61–70 of 614 posts
Gen. Keith Alexander, asked about it at a Bloomberg event, denied the accusations. "I don't know what the report is," Alexander cautioned, adding the NSA does not "have access to Google servers, Yahoo servers." He said the NSA is "not authorized" to do this, and instead, must "go through a court process." http://www.politico.com/story/2013/10/keith-alexander-nsa-re...
"vice president for security engineering Eric Grosse announced that the company is racing to encrypt the links between its data centers. " Isn't this useless? They can serve Google NSL and the court can force the company to release the SSL keys for the encryptions - just like Lavabit. Google CEO/Board can not shutdown the company like Lavabit. What can they do, get out of USA like how they got out of China?
> Isn't this useless? No. > They can serve Google NSL and the court can force the company to release the SSL keys for the encryptions - just like Lavabit. They can't do that without Google knowing about it, knowing what data is covered by the NSL and having the opportunity to challenge the request, or to factor the fact of the requests and the extent of information covered by it in evaluating Google's lobbying priori…
Once inside, put a few webcam, physical/virtual key logger, a few line of code, (checkin code with extra ",", "=" instead of "==" in the right place - just like a post about Linux security Kernel hack a while back.) and the jobs are done.
"vice president for security engineering Eric Grosse announced that the company is racing to encrypt the links between its data centers. " Isn't this useless? They can serve Google NSL and the court can force the company to release the SSL keys for the encryptions - just like Lavabit. Google CEO/Board can not shutdown the company like Lavabit. What can they do, get out of USA like how they got out of China?
So getting out of the US would be insufficient (not that it would be a viable option anyway) - if moving out of the US, they'd also need to actually know their countermeasures are sufficient to prevent the NSA from just taking what they want.
I hope that this finally convinces everyone that it doesn't matter whether Google is "Evil" or Yahoo is more evil or whatever. What matters is that large cloud systems are fundamentally incapable of protecting data. Even the most goodhearted and the most talented teams can't reliably defend against a massively funded adversary. Secrets are for keeping, not sharing.
I don't believe that's true.
1. Google (and others?) is already aggressively increasing the amount of encryption it does on traffic between its datacenters. So they have been addressing this problem before it was even brought to light.
2. We easily have the encryption abilities to do many more things than we do with secure cloud data; we'd just have to pay more for it. For instance, I can encrypt everything the minute it leaves my laptop, store it in the cloud, and not decrypt until it hits my laptop again. Nobody but me ever gets the secret key (heck, it could be a one-time-pad and thus unbreakable). If I trust the cloud computers themselves, then I can store different secret keys on each and use strong public-key encryption to protect all traffic between different machines in the cloud, and between my machine. Breaking the system requires compromising a machine, and even then you only get the key for that machine.
3. In theory, fully homomorphic encryption could allow the best of both worlds above. I completely encrypt my data on my machine --- nobody else has the key --- then send it into the cloud where cloud companies can do operations for me like searching, sorting, filtering, etc, all without ever decrypting the data or learning what it is. They send me back the results (securely), then I decrypt. Of course, right now this would be massively slow and expensive, but progress is being made.
Naturally all of the above are subject to the "5-dollar wrench" rule or the "secret court/FISA/warrants" rule. You cannot protect your data from the people making a law that says "give up your data". But it is technologically possible and even feasible to secure data from the NSA's snooping. The tradeoff is cost and time.
Earlier quoted context omitted.
You know what would outrage the public? ESPN being shut down. Most people do not actually care about their privacy. Even if everyone had the technical chops needed to understand what has been happening, most people never spend much time contemplating the importance of privacy rights.
> people do not actually care about their privacy This is 100% accurate, I've attempted to aggressively promote privacy tools well before the NSA/Snowden stuff among the people I know. They still don't care to use simple things like OTR with IM. They might use it for one week, and switch back. Journalists/tech sites love making this seem like the biggest deal in society right now, but hardly the case in reality. I'm…
Privacy rights are too abstract for most people to bother with. After all, they have nothing to hide, only criminals and terrorists would bother hiding anything (or so the thinking goes).
People will no doubt come on this thread and remind everyone that of course the government always had access - you must have been a fool not to think so. But I just can not get over how angry it makes me. Honestly I thought that using google products with some exploitation of the contents for advertising was an acceptable exchange. This is just a total betrayal and I cannot believe that the Google board is not aware…
This might be a good time to go back and look at what you said to all those cypherpunks who kept talking about the need to build security into Internet protocols from day 1. Whitefield Diffie had pointed out this problem -- that online services could violate user privacy without any technical barriers -- in the 1970s and pointed to it to motivate public key cryptography. Throughout the 90s and 00s people were saying…
The cypherpunk "2.0" generation is here. The adversaries are definitely way more resourceful and ten steps ahead now. So there may be some value in looking back with regret. But it's never too late.
I hope that this finally convinces everyone that it doesn't matter whether Google is "Evil" or Yahoo is more evil or whatever. What matters is that large cloud systems are fundamentally incapable of protecting data. Even the most goodhearted and the most talented teams can't reliably defend against a massively funded adversary. Secrets are for keeping, not sharing.
Well, I don't think it's that easy. If the NSA wanted your data, they could get into your network probably easier than they could get into Google's networks. Companies like Google have way smarter people (and working full time) securing data than most businesses. For us to secure our networks as much as someone like Google would, we'd have to have a team of the best hackers around. And by definition, the best hackers…
I hope that this finally convinces everyone that it doesn't matter whether Google is "Evil" or Yahoo is more evil or whatever. What matters is that large cloud systems are fundamentally incapable of protecting data. Even the most goodhearted and the most talented teams can't reliably defend against a massively funded adversary. Secrets are for keeping, not sharing.
Well, I don't think it's that easy. If the NSA wanted your data, they could get into your network probably easier than they could get into Google's networks. Companies like Google have way smarter people (and working full time) securing data than most businesses. For us to secure our networks as much as someone like Google would, we'd have to have a team of the best hackers around. And by definition, the best hackers…
Earlier quoted context omitted.
> people do not actually care about their privacy This is 100% accurate, I've attempted to aggressively promote privacy tools well before the NSA/Snowden stuff among the people I know. They still don't care to use simple things like OTR with IM. They might use it for one week, and switch back. Journalists/tech sites love making this seem like the biggest deal in society right now, but hardly the case in reality. I'm…
I think it is part of a more general problem: people do not spend much time thinking about the importance of any of their rights. Nobody wants to hear that a terrorist attack was successful or that a criminal walked free for the sake of their civil rights -- rights are abstract, terrorists and criminals are threats to our children and whatnot. Look at what people say about free speech rights, how quickly everyone par…
> the antithesis of the imagined superior being. The last man is tired of life, takes no risks, and seeks only comfort and security.
> Nietzsche said that the society of the last man would be too barren to support the growth of great individuals. The last man is possible only by mankind's having bred an apathetic creature who has no great passion or commitment, who is unable to dream, who merely earns his living and keeps warm. The last men claim to have discovered happiness, but blink every time they say so.
https://en.wikipedia.org/wiki/Last_man
The last man trades their rights and freedoms away for security and comfort.