Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google Security Team Member on NSA: "Fuck These Guys"

plus.google.com

Post reply on HN
Print view View original

101–110 of 420 posts

Re: Google Security Team Member on NSA: "Fuck These Guys"

#101

Post by meowface »

CaptainZapp wrote: post #93
nodata wrote: post #86

Earlier quoted context omitted.

Erm, what? Which law did they break, and which civil rights did they violate?

Like indiscriminately and illegally sucking up WiFi data with their street view mobiles? Including account information and passwords on unsecured WiFi connections. Even if the accusation of "violating laws" may be a tad hyperbolic in the great scheme of things it's not a stretch to deem Google one of the most hypocritical companies around.

That did happen, but I believe the data was captured and stored by mistake. At the least, they had no intention to view or use any of that data.

The NSA on the other hand actively intends everything it's doing in this case. Comparing Google's Wifi mishap with the NSA's hundreds (thousands?) of deeply questionable operations driven by invasions of privacy and security is comparing apples with oranges.

Re: Google Security Team Member on NSA: "Fuck These Guys"

#102

Post by rhizome »

samstave wrote: post #32
wmf wrote: post #21

Earlier quoted context omitted.

In The Shadow Factory (written after the Klein leaks but before Snowden), Bamford notes that a lot of surveillance equipment comes from Israel. I don't know much about Israeli culture but it may be significantly different from the US.

I am at the openstack conference right now. My colleague was talking in hebrew to a lot of folks the past few days. I said to him jokingly "Where did all these Israeli's come from that are here" His reply: "Dude, all this shit comes out of Israel! its the whole tech/NSA bullshit used against the palestinians!" It was a casual comment - but very interesting in that its a foregone conclusion that the surveillance state…

Highly self-aggrandizing. I think the most that can be said is that it's a highly symbiotic relationship between .us/.il.

Re: Google Security Team Member on NSA: "Fuck These Guys"

#103

Post by paxswill »

Amadou wrote: post #43
digitalboss wrote: post #26

Earlier quoted context omitted.

I asked this question 6 months ago, I liked the reply. ---- Most programmers are very much unlike you or I. Think about those legions of DoD/DoD contractor engineers that trust government implicitly and totally, and really don't give a shit about more "hacker"/"technologist" subjects. ---- https://news.ycombinator.com/item?id=5836416

The other half of that equation is that the requirements for a security clearance tend to filter out the people who are mentally predisposed to question authority. It is a very rare person who can see all the things wrong with the various Wars on Dignity (drugs, terror, etc) and yet has a nose so clean as to qualify for a top secret clearance. It's kind of like the saying about walking a mile in someone else's shoes…

Just because someone can see what's wrong doesn't mean they do anything about it. Without that evidence of action, there's nothing for a background check to turn up. Getting a security clearance is not incredibly difficult.

Re: Google Security Team Member on NSA: "Fuck These Guys"

#104

Post by [deleted] »

lsh123 wrote: post #77
bo1024 wrote: post #71

Earlier quoted context omitted.

I can't agree with that, this was on Google's on fiber connections between their own data centers, right? And no other company with multiple data centers encrypts all traffic between them, right? (maybe you'll find a small counterexample but no big one.) So I don't think this is "security 101".

Well, I do :) Moreover, I encrypt all the traffic even inside the same data center.

[deleted]

Re: Google Security Team Member on NSA: "Fuck These Guys"

#105

Post by dingaling »

bo1024 wrote: post #71
lsh123 wrote: post #52

Lets start from the beginning: the NSA "hack" became possible because Google (and its security team) made bad assumptions about the security of the connection between Google's data centers and did not encrypt the traffic. Basically, this is security 101: protect data at rest and protect data in flight. So, sorry but I think the better subject for discussion would be how badly Google screwed up, not how evil is NSA. M…

I can't agree with that, this was on Google's on fiber connections between their own data centers, right? And no other company with multiple data centers encrypts all traffic between them, right? (maybe you'll find a small counterexample but no big one.) So I don't think this is "security 101".

> And no other company with multiple data centers encrypts all traffic between them, right?

Indeed they do! From personal experience, Cisco was hawking its TrustSec inter-DC encryption solution five or six years ago, even over dark fibre.

