Live data from Hacker News

XKeyscore: NSA program collects 'nearly everything a user does on the internet'

theguardian.com

261–270 of 641 posts

Re: XKeyscore: NSA program collects 'nearly everything a user does on the internet'

#261

Earlier quoted context omitted.

Why would we assume that TLS is safe? The NSA could just as easily compromise the CAs and get all the certificates they need.

Not exactly. Compromising a CA would let them fool a browser into thinking that a fake Google certificate is a real one. However, if Google were diligent, they could publish their valid cert signatures anywhere they like, and users could check the signatures of the certs that are presented as genuine. The TSA can't crack or impersonate a cert at will; they can only 1) try to trick you into accepting a phony one or 2)…

Wouldn't having the private cert allow you to decrypt all communications encrypted using that cert?

Re: XKeyscore: NSA program collects 'nearly everything a user does on the internet'

#262
I asked this in a deeper thread, but i would like to reask anyone that can explain. If the NSA is tapping pipelines as it seems they are, wouldn't the sources such as facebook and google all come online at the same time? if they were in fact referring to the pipeline access as their way into facebook and company, why did they all have different onboarding times? wouldn't they have all come on at the same time: the time when they tapped the pipelines? Maybe i misunderstand the process. I get that maybe they had to write some interface that interpreted the packets and sorted them as such, but that wouldn't take years.

Re: XKeyscore: NSA program collects 'nearly everything a user does on the internet'

#263
post #49

Earlier quoted context omitted.

I wouldn't for a second bet on it. A hidden service has exactly the same issue as traffic that exits the network. The topography looks like this. httpd > tor node > tor node > tor node > rendezvous point With enough monitoring, the location of the web server (or other hidden service) can just be found out by bombing the hidden service with traffic and seeing what end point lights up with traffic. With fine enough mon…

I would think Silk Road provides enough incentive that if the government could defeat tor hidden services, they would have busted Silk Road.

If every police officer had access to these tools, the news would leak much sooner.

So I would think these tools are available only to a select few, and those are more interested in more high-profile tasks like catching extremists or going after political opponents.

I, frankly, don't think SR is that high on government list. Not yet.

Re: XKeyscore: NSA program collects 'nearly everything a user does on the internet'

#264
post #218
post #29

This is overwhelming. Even when you always hear the claims about we knew this was going on, somehow it is still shocking when you see it all laid out infront of you with screenshots and the capabilities described. I can see how they get HTTP information, since they would intercept at transit hubs - but how are they getting all Facebook private messages and Gmail? I was also looking for another unique ID that users ar…

>This is overwhelming. Even when you always hear the claims about we knew this was going on, somehow it is still shocking when you see it all laid out infront of you with screenshots and the capabilities described. It has become a bit of a pet peeve of mine recently to see self-aggrandizing comments from users around the net about how "we should have known" and "none of this is new." I'm a practically addicted news j…

You're both right. If you read the PATRIOT Act, it's easy to look backwards and see that the things we're becoming aware of now are logical extensions of what was being asked for way back then.

It is, however, VERY easy not to have been able to have that foresight, and I think that the insights people were expecting the government to have been constrained by the fact that all the information of value is collected by neutral third parties. Google, Yahoo, Twitter, etc., aren't likely colluders with the government.

Plus, at the time of the PATRIOT Act's passage, there wasn't quite as much information being put on social media, or out to the public in general. Not as much was online, digital, or otherwise easily indexable.

There were those predicting this sort of possibility before the PATRIOT Act's enactment, and since, to be sure, but you shouldn't feel responsible for not having seen the signs yourself, or for having heeded the words of what probably seemed like kooky overreactionaries from back in the day.

The funniest part about this, to me, is that somewhere, very quietly, Richard Stallman is quietly telling us all the he told us so, and he's absolutely right, and always has been. Neverminding that, he's largely seen as a crazy old paranoiac who we should respect for his IT knowledge, while having to forgive the rest of his eccentricities.

Re: XKeyscore: NSA program collects 'nearly everything a user does on the internet'

#266
post #218
post #29

This is overwhelming. Even when you always hear the claims about we knew this was going on, somehow it is still shocking when you see it all laid out infront of you with screenshots and the capabilities described. I can see how they get HTTP information, since they would intercept at transit hubs - but how are they getting all Facebook private messages and Gmail? I was also looking for another unique ID that users ar…

>This is overwhelming. Even when you always hear the claims about we knew this was going on, somehow it is still shocking when you see it all laid out infront of you with screenshots and the capabilities described. It has become a bit of a pet peeve of mine recently to see self-aggrandizing comments from users around the net about how "we should have known" and "none of this is new." I'm a practically addicted news j…

> I'm a practically addicted news junkie ...

