years: they have no legal protection at all from the US government examining data Google holds about them and that Google readily comply with such requests and aren't really in a position to do much else. 'Telling the truth' involves restating this truth in the full glare of worldwide publicity. The more they try to reassure americans that everything they did was 'legal'[1] and only targeted foreigners, the more foreigners they alienate.

So from a PR perspective I don't see how Google can fix this unless US law substantially changes (or they employ crypto on the users side but that undermines the economics of much of their business).

[1] I'm not convinced that it is legal under EU data protection law and Google does have a presence in the EU, but I'm no lawyer.

Re: Asking the U.S. to allow Google to publish more national security request data

#56

Post by kllrnohj »

ben_pr wrote: post #24

The issue here is that Google doesn't know how much data the NSA collects. The NSA has access to the internet backbone that Google uses and can read whatever traffic it wishes that leaves the Google network. Obviously this is not everything but most everything. It is a low view of the NSA to think that they do not have the ability to real-time decrypt SSL certs from every major SSL cert authority. So while Google can…

> It is a low view of the NSA to think that they do not have the ability to real-time decrypt SSL certs from every major SSL cert authority.

For most SSL certs this is probably true, but Google uses perfect forward secrecy which makes this very unlikely if not damn near impossible: http://googleonlinesecurity.blogspot.com/2011/11/protecting-...

Re: Asking the U.S. to allow Google to publish more national security request data

#57

Post by tptacek »

jlgreco wrote: post #37
tptacek wrote: post #31

Earlier quoted context omitted.

You're suggesting that the idea of Google as a tool for the NSA is a marginal interest on HN?

No, I am talking about much less specific interests, as his use of the phrase is similarly broad. Nor does his attempt to marginalize an interest imply that the interest is marginalized on HN. It concerns me that you are so eager to misread others' comments, and defend comments that contain no substance, only name-calling.

What does it mean that it "concerns you"?

Re: Asking the U.S. to allow Google to publish more national security request data

#58

Post by jmillikin »

ben_pr wrote: post #24

The issue here is that Google doesn't know how much data the NSA collects. The NSA has access to the internet backbone that Google uses and can read whatever traffic it wishes that leaves the Google network. Obviously this is not everything but most everything. It is a low view of the NSA to think that they do not have the ability to real-time decrypt SSL certs from every major SSL cert authority. So while Google can…

  > It is a low view of the NSA to think that they do not
  > have the ability to real-time decrypt SSL certs from
  > every major SSL cert authority.
The technology required to break SSL is sufficiently advanced that any organization possessing it would probably have easier ways to collect data, all of which would grossly outmatch all known security precautions. There would be no need for any of these sneaking-around stuff because breaking SSL is an instant win condition.

Re: Asking the U.S. to allow Google to publish more national security request data

#59

Post by rdl »

tptacek wrote: post #53
rdl wrote: post #52

Earlier quoted context omitted.

W3C webcrypto, done in a smart way, is probably one of the most critical pieces of security infrastructure to be built today. I'm not talking about giving the real PGP or S/MIME to Google; just a UI flag saying "this message has special content, click here to download". And some kind of low-assurance S/MIME signature which just says "was downloaded from gmail" to protect from local modification. I'm not sure how mail…

It's not being done in a particularly smart way; Web Crypto has more to do with enabling pure-web plugin-free streaming media than with enabling secure browser-based PGP.

Presumably all it would take would be Google, Apple, or even Mozilla to do something more real on their own. I'd probably bet on the Chrome doing it more than anyone else.

Re: Asking the U.S. to allow Google to publish more national security request data

#60

Post by jlgreco »

tptacek wrote: post #57
jlgreco wrote: post #37

Earlier quoted context omitted.

No, I am talking about much less specific interests, as his use of the phrase is similarly broad. Nor does his attempt to marginalize an interest imply that the interest is marginalized on HN. It concerns me that you are so eager to misread others' comments, and defend comments that contain no substance, only name-calling.

What does it mean that it "concerns you"?

What kind of comment is that? What do you think it means?

I'll give you a hint and tell you one of the things it doesn't mean. It doesn't mean "surprises me".

Post reply on HN