Re: Google Security Team Member on NSA: "Fuck These Guys"

#106

Post by lsh123 »

cryptbe wrote: post #99
lsh123 wrote: post #77

Earlier quoted context omitted.

Well, I do :) Moreover, I encrypt all the traffic even inside the same data center.

could you share which technology are you using to encrypt all the traffic?

* Mid-tier servers: standard HTTPS with nginx

* Database: SSL connections for MySQL

* Memcached, Gearmand, and other tools that don't have built-in SSL support: simple home grown message level encryption (AES256)

And of course, there are VPN tunnels between data centers in addition to the above.

Re: Google Security Team Member on NSA: "Fuck These Guys"

#107

Post by thezilch »

CaptainZapp wrote: post #93
nodata wrote: post #86

Earlier quoted context omitted.

Erm, what? Which law did they break, and which civil rights did they violate?

Like indiscriminately and illegally sucking up WiFi data with their street view mobiles? Including account information and passwords on unsecured WiFi connections. Even if the accusation of "violating laws" may be a tad hyperbolic in the great scheme of things it's not a stretch to deem Google one of the most hypocritical companies around.

Except, they didn't explicitly mean to do that, stopped doing that, and paid for the autonomous collection of trash that they threw out.

Re: Google Security Team Member on NSA: "Fuck These Guys"

#108

Post by presty »

SCdF wrote: post #6

This has been asked before, but I'd love to hear from a dev (anonymously of course) who actually helped build this NSA madness. Is it like The Cube, where no one really knew what each piece was for? Is it that they are morally pro the NSA's attitude toward personal and corporate privacy, or do they just not care either way?

It's really not surprising that we don't hear about someone speaking up - would you be willing to risk doing so (even anonymously) after working on projects that you _knew_ that were monitoring everything on the internet?

About who made these tools, I would say that this was built through a combination of different people:

- very patriotic individuals: e.g. someone who joins the military and gets a military sponsored world class education in comp sci; or someone who gets recruited at an early age on the campus of berkeley/stanford/yale/mit/etc (remember how spies were recruited back in the days)

- consultants: Palantir, Booz Allen and many more

- buying outsourced tech (e.g. from startups in the Valley/Boston/Penn/Virginia/Maryland or Israel)

- captured black hats in exchange for softer sentences

- renegades from big tech companies: i.e. ex-google employees. You'd be surprised how pissed off some people can be at their previous employees and to what lengths they might go to hurt them

Re: Google Security Team Member on NSA: "Fuck These Guys"

#109

Post by cryptbe »

lsh123 wrote: post #106
cryptbe wrote: post #99

Earlier quoted context omitted.

could you share which technology are you using to encrypt all the traffic?

* Mid-tier servers: standard HTTPS with nginx * Database: SSL connections for MySQL * Memcached, Gearmand, and other tools that don't have built-in SSL support: simple home grown message level encryption (AES256) And of course, there are VPN tunnels between data centers in addition to the above.

Thanks.

> And of course, there are VPN tunnels between data centers in addition to the above.

Could you please be more specific on the VPN solution that you are using? How do you manage the shared keys? How do you make sure 'system administrators can't easily read the traffic?"

Re: Google Security Team Member on NSA: "Fuck These Guys"

#110

Post by cinquemb »

tonyplee wrote: post #66

Just simple big government(s) v.s. big company - happened over and over again in history - remember how powerful Microsoft was in the end of the 90. Governments don't like challenge to its power. They will find ways to control the Jedi Council.

I really don't think this is that clear cut. On this thread alone, two people have have vouched for their companies that encrypt internal traffic as standard MO (wepay, and another larger than google [by their words]) and considering that some mailing list chatter[0] has pointed out some interesting dynamics (read duplicitous) on the behalf of some companies (among the remarks on here), I wouldn't fool myself with its that simple.

As someone working on a start up now dealing with crowd-sourcing/mining data on people/identities and leaving it public, it's very interesting to see the dynamics play out with online services especially with ones that create the perception of walled gardens vs those that position themselves as inherently public and the flak (or lack thereof) they take from privacy advocates and what not.

[0] http://cryptome.org/2013/10/nsa-hysteria-coverup.htm

Post reply on HN