More like a news sheep. The mass market news is and has always been 49% fluff and 49% lies.

Comments from people who already knew what the NSA does are not "self aggrandizing". The are other-insulting. You should rightly be ashamed that you walk through life in a news fog of up-to-the-minute minutiae. Read books by retired insiders, talk to current insiders and contractors. That's the only way you will learn anything about anything. To wait for the newsmen to do it for you is to sign your mind over to tampon salesmen.

The NSA story is staggeringly unimportant. Every government, many companies, and rather a lot of organized criminals run intel and counterintel operations. It is just a fact of life, like antibiotics and highway construction. It is inevitable that there must be a national American signals intelligence organization.

What os staggetingly important is why the NSA alone, out of all the spy organizations, is being singled out for a comprehensive media war. The most likely explanation is that the Democratic Party needed something to distract from its pecadillos. The next most likely explanation is that a foreign government is getting themselves some payback. In any event, if you care about this non-news, you are just another mindless pawn.

Re: XKeyscore: NSA program collects 'nearly everything a user does on the internet'

#267
post #133

Earlier quoted context omitted.

Kind of puts into perspective why they would coordinate such a massive raid on Megaupload. The target may not have even been the data - merely seizing the data puts anybody who has accessed the megaupload website as an easy target.

You crossed the tinfoil line. Copyright infringement was sufficient motivation for the actions taken. The megaupload raid was not okay, but I am pretty sure Hollywood was behind it, not the NSA.

You've got a lot of nerve impugning tinfoil these days.

Re: XKeyscore: NSA program collects 'nearly everything a user does on the internet'

#268

Earlier quoted context omitted.

> edit: Gmail messages must only be captured when they leave the Google network. It seems easier for the NSA to tap datacenter datacenter fiber links inside Google's network. Why worry about decryption when you can have Google's frontend servers do it for you?

Why would Google (or anyone) link to them directly? with fiber no less! this stuff is alarming enough no need for FUD. This XKS business seems about intercepting non-encrypted traffic as the references to HTTP payload quoted in the article would suggest.

> Why would Google (or anyone) link to them directly? with fiber no less!

"They have no direct access to our servers"

I wonder what a beam splitter consists of. Oh. A PRISM.

Re: XKeyscore: NSA program collects 'nearly everything a user does on the internet'

#269

Earlier quoted context omitted.

It's not feasible for the average person to restrict their lives to the point that RMS does and advocates for. * Reading the web via email only * Using completely free software and hardware (which as far as I can tell, limits you to a very small subset of Linux on a single Chinese-made netbook) * Not carrying a cellphone * Not using any social networks. Stallman's principled stand is admirable, but untenable for most…

Principled != crackpot. Crackpot is an insult intended for the feeble minded and is used to reduce any opinions a person might hold on a subject as reject-able out of hand. Over unity energy generation from the vacuum is rightly labeled as 'crackpot' imo, Stallman's position, while extreme should (again, imo) not be labeled as such.

Where Stallman breaks from admirable principle and dives into untenable crackpottery, IMO, is where he calls proprietary software evil.

Re: XKeyscore: NSA program collects 'nearly everything a user does on the internet'

#270
post #218
post #29

This is overwhelming. Even when you always hear the claims about we knew this was going on, somehow it is still shocking when you see it all laid out infront of you with screenshots and the capabilities described. I can see how they get HTTP information, since they would intercept at transit hubs - but how are they getting all Facebook private messages and Gmail? I was also looking for another unique ID that users ar…

>This is overwhelming. Even when you always hear the claims about we knew this was going on, somehow it is still shocking when you see it all laid out infront of you with screenshots and the capabilities described. It has become a bit of a pet peeve of mine recently to see self-aggrandizing comments from users around the net about how "we should have known" and "none of this is new." I'm a practically addicted news j…

I think it's just a demonstration of complacency more than any actual knowledge on the subject. I've noticed it's invariably my non technical acquaintances who are the first to pontificate on how this is all somehow boring old hat.
Post reply on HN