How Microsoft handed the NSA access to encrypted messages • Hacker News Board

Re: How Microsoft handed the NSA access to encrypted messages

#141

Post by nathan_long » Fri, Jul 12, 2013, 1:16 AM UTC

acqq wrote: post #103

tptacek wrote: post #92

Earlier quoted context omitted.

CALEA does NOT require Microsoft to provide decryptable communications services; in fact it ensures Microsoft can do exactly the opposite. http://paranoia.dubfire.net/2010/09/calea-and-encryption.htm...

A telecommunications carrier shall not be responsible for decrypting, or ensuring the government’s ability to decrypt, any communication encrypted by a subscriber or customer, unless the encryption was provided by the carrier and the carrier possesses the information necessary to decrypt the communication. Note " unless the encryption was provided by the carrier." Skype is the one that provides encryption here (a car…

Which is just a way of saying "we don't require you to do what you can't do." A truly good service would take advantage of that by ensuring they themselves have no access to the communications.

Re: How Microsoft handed the NSA access to encrypted messages

#142

Post by kvb » Fri, Jul 12, 2013, 1:59 AM UTC

mikelat wrote: post #104

mythz wrote: post #4

Marketing: "Your privacy is our priority." Meaning: "Microsoft and the FBI had come up with a solution that allowed the NSA to circumvent encryption on Outlook.com chats" "For Prism collection against Hotmail, Live, and Outlook.com emails will be unaffected because Prism collects this data prior to encryption." "analysts will no longer have to make a special request to SSO", "this new capability will result in a much…

I think the best part is that Microsoft has been bragging about how they care about privacy so much more than Google therefore you should use their products/services, and now they just got caught red handed doing the worst possible privacy violations in the book.

On the contrary, it's exactly that sort of characterization that I object to. How could complying with court orders be the "worst possible privacy violation"? I'm sympathetic to the argument that the orders are overbroad, or that Microsoft should have appealed the orders and hasn't opposed the orders as stubbornly as it could have (though of course we know very little about what has actually occurred along these lines). But why would responding to a court order be a worse privacy violation than selling information about my online behavior to other companies (in addition to also responding to court orders!)?

Re: How Microsoft handed the NSA access to encrypted messages

#143

Post by contingencies » Fri, Jul 12, 2013, 2:45 AM UTC

ceph_ wrote: post #135

HSO wrote: post #112

Earlier quoted context omitted.

my first link on bing: http://www.prweb.com/releases/class-action-lawsuit/google-ns...

Wow, almost all of the results of 'google nsa lawsuit' on bing are negative against google. http://www.bing.com/search?q=google+nsa+lawsuit 1) Maryland Attorney Mike Slocumb Comments on Google Privacy Class Action Lawsuit and NSA Surveillance Case (negative) 2) Google surveillance far surpasses the NSA, author says - CBS News (negative) 3) EPIC files FOIA request over reported Google, NSA partnership ... (negative) 4…

This information was brought to you by the Ministry of Truth division, MegaCorp-M. Have a fun, happy day, Consumer. And remember: relax, and don't think too much!

Re: How Microsoft handed the NSA access to encrypted messages

#144

Post by altcognito » Fri, Jul 12, 2013, 2:51 AM UTC

I'm going to purchase a subscription to the Guardian out of principal. I invite you all to do the same. This is absolutely fantastic work they've done.

Re: How Microsoft handed the NSA access to encrypted messages

#145

Post by [deleted] » Fri, Jul 12, 2013, 3:08 AM UTC

acqq wrote: post #103

tptacek wrote: post #92

Earlier quoted context omitted.

CALEA does NOT require Microsoft to provide decryptable communications services; in fact it ensures Microsoft can do exactly the opposite. http://paranoia.dubfire.net/2010/09/calea-and-encryption.htm...

A telecommunications carrier shall not be responsible for decrypting, or ensuring the government’s ability to decrypt, any communication encrypted by a subscriber or customer, unless the encryption was provided by the carrier and the carrier possesses the information necessary to decrypt the communication. Note " unless the encryption was provided by the carrier." Skype is the one that provides encryption here (a car…

[deleted]

Re: How Microsoft handed the NSA access to encrypted messages

#146

Post by grey-area » Fri, Jul 12, 2013, 4:14 AM UTC

forgotAgain wrote: post #58

ahlatimer wrote: post #36

Earlier quoted context omitted.

Do you think the government would jail someone of Steve Ballmer's stature if he talked openly about what the government has asked of Microsoft. Absolutely, but even if they didn't, if you were Steve Ballmer, would you take that risk? They certainly could prosecute you for leaking secret information. That's even assuming that Ballmer knew about it. It could have been that they approached people who were in some positi…

if you were Steve Ballmer, would you take that risk? They don't seem to mind taking risks when it comes to questionable tax deductions. They certainly could prosecute you for But they wouldn't. The type of activity the government is engaged in only works when people are passive. if you're served a lawful court order, you either obey it or risk the consequences, up to and including time in jail. When was the last time…

The former chairman of Quest started a six year sentence in 2009 for defying the NSA.

https://en.wikipedia.org/wiki/Joseph_Nacchio

They don't even have to prosecute you for not obeying a secret order, they can easily use some other law to put you away, especially given they have legal access to any communication about, from and to you. I choose to believe him rather than the NSA on the reasons for that prosecution.

I imagine that case had a sobering effect on anyone high up in these companies who was inclined to stand up to the NSA.

