Can someone enlighten me, what is going on with NSA these last days (besides Snowden of course) ? I hear about new leads that they can break mainstream internet encryption methods. Is this true, and if so in what level? What about open source encryption?
Google encrypts data amid backlash against NSA spying
111–120 of 153 posts
Re: Google encrypts data amid backlash against NSA spying
#112Earlier quoted context omitted.
I know what you're trying to say, but your wording is off. Something cannot be theoretically impossible but practically possible.
Don't worry, your wording is also off, something can be theoretically impossible but practically possible. Things can not be impossible but also practically possible, but for every theory disproved, there was a contrarian thing possible :)
I suppose it depends on the context. The only way this could happen is if you're talking about a bad theory. Whereas something theoretically possible can be practically impossible, even for a good theory, if real life situations can't match the conditions of the theory.
In this case the NSA didn't even do anything theoretically impossible. They did a workaround. They added backdoors, which violates the conditions of the theory. It's like saying I got through your unbreakable door by coming in through the window.
Re: Google encrypts data amid backlash against NSA spying
#113My main reaction to this was, ummm, wait - google isn't already encrypting its data internally?! -- off topic rant -- Such a weird discontinuity in all this ... Google was prosecuted and paid a fine, despite self-disclosing, falling on its own sword and issuing an abject apology, for accidentally sniffing some unencrypted data as they drove past. This was condemned at every level by government. Now the government is…
Because most of the people outraged that Google supplied "-s 0" instead of "-s 64" when running tcpdump weren't quite bright or were not thinking it through? I've yet to hear of any intelligent reason to be upset about the WiFi collection thing.
And more precisely, it's the NSA, who has the job to break encryption. There was outrage when Carnivore was made public (late 90s?), then that AT&T room the NSA tapped that was leaked in 2006. By now, it's just taken for granted (by technical people anyways) that unencrypted communications are going to be recorded. You don't even need a state-level adversary to achieve this on a limited scale.
Re: Google encrypts data amid backlash against NSA spying
#114Earlier quoted context omitted.
Eh. If you own the whole fiber from place to place, you might be lulled into thinking the data never leaves your premises.
Yeah, there's always a dividing line. Between two servers in the same rack? Between two racks in the same datacenter? Between two datacenters in the same physical complex? Between two complexes connected by fiber you installed yourself? If the security state keeps on keeping on, I expect companies which care about privacy to keep tightening it in. One day not long from now it might be considered ludicrous to transfer…
If you own the entire datacenter (like I'm sure Google does in most scenarios) and you're having racks compromised, then you probably have much larger issues that crypto won't solve.
Re: Google encrypts data amid backlash against NSA spying
#115Google has full unencrypted access to all private data from their users (because collating that data is the foundation of their core business) and the NSA has the power to lean on Google to provide them full access.
Not to mention that at the very heart of the NSA spying story is the allegation that Google e.a. provides access to said data willingly. And the only denial from both parties has been a mixture of partial admission ("but we're using proper procedure") and carefully crafted lawyer-speak (the infamous "no direct access" boilerplate denials).
This is just internal security enhancements being abused as a PR exercise. Google is trying use the latest revelations about the NSA to deflect attention away from it's own complicity.
Re: Google encrypts data amid backlash against NSA spying
#116Earlier quoted context omitted.
Instead of trying to reverse-engineer a proprietary compressed Javascript codebase that changes daily, you should use Thunderbird and Enigmail. http://www.mozilla.org/en-US/thunderbird/ https://www.enigmail.net/
Or just use KMail (which integrates with GnuPG by default) on your shiny open-source Linux or BSD that you're surely using already. :)
drivebyacct2, you are hell-banned, and have been for quite awhile. Several of your comments have been insightful with show-dead, and I feel you should be aware.
Re: Google encrypts data amid backlash against NSA spying
#117Earlier quoted context omitted.
For sure, but in the case of google this probably doesn't apply. From what was published recently we know NSA has proven methods for bypassing encryption, namely getting the keys used for encryption (so they can decrypt everything) or getting access to the content before encryption or after decryption. To me this last move by google is a PR attempt at regaining people's trust
I'm so bored of hearing the accusations of PR stunts. They crop up in every submission detailing an action taken by Google with regards to the Snowden/Prism/NSA revelations. Is it so ridiculous that a large corporation should seek to ameliorate its image in the eyes of users and shareholders? PR has become such a dirty word. Of course it would be best if all these actions were taken earlier, purely as the result of a…
When Google does something that makes it impossible for them to hand over certain types of data to the NSA, either by not collecting it, or making it so that only the user is able to decrypt it, wake me up. Until then, it's a PR stunt.
Re: Google encrypts data amid backlash against NSA spying
#118Earlier quoted context omitted.
Yeah, there's always a dividing line. Between two servers in the same rack? Between two racks in the same datacenter? Between two datacenters in the same physical complex? Between two complexes connected by fiber you installed yourself? If the security state keeps on keeping on, I expect companies which care about privacy to keep tightening it in. One day not long from now it might be considered ludicrous to transfer…
If you own the entire datacenter (like I'm sure Google does in most scenarios) and you're having racks compromised, then you probably have much larger issues that crypto won't solve.
Datacenters aren't poofed into existence. The networking hardware could be compromised at the factory, which would compromise the datacenter's network security without compromising its physical security or any of the servers.
Re: Google encrypts data amid backlash against NSA spying
#119A salient bit: [Eric] Grosse echoed comments from other Google officials, saying that the company resists government surveillance and has never weakened its encryption systems to make snooping easier — as some companies reportedly have, according to the Snowden documents detailed by the Times and the Guardian on Thursday. “This is a just a point of personal honor,” Grosse said. “It will not happen here.” Some folks a…
I am sure there are people there who do care about security and this is a victory, but it is a small one and not one that really saves their reputation.
The problem is that the NSA presumably gets access to the information before it is encrypted, so this does not limit what the NSA can get from Google. What it does do though is possibly cloud the traffic to some extent regarding cracking stuff, but then the NSA could probably just disregard the traffic between data centers.
The real victory is that other companies are more likely to follow Google and this may have an impact.
Re: Google encrypts data amid backlash against NSA spying
#120A salient bit: [Eric] Grosse echoed comments from other Google officials, saying that the company resists government surveillance and has never weakened its encryption systems to make snooping easier — as some companies reportedly have, according to the Snowden documents detailed by the Times and the Guardian on Thursday. “This is a just a point of personal honor,” Grosse said. “It will not happen here.” Some folks a…
Personal honor is what Edward Snowden showed. Getting caught for selling out your users and then endeavoring to do something about it is not honorable. It's manipulative and pathetic.