Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

XKeyscore: NSA program collects 'nearly everything a user does on the internet'

theguardian.com

Post reply on HN
Print view View original

191–200 of 641 posts

Re: XKeyscore: NSA program collects 'nearly everything a user does on the internet'

#191

Post by rjsw »

semenko wrote: post #167
MrKurtz wrote: post #149

Earlier quoted context omitted.

Why would Google (or anyone) link to them directly? with fiber no less! this stuff is alarming enough no need for FUD. This XKS business seems about intercepting non-encrypted traffic as the references to HTTP payload quoted in the article would suggest.

(Keep in mind these slides are 5 years old, before Google Search over SSL) The NSA has clearly tapped trans-oceanic fiber -- why not also tap high-volume inter-datacenter links?

I guess they could tap the fibre at a relay point, maybe somewhere like Hawaii.

Re: XKeyscore: NSA program collects 'nearly everything a user does on the internet'

#192

Post by northwest »

kintamanimatt wrote: post #75
runn1ng wrote: post #31

From the slides http://www.theguardian.com/world/interactive/2013/jul/31/nsa... "Show me all the VPN startups in country X, and give me the data so I can decrypt and discover the users" Does this mean using VPN is not very safe from dragnet?

You probably don't need to break the encryption because eventually all traffic has to exit the VPN's company's endpoint, and at that point it can be captured. Meta data such as the browser's fingerprint can be used to tie traffic to an individual, for example, if you see them log in to a regular HTTP site with an email or a username, this information could probably be used to figure out who they are. Armed with this…

You often hear "What, I should go darknet? Are you crazy?!".

But that's actually the one thing that makes the most sense now:

https://en.wikipedia.org/wiki/Darknet_%28file_sharing%29

Re: XKeyscore: NSA program collects 'nearly everything a user does on the internet'

#193

Post by blueprint »

astrodust wrote: post #142
jacquesm wrote: post #42

Earlier quoted context omitted.

Stallman never was a conspiracy crackpot, he always was a visionary. The only thing that changed is some people's judgment of him.

You can be completely correct and still be a crackpot. What we need is strict limitations on what can and should be collected, and how it's used, plus better methods of securing what's being exchanged. For example, sending email as plain-text, leaving it on the server as plain-text, maybe that's a bad idea. The NSA isn't necessarily the only reason you'd do this. Foreign governments are going to take an interest in t…

> You can be completely correct and still be a crackpot.

This is very important. What do you mean by "crackpot"?

Re: XKeyscore: NSA program collects 'nearly everything a user does on the internet'

#194

Post by rdouble »

It seems like working for the NSA is more like working at Inintech than it is like Minority Report. I've been more embarrassed by how Office Space retarded this seems than I have about the privacy abuses. I'm skeptical any of these supposed systems work, or even exist. It reminds me of Iran's pretend fighter jet.

Re: XKeyscore: NSA program collects 'nearly everything a user does on the internet'

#196

Post by clicks »

nicholassmith wrote: post #163
akmiller wrote: post #141

Honest, maybe naive question, but what types of programmers actively help build and maintain systems like this? I turned down a job for a company that is less than a mile from my house because I viewed their business as immoral. Hard for me to fathom anyone taking a job, helping to build systems like this. I get that many of the components of a system like this could be seen as harmless. However, a system of this com…

They're probably not thinking of it as immoral. Most likely they actually do believe they're improving national security by doing this. Or they just like the paycheck, that's a big possibility. I imagine the NSA is probably happy to pay a lot with a large amount of bonuses to keep people in roles.

This sentiment was also echoed by Snowden in the original video interview. He supposedly had greater insight as to how civil rights at large were being violated, only because as a sysdmin he (and not others) had a broader picture of what was going on, and at what scale it was going on.

So, it's easy to imagine NSA recruiters coaxing potential hires with convincing lines like "we have internal courts, procedures, and checks and balances systems to prevent abuse of citizens' privacy".

Re: XKeyscore: NSA program collects 'nearly everything a user does on the internet'

#197

Post by cowchase »

nikcub wrote: post #29

This is overwhelming. Even when you always hear the claims about we knew this was going on, somehow it is still shocking when you see it all laid out infront of you with screenshots and the capabilities described. I can see how they get HTTP information, since they would intercept at transit hubs - but how are they getting all Facebook private messages and Gmail? I was also looking for another unique ID that users ar…

> Gmail messages must only be captured when they leave the Google network. They are the only provider to support server-to-server TLS

We should start lobbying for broader support for server-to-server TLS with perfect forward secrecy. While it alone is not sufficient to prevent the wiretapping of targeted individuals, it still makes fishing expeditions or "Big Data" level surveillance much harder. It would help keeping ordinary users' emails protected on the wire and secure the meta data of PGP emails.

Re: XKeyscore: NSA program collects 'nearly everything a user does on the internet'

#198

Post by griffordson »

astrodust wrote: post #150
runn1ng wrote: post #73

Earlier quoted context omitted.

No javascript tracking. Very strange behaviour (therefore, less behaviour tracking). That's what I can think of.

Honestly, if the NSA wanted to know what Stallman was up to, they'd apply the $5 wrench technique ( http://xkcd.com/538/ ). All the tin-foil in the world can't prevent them from getting what they want if you're suddenly a Person of Interest.

Is there no difference between specifically targeting a suspect and gaining physical access to their hardware vs. any number of government employees/contractors sitting at their desk browsing through anybody's data with little to no technical limits and little to no oversight?

One of the slides literally says that users must be careful to and their query with another parameter to avoid running afoul of the law.

Re: XKeyscore: NSA program collects 'nearly everything a user does on the internet'

#199

Post by kintamanimatt »

northwest wrote: post #192
kintamanimatt wrote: post #75

Earlier quoted context omitted.

You probably don't need to break the encryption because eventually all traffic has to exit the VPN's company's endpoint, and at that point it can be captured. Meta data such as the browser's fingerprint can be used to tie traffic to an individual, for example, if you see them log in to a regular HTTP site with an email or a username, this information could probably be used to figure out who they are. Armed with this…

You often hear "What, I should go darknet ? Are you crazy ?!". But that's actually the one thing that makes the most sense now: https://en.wikipedia.org/wiki/Darknet_%28file_sharing%29

Yes and no. Remember, it's not a silver bullet or a secret security sauce.

Re: XKeyscore: NSA program collects 'nearly everything a user does on the internet'

#200

Post by w_t_payne »

hackinthebochs wrote: post #184
GI wrote: post #120

I am going to be obliterated for this comment! Does the fact they've caught 300 terrorists in anyway justify what they're doing? I am not saying it does, I just wondered what people's thoughts were (although I can guess!). It's interesting that it was included in the article in an attempt to give it some 'balance'..

300 "terrorists" caught for a few billion people's privacy completely destroyed at a price tag of 100 Billion (pulled out of my ass obviously). Absurdity at its finest.

How many of these "terrorists" were just young men suffering typical teenage angst, and happened to be of the wrong religion?
Post reply on HN