Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google Security Team Member on NSA: "Fuck These Guys"

plus.google.com

Post reply on HN
Print view View original

291–300 of 420 posts

Re: Google Security Team Member on NSA: "Fuck These Guys"

#291

Post by pnathan »

untog wrote: post #223
joshstrange wrote: post #213

Earlier quoted context omitted.

Ok but to agree with that argument is to agree that the NSA and organizations like it are necessary. I'm still waiting for the proof that they are. Everything I see points to them compromising countless people's privacy and having nothing to show for it.

But that's the core of the problem. By the nature of what they do, their successes are never clear. Not that this is a very robust intellectual defense, but the US is far from the only country to do this. Just two days ago the NYT had an article about Brazil spying on Americans within its borders: http://www.nytimes.com/2013/11/05/world/americas/brazil-ackn... If we shut down the NSA tomorrow we would be an an intern…

This is why my opinion is that the TLA policies and limits should be set by Congress in open debate. While their work may be secret, the limits and approach to the work should be set by the representatives of the people, publicly.

Re: Google Security Team Member on NSA: "Fuck These Guys"

#292

Post by kllrnohj »

lsh123 wrote: post #212
kllrnohj wrote: post #116

Earlier quoted context omitted.

> Well, I feel that encrypting traffic inside the data center is not a bad idea (and we do it at WePay where I serve as CSO). Do you have your own data center building? And if you don't have your own data center buildings, how are you guarding against physical attacks? Because just saying "encryption" doesn't actually mean anything. Encryption isn't free, and at Google scale that can add up. Useless encryption is jus…

At WePay - no, we don't have our own data centers just yet. In a couple large companies I worked before - yes (and we did encrypt the traffic as much as possible). Some types of encryption are pretty cheap actually. I used to use special SSL cards in the servers 10-15 years ago but today my laptop would outperform these cards and wouldn't even get hot :) Plus you need to remember that relatively expensive public key…

> So far I haven't seen any evidences that there was cable splicing. Thus using occam's razor I would assume that the hack was much simpler than that.

What? The evidence totally points to cable splicing. What hack involves getting all the inter-DC packets but nothing else? Obviously the machines weren't compromised, or they wouldn't have cared about reverse-engineering the wire protocol. So what are you proposing was hacked?

> I'll re-iterate that security should be built on defense-in-depth principle. Every single protection layer will fail or someone will go around it. The assumption that a data center is "safe" is a bad assumption period. You have to play "what-if" game and think for the attacker.

And I'll re-iterate that you're asking for a goddamn magical pony.

Side note, if your data center isn't safe go get a new one. Seriously. Most DCs have tons of security to make them safe. That's not an assumption.

Re: Google Security Team Member on NSA: "Fuck These Guys"

#293

Post by rsync »

kllrnohj wrote: post #74
lsh123 wrote: post #52

Lets start from the beginning: the NSA "hack" became possible because Google (and its security team) made bad assumptions about the security of the connection between Google's data centers and did not encrypt the traffic. Basically, this is security 101: protect data at rest and protect data in flight. So, sorry but I think the better subject for discussion would be how badly Google screwed up, not how evil is NSA. M…

> Lets start from the beginning: the NSA "hack" became possible because Google (and its security team) made bad assumptions about the security of the connection between Google's data centers and did not encrypt the traffic. The assumption isn't bad - it's a private network line, not a public internet connection. Nobody else had access to that line, at least they weren't supposed to. Splicing a fiber line is a bit out…

"The assumption isn't bad - it's a private network line, not a public internet connection. Nobody else had access to that line, at least they weren't supposed to."

You don't use telnet when you access your home server(s) from your laptop ... that's basically what they were doing.

They skipped over a zero-cost, obvious best practice, and I think we should be suspicious. Either they've run that part of their network in a stunningly negligent fashion ... or this was the ingress they gave to the NSA which could be plausibly denied later.

Re: Google Security Team Member on NSA: "Fuck These Guys"

#294

Post by metaphorm »

sinak wrote: post #89

I think it's pretty clear that we need both technical and legislative fixes to NSA surveillance. Just one of the two isn't enough: to get be even vaguely confident that surveillance ends, we need both. The technical fixes I can't speak to, but the legislative ones I've been thinking about for a while. In the last week, there have been two prominent bills announced to deal with surveillance: - Bill 1: The FISA Improve…

Feinstein is a villain. Time to get her out of office.

Re: Google Security Team Member on NSA: "Fuck These Guys"

#295

Post by kllrnohj »

ForHackernews wrote: post #284
thezilch wrote: post #107

Earlier quoted context omitted.

