Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

NSA veterans speak out on whistle-blower [video]

usatoday.com

Post reply on HN
Print view View original

71–80 of 85 posts

Re: NSA veterans speak out on whistle-blower [video]

#71

Post by glurgh »

einhverfr wrote: post #62
glurgh wrote: post #37

Earlier quoted context omitted.

Oh, agreed that it's quite unhelpful and Snowden revealing details about such activities is a pretty terrible idea. On the other hand, such revelations in general aren't all that new or rare - the most recent one probably being about US spying on UN diplomats just a couple of years ago. Beside light spattering of egg on some faces and a bit of ritualized indignant posturing, though, this sort of thing doesn't seem to…

First, I suspect that Snowden revealing these details is not that harmful. The fact is, I think everyone would expect that everyone keeps track of everyone's diplomats. That's just the way the world works. Additionally, hacking into network backbones in China? Is there anybody out there that was aware of the NSA's activities over the last few decades that doesn't immediately assume that they do? Or is this news to th…

Well, I think I already agreed in the post you're replying to that these sort of revelations are not particularly harmful to any of the state actors involved.

They are, though, tremendously harmful to him and his purported cause - to the point that I have a very difficult time seeing this as some part of an intelligent, well-considered strategy. Should he ever end up in a US court, any hope of lenient treatment or something like an eventual presidential commutation or pardon is well out the window - you can't be both a principled defender of civil liberties and a low-grade spy. Worse is the damage to his credibility as a person acting out of conscience - he's handing his detractors a complete gimme and even giving his potential supporters serious pause. In the interview linked, William Binney straight up calls him a traitor and it's pretty tough to portray William Binney as some pliant NSA stooge.

Re: NSA veterans speak out on whistle-blower [video]

#73

Post by hvidgaard »

einhverfr wrote: post #59
danso wrote: post #9

> Binney: Part of his job as the system administrator, he was to maintain the system. Keep the databases running. Keep the communications working. Keep the programs that were interrogating them operating. So that meant he was like a super-user. He could go on the network or go into any file or any system and change it or add to it or whatever, just to make sure — because he would be responsible to get it back up and…

Securing data against a systems administrator however is difficult on the best of days. I have done some of this for Efficito ( http://www.efficito.com ). Even with the best of care there are ways an administrator can get the info no matter what you do. All you really can do is restrict it to ensure that casual access is not an issue. For example, we store virtual machine root passwords in an encrypted database for l…

It comes down to physical access (in the sense as they can log into the box as root) - if you value security someone (single or "multiple person user") must be able to log in as root. Someone must be able to access the data hardware that contains the data, otherwise you'll might as well not store it and save the headache. Once you have admins with the ability to be root on the box, they can get the data. There is no way around it. What you can (and should do) is have access logs saved at least at one location where noone can delete anything. I suppose you could encrypt the data and save the key on a dedicated tamperproof box (are IBM still the main provider of these?), but someone must manage this box. Trust is inevitable, at best you can divide it in such a way that the combined entity is unlikely to go rogue.

Re: NSA veterans speak out on whistle-blower [video]

#74

Post by miles »

dfc wrote: post #35
miles wrote: post #32

Earlier quoted context omitted.

Thanks for your reply, dfc. Sorry if the draft deferral comment was inappropriate. I mainly wanted to contrast their experience and expertise in the field. BTW, thanks for the recommendation on your profile page to use dfcdfc as the topcolor; I stumbled onto it over a year ago and have been using it ever since.

No worries, more than anything the draft thing was distracting. It was superfluous and it took something away from the clearly reasoned point you were making. Added: I just saw bit about topcolor=dfcdfc. That brought some much needed levity to the discussion. You are good people miles.

You are good people miles

You too, dfc ;-)

Re: NSA veterans speak out on whistle-blower [video]

#75

Post by prollyignored »

einhverfr wrote: post #59
danso wrote: post #9

> Binney: Part of his job as the system administrator, he was to maintain the system. Keep the databases running. Keep the communications working. Keep the programs that were interrogating them operating. So that meant he was like a super-user. He could go on the network or go into any file or any system and change it or add to it or whatever, just to make sure — because he would be responsible to get it back up and…

Securing data against a systems administrator however is difficult on the best of days. I have done some of this for Efficito ( http://www.efficito.com ). Even with the best of care there are ways an administrator can get the info no matter what you do. All you really can do is restrict it to ensure that casual access is not an issue. For example, we store virtual machine root passwords in an encrypted database for l…

I am rolling on the floor and laughing so hard !

In my past threads, I have been trying to say how atrocious root user privileges are ! I was down-voted to oblivion.

Jesus Fucking Mary !

Downvote me you karma rich twats ! There click it, I can clearly see that you people deal in superlatives than obvious facts.

All I expected was some "Gee, I use Linux and I know how fucked up the super user is. He is a man of steel and piss ."

