Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

PRISM fears give private search engine DuckDuckGo its best week ever

venturebeat.com

Post reply on HN
Print view View original

191–200 of 213 posts

Re: PRISM fears give private search engine DuckDuckGo its best week ever

#191

Post by dredmorbius »

brvs wrote: post #122
bigiain wrote: post #116

Earlier quoted context omitted.

Why do you trust any binaries you've got? Where did your first-use/bootstrapping compiler come from? And even if you wrote your own OS and compiler from the ground up - who wrote your BIOS? Your network card firmware? Your disk controller software? Your CPU microcode? We _all_ abdicate our trust-chain _somewhere_

This is why it's important to look at PRISM as a political issue and not merely a technical one, like I see a ton of people doing now. The best solution to government spying isn't to tell everyone to use Linux and DuckDuckGo, it's to change the spying itself.

There's no reason you can't apply both tactics.

Shifting use away from, as Bruce Schneier puts it, feudal architectures, both puts the Government on notice that its methods aren't appreciated, and creates a damaged class (the SAAS feudal lords: Google, Facebook, AWS, Apple, Salesforce, and others) who can petition the government to lay off the tactics as it's hurting business. https://www.schneier.com/blog/archives/2013/06/more_on_feuda...

Hell, push this hard enough and a sufficiently feasible decentralized VOIP might become sufficiently common enough to put the WiFi carriers out of the voice business, relegated to carrying encrypted bits. They might know your handset location, your data usage, and the Tor entry point you're using, but that's it. It's something I've been giving though to.

Re: PRISM fears give private search engine DuckDuckGo its best week ever

#192

Post by dredmorbius »

diminoten wrote: post #92
paulsutter wrote: post #56

It's not safe to assume the NSA doesn't log DDG searches. Look at the PRISM logo - it's a beam splitter. Read the slide, look at the "Upstream" portion. http://commons.wikimedia.org/wiki/File:Upstream_slide_of_the... They're logging all your URLs and headers. How much are you willing to bet they can't decrypt https? I dont understand all the hubbub _is focused solely_ on direct server access (the bottom half of the s…

Spoiler alert: They can't decrypt it. That's why they have to ask these companies for the info, rather than just take it from the ISPs.

It could just as easily come down to simple costs.

If it's less expensive to ask someone to hand over the data (in bulk) rather than burn CPU cycles cracking SSL (again: in bulk), then go for it.

Even if it's feasible to crack SSL for a few crucial messages, it's likely not so for the volumes of data the NSA are capturing.

Re: PRISM fears give private search engine DuckDuckGo its best week ever

#193

Post by cLeEOGPw »

oinksoft wrote: post #13

I ceased using Google search except as a last resort when this story broke, and I had no idea what I had been missing out on with DDG: Excellent keyboard navigation . Also, DDG's results compared to a year ago are night-and-day. It seems to listen to my keywords better than Google did too, a growing annoyance I had. If you haven't, you really should try out DDG for a week.

I started using DDG few days ago and I am not disappointed so far.

Re: PRISM fears give private search engine DuckDuckGo its best week ever

#194

Post by Sprint »

SilasX wrote: post #160
bigiain wrote: post #141

Earlier quoted context omitted.

And here's the problem. Email needs to be able to be read by the recipient, so until a significant portion of email recipients can handle encrypted mail - the NSA doesn't need to attack my encrypted email storage, because enough of my correspondence ends up in cleartext in gmail/hotmail/yahoo et al. This is a hard one to solve. GPGmail seems to get broken with every Mac Mail.app release. Vast numbers of people rely o…

Hm, should be easy enough to have some browser plugin that lets you select a text/data field and recipient list field and encrypt it with the appropriate key; and to do something similar for recognition and decryption of fields. If I implement this, will I become famous?

There was FireGPG but it was discontinued http://blog.getfiregpg.org/2010/06/07/firegpg-discontinued/

Re: PRISM fears give private search engine DuckDuckGo its best week ever

#195

Post by wisty »

sirclueless wrote: post #145
icebraining wrote: post #139

Earlier quoted context omitted.