Except, they didn't explicitly mean to do that, stopped doing that, and paid for the autonomous collection of trash that they threw out.

How do you do that by accident? Somebody had to design, implement, and test a feature to sniff and store data off wireless networks.

The goal was just to sniff the wifi APs MAC to pair it with a GPS location for wifi location lookups, not to store the entirety of the packet.

Re: Google Security Team Member on NSA: "Fuck These Guys"

#296

Post by wonderyak »

metaphorm wrote: post #294
sinak wrote: post #89

I think it's pretty clear that we need both technical and legislative fixes to NSA surveillance. Just one of the two isn't enough: to get be even vaguely confident that surveillance ends, we need both. The technical fixes I can't speak to, but the legislative ones I've been thinking about for a while. In the last week, there have been two prominent bills announced to deal with surveillance: - Bill 1: The FISA Improve…

Feinstein is a villain. Time to get her out of office.

She's always been a villain. Its just that the other Senators are so much worse she looks good in comparison.

Re: Google Security Team Member on NSA: "Fuck These Guys"

#297

Post by kllrnohj »

CaptainZapp wrote: post #93
nodata wrote: post #86

Earlier quoted context omitted.

Erm, what? Which law did they break, and which civil rights did they violate?

Like indiscriminately and illegally sucking up WiFi data with their street view mobiles? Including account information and passwords on unsecured WiFi connections. Even if the accusation of "violating laws" may be a tad hyperbolic in the great scheme of things it's not a stretch to deem Google one of the most hypocritical companies around.

Receiving a broadcast isn't illegal - you shove it out into the air, you lost all privacy rights on that broadcast legally speaking.

You can debate the ethics of it, but it wasn't illegal. And Google did get penalized for it.

Re: Google Security Team Member on NSA: "Fuck These Guys"

#298

Post by dllthomas »

metaphorm wrote: post #294
sinak wrote: post #89

I think it's pretty clear that we need both technical and legislative fixes to NSA surveillance. Just one of the two isn't enough: to get be even vaguely confident that surveillance ends, we need both. The technical fixes I can't speak to, but the legislative ones I've been thinking about for a while. In the last week, there have been two prominent bills announced to deal with surveillance: - Bill 1: The FISA Improve…

Feinstein is a villain. Time to get her out of office.

Good luck with that. She's not up for re-election until 2018, and so far as I'm aware there are no allegations of crimes of the sort that would get her expelled from the senate (in practice, looking at previous examples).

Re: Google Security Team Member on NSA: "Fuck These Guys"

#299

Post by lsh123 »

kllrnohj wrote: post #292
lsh123 wrote: post #212

Earlier quoted context omitted.

At WePay - no, we don't have our own data centers just yet. In a couple large companies I worked before - yes (and we did encrypt the traffic as much as possible). Some types of encryption are pretty cheap actually. I used to use special SSL cards in the servers 10-15 years ago but today my laptop would outperform these cards and wouldn't even get hot :) Plus you need to remember that relatively expensive public key…

> So far I haven't seen any evidences that there was cable splicing. Thus using occam's razor I would assume that the hack was much simpler than that. What? The evidence totally points to cable splicing. What hack involves getting all the inter-DC packets but nothing else? Obviously the machines weren't compromised, or they wouldn't have cared about reverse-engineering the wire protocol. So what are you proposing was…

> The evidence totally points to cable splicing.

I don't think there are any evidences at all. As far as I know, the only known thing is that NSA was able to obtain the un-encrypted google traffic. For example, it could have been backdoor in the router, one extra cable in the switch, or a few other similar low-tech options.

> Most DCs have tons of security to make them safe.

Don't disagree. But this doesn't make them invincible from other attack vectors (e.g. rogue employees). I actually heard the same argument from quite a few people during interviews and I usually don't hire them because you have to be paranoid to get security right :)

Re: Google Security Team Member on NSA: "Fuck These Guys"

#300

Post by arkj »

sinak wrote: post #89

I think it's pretty clear that we need both technical and legislative fixes to NSA surveillance. Just one of the two isn't enough: to get be even vaguely confident that surveillance ends, we need both. The technical fixes I can't speak to, but the legislative ones I've been thinking about for a while. In the last week, there have been two prominent bills announced to deal with surveillance: - Bill 1: The FISA Improve…

We've always been spied on and we will be. Just be honest souls. And let them spy or do whatever; This talk is kinda tiring now. I'll not worry as long as there are checks in the system that someone inside is not misusing this information.
Post reply on HN