Re: NSA veterans speak out on whistle-blower [video]

#76

Post by dantheman »

nikcub wrote: post #28

I feel bad for Drake, he was facing federal charges and nobody seemed to notice. 89% of federal cases are plead before trial and of those that go to trial 90%+ are found guilty, that is how much the odds were stacked against him. He got nowhere near the attention that he deserves[1[] William Binney is an absolute hero. I have absorbed everything this guy has ever said or done[2]. He was not only employed at the NSA,…

His talk at HOPE 9 was great:

http://www.youtube.com/watch?v=hqN59beaFMI

Re: NSA veterans speak out on whistle-blower [video]

#77

Post by vidarh »

hvidgaard wrote: post #73
einhverfr wrote: post #59

Earlier quoted context omitted.

Securing data against a systems administrator however is difficult on the best of days. I have done some of this for Efficito ( http://www.efficito.com ). Even with the best of care there are ways an administrator can get the info no matter what you do. All you really can do is restrict it to ensure that casual access is not an issue. For example, we store virtual machine root passwords in an encrypted database for l…

It comes down to physical access (in the sense as they can log into the box as root) - if you value security someone (single or "multiple person user") must be able to log in as root. Someone must be able to access the data hardware that contains the data, otherwise you'll might as well not store it and save the headache. Once you have admins with the ability to be root on the box, they can get the data. There is no…

You hint at it: There are certainly ways to spread the trust. Require a physical key to allow root logins, and keep it in a monitored safe in the data centre. Require logs of who pulls the key, and entrust access to that physical key only to a separate group of people from those with the root passwords.

Of course the problem is that methods like this takes a lot of effort, and so it is a tradeoff between safety and the cost and convenience, and in reality very little data.

Re: NSA veterans speak out on whistle-blower [video]

#78

Post by einhverfr »

hvidgaard wrote: post #73
einhverfr wrote: post #59

Earlier quoted context omitted.

Securing data against a systems administrator however is difficult on the best of days. I have done some of this for Efficito ( http://www.efficito.com ). Even with the best of care there are ways an administrator can get the info no matter what you do. All you really can do is restrict it to ensure that casual access is not an issue. For example, we store virtual machine root passwords in an encrypted database for l…

It comes down to physical access (in the sense as they can log into the box as root) - if you value security someone (single or "multiple person user") must be able to log in as root. Someone must be able to access the data hardware that contains the data, otherwise you'll might as well not store it and save the headache. Once you have admins with the ability to be root on the box, they can get the data. There is no…

It's actually more complex than that. One of the things that really gets in the way of encrypted storage, when you think about it, is the reality that key management involves tradeoffs too. For example, we could divide things up that you could get the encryption key only on a separate system and so only a public key and the public key encrypted symmetric key are stored. In this model you only get either symmetric key-encrypted data, or the public key-encrypted symmetric key.

The problem though is that someone still has to have the right to rotate keys and this process can be attacked too. For example, one could rotate keys to a known value thus giving the attacker access to the plain text. Worse, the person who can rotate the keys has to have the right to access both old and new keys in an unencrypted state.

Now, given that reality, it isn't clear to me that the fact that someone could set up the database to log all queries, and allowing passphrases for encryption to be passed in in the query poses a real added danger.

Another option is just not to allow key rotation but that allows for attacks on the key itself. You can get aroudn this by having a different key for each piece of data and thus limit the utility of cracking each piece.

However if you go that route, then you have two computers to secure instead of one, and it is vulnerable to more types of attacks than before since you are now trusting the client.....

Re: NSA veterans speak out on whistle-blower [video]

#79

Post by mtgx »

nikcub wrote: post #28

I feel bad for Drake, he was facing federal charges and nobody seemed to notice. 89% of federal cases are plead before trial and of those that go to trial 90%+ are found guilty, that is how much the odds were stacked against him. He got nowhere near the attention that he deserves[1[] William Binney is an absolute hero. I have absorbed everything this guy has ever said or done[2]. He was not only employed at the NSA,…

This was a great talk by Binney, Drake and Jesselyn Radack, on whistleblowing and surveillance:

https://www.youtube.com/watch?v=XDM3MqHln8U

Re: NSA veterans speak out on whistle-blower [video]

#80

Post by Zakharov »

einhverfr wrote: post #59
danso wrote: post #9

> Binney: Part of his job as the system administrator, he was to maintain the system. Keep the databases running. Keep the communications working. Keep the programs that were interrogating them operating. So that meant he was like a super-user. He could go on the network or go into any file or any system and change it or add to it or whatever, just to make sure — because he would be responsible to get it back up and…

Securing data against a systems administrator however is difficult on the best of days. I have done some of this for Efficito ( http://www.efficito.com ). Even with the best of care there are ways an administrator can get the info no matter what you do. All you really can do is restrict it to ensure that casual access is not an issue. For example, we store virtual machine root passwords in an encrypted database for l…

Just a spur of the moment thought, but can you encrypt the master password such that you need passwords from three of four (or any N of M) people to decrypt it?
Post reply on HN