Re: How Microsoft handed the NSA access to encrypted messages

#147

Post by grey-area » Fri, Jul 12, 2013, 4:54 AM UTC

Microsoft: Your privacy is our Priority°.

This slogan now deserves to live on in infamy alongside other prominent examples of doublespeak, like Plays for Sure•, and Don't be evil°.

What concerns me in these responses from Microsoft is the distortion of the term lawful to include any request from the NSA. If you change the meaning of words like lawful, domestic and intercept, you can of course make anything legal in some sense, but distorting meanings like that is very dangerous, and using secret interpretations of it really damages our confidence and trust in the rule of law. That said I can't see any difference on this issue between MS and any other US tech giants, apart from Twitter, who are to be commended for staying out of this program. With the breaking of encryption on things like outlook chats and delivery in real time, it appears we simply can't trust any guarantees of privacy from these companies at all. Even if they did implement client-side encryption, they'd still feel obliged to break it for the NSA (and its many partners worldwide), so no offering from them is going to protect our privacy.

This was interesting too from one of the documents:

"enables our partners to see which selectors the National Security Agency has tasked to Prism...The FBI and CIA then can request a copy of Prism collection of any selector"

This indicates that any NSA PRISM search can be accessed by any one of these agencies, so once it is in the system, this information will spread widely. Given the guidelines on access of the NSA, that could include all foreign data being automatically available to any FBI or CIA agent. I wonder if they have any limits on access to 'foreign' data at all?

° As long as you're American, and not covered by a bulk court order by the NSA, and not encrypting anything, and not communicating outside the US, and don't have a 51% chance of communicating outside the US (what does that even mean?).

• No longer

Re: How Microsoft handed the NSA access to encrypted messages

#148

Post by Steko » Fri, Jul 12, 2013, 4:57 AM UTC

jlgreco wrote: post #140

Steko wrote: post #138

Earlier quoted context omitted.

It's pretty clear when an article has been flagged off the frontpage intentionally on hnrankings.info and in my experience every link of the type also "just happened" to be anti-google, pro-ms or pro-apple.

I have seen your links to hnrankings.info and cannot say that they make it clear flagging is the cause (much less organized flagging). Your (and others) assertions are too strong for the data that you have. With hnrankings.info I believe you could establish a trend (so far I have only seen specific handpicked examples, not a trend. A trend is probably there, but nobody that I have seen has bothered to do the legwork…

I haven't bothered to link many hnrankings I've done personally because (tangent) both HN search & hnrankings.info are blocked by the handsome and intelligent admins at my office (/tangent).

But here's a simple experiment that can be done in a few minutes: search for daringfireball.net links on HN, click on the ones with a decent number of points, put those into hnrankings.info and you'll see a clear pattern of flagging for pretty much every single one.

Now maybe Gruber articles are just terrible (ymmv) but I can say that every other article I've seen flagged down (fairly easy to tell from rank/points/time) falls into the same categories. And I don't see how it's a big conspiracy theory to apply occam's razor to the observation that "hey all these anti-google or pro-apple or pro-ms links have a graph that makes it look like they were flagged off the first page". The same mentality that would abuse this is not hard to find in the comment sections of many tech sites so I'm not sure why anyone would be surprised or think HN is immune.

And again if HN mods want to produce a list of flagged articles I'm confident it would back the assertions that I and others have made.

Re: How Microsoft handed the NSA access to encrypted messages

#149

Post by grey-area » Fri, Jul 12, 2013, 5:38 AM UTC

bigiain wrote: post #127

kvb wrote: post #22

Earlier quoted context omitted.

Well, did you expect "privacy" to imply that your data would not be released to the government following legal requests for it? I always assumed it meant that they wouldn't share it with other businesses, but maybe that's just me. Analogously, if one of the major phone providers started selling information to marketers, including what times of day I made phone calls, would it be inappropriate for a competitor to crea…

That implication is exactly what Colin provides with my tarsnap backups. He (or Amazon) can respond to legal requests with my strongly encrypted data, and Neither Colin/tarsnap nor Amazon can provide them with my private keys. You can design your systems this way. It appears you're allowed under US law. It seems there's companies jumping through hoops on behalf of the NSA and/or FBI to build systems that _dont_ provi…

Note that Colin _could_ conspire with / be compelled by the NSA to attempt to convince me to "upgrade" my local tarsnap code with a backdoored version

Far more likely is that they'd oblige him to upgrade everyone's tarsnap with a backdoored version, just in case.

Re: How Microsoft handed the NSA access to encrypted messages

#150

Post by honzzz » Fri, Jul 12, 2013, 6:29 AM UTC

grey-area wrote: post #147

Microsoft: Your privacy is our Priority°. This slogan now deserves to live on in infamy alongside other prominent examples of doublespeak, like Plays for Sure•, and Don't be evil°. What concerns me in these responses from Microsoft is the distortion of the term lawful to include any request from the NSA. If you change the meaning of words like lawful, domestic and intercept, you can of course make anything legal in s…

>>> What concerns me in these responses from Microsoft is the distortion of the term lawful

This seems really important to me. I grew up in a totalitarian regime and this kind of re-defining common language was one of the most powerful tools the regime could use to retain power and keep people in constant fear. For example the crime of 'disruption of public order' could be used to put basically anybody to jail because the term would be twisted to fit any behaviour that the regime did not like - for example when you criticised some official or communist party member or complained about something publicly.

Actually I believe that ability of the government or any other group of people to redefine common language and inability of people to force government to use their version of language means that the power distribution in society is seriously skewed and therefore is a strong sign of failing democracy. It's really scary to observe that in the US.