OTOH, if they can get a CA - any CA - to cooperate, they can MITM anyone without having to break SSL.

Not without someone noticing. Some sites have pinned certs in Chrome, which would stop this, and even without that you would expect some knowledgeable techie at Facebook or Github or something to be using their home laptop and say, "Wait a sec, this isn't my company's public cert!" Not having seen any blog posts screaming, "OMG, my site is being hijacked wholesale," I can only assume that the NSA isn't doing this (or…

Could they do this selectively, and only MITM people on watchlists?

Re: PRISM fears give private search engine DuckDuckGo its best week ever

#196

Post by jrockway »

mh- wrote: post #190
lessnonymous wrote: post #178

Earlier quoted context omitted.

Do they need to MITM? If they have a copy of the private key, can't they just use it to decrypt the data .. even old data for which they've only just acquired the key?

to your latter question: no, not with the right ciphers. http://en.wikipedia.org/wiki/Perfect_forward_secrecy

Perfect forward secrecy doesn't apply if the NSA has broken the key exchange algorithm and has your session keys.

Re: PRISM fears give private search engine DuckDuckGo its best week ever

#197

Post by dlib »

krek wrote: post #177
stephen_g wrote: post #174

Earlier quoted context omitted.

This has been talked about many times now. All compromising a CA lets them do is to create believable certificates to be able to man in the middle connections, but they can't be doing that for a large number of connections because it's resource intensive and detectable. They still don't have the private keys of the sites if they break into the CA.

What are the odds that Google, Yahoo, et al. handed over their private keys, I wonder.

I find this quite plausible, with or without the knowledge of Page, Zuckerberg et al. the NSA might very well have the private keys of these companies. I would not be surprised if the CEO's of these companies choose to be ignorant of the NSA's methods to not have to lie to the public, shareholds and Congress.

Also, given that the world's best engineers work at either high-tech companies or the NSA there will be some who have switched between these industries, giving the NSA/CIA a headstart to get any information these companies hold through old-fashioned spy-tactics.

Re: PRISM fears give private search engine DuckDuckGo its best week ever

#198

Post by jerf »

abrichr wrote: post #169
jerf wrote: post #94

Earlier quoted context omitted.

"How much are you willing to bet they can't decrypt https?" I'd bet quite a bit, though not "my life", that they do not have a generalized "read everything" ability for all forms of SSL. They may have what cryptographers would call "a crack", but that's a low bar, and doesn't prove they have a practical attack. However, DDG is currently using 128-bit RC4, which is very weak. [1] I wouldn't care to bet anything that t…

Thanks for the link, that was an awesome article. Well written and technically substantial. How did you come across it?

I googled for something like "rc4 weak crack" or something like that. I was just trying to substantiate the claim that RC4 is weak.

Re: PRISM fears give private search engine DuckDuckGo its best week ever

#199

Post by uh_oh »

samstave wrote: post #184
leoc wrote: post #163

Earlier quoted context omitted.

If Bill Binney said that, and if he is right, I'd assume the most likely explanation is that NSA can push over some low-security SSL connections of the type jerf describes above https://news.ycombinator.com/item?id=5877362 , but has to rely on "direct access" to get around most or all high-quality (but still widely-used) SSL encryption. (Or, again, that it also has the capacity to break high-grade HTTPS connections,…

With the history of the gov/NSA being effective crypto gods - my money is they are ahead of decrypting SSL and HTTPS and even of it is not real-time, they store streams from target end points regularly for slower offline decrypt.

I wonder why so many people believe this. Many simple and weak ciphers have been around for decades and - although they are considered to be very insecure by cryptographers - certainly can't be decrypted in real-time (!) on this scale (!).

Re: PRISM fears give private search engine DuckDuckGo its best week ever

#200

Post by ausjke »

I tried duckduckgo and it did not work as well as google, yet.

I especially dislike its name, it's odd and too long to type, and again, duck 'walks' slowly, not a good sign.

can this be renamed to something better, and shorter? sometimes name does matter.

Post reply on HN