111–120 of 135 posts
I think this is misleading. I now believe that the NSA has the private keys for substantially all SSL certs in use, and I expect that a non-trivial percentage of Tor nodes are run by the government. SSL certs require cooperation of a trusted registrar even for the biggest companies -- Google's is signed by Equifax, for example. Given what we've seen in the last few days, requesting keys from the root CAs is a no-brai…
[deleted]
I think this is misleading. I now believe that the NSA has the private keys for substantially all SSL certs in use, and I expect that a non-trivial percentage of Tor nodes are run by the government. SSL certs require cooperation of a trusted registrar even for the biggest companies -- Google's is signed by Equifax, for example. Given what we've seen in the last few days, requesting keys from the root CAs is a no-brai…
[deleted]
Convegernce i.e. refused to work with CDNs which may have different certificates for the same domain for example, which may be completly valid.
The key of public key crypto (like in RSA) was to make key management easier and independent of a 3rd party, to avoid further bloat, overhead and complexity.
This is the same for Certificate Transparency/Pinning mentioned earlier, given the details it looks very strong on paper, but the implementation will suck in r/l terms.
Earlier quoted context omitted.
A key thing to point out, all a root CA does is verify your public key. The NSA can't get Google's private key from Equifax and they can't even impersonate Google if the end user is using Chrome even if Equifax signed a cert for them. The reason is because Chrome basically checks to see if the cert matches up with a known good copy. Also, if your platform supports it, Gmail has perfect forward secrecy meaning that ev…
I was under the impression having the ability to subpoena a key or cert from either the CA or the company issued the cert would give the NSA carte blanche on decrypting any (encrypted) data they may have gathered by other means. Since I don't seem to be understanding the associated technology as well as I thought I was, could you point me towards some relevant reading on this topic? How/Why are the current implementa…
As for subpoenaing keys: Most CAs will allow for you to generate your key pair and certificate signing request on your own hardware. You'd then submit the CSR which the CA would in turn generate a signed certificate from. The private key should never be shared with the CA. In order to eavesdrop on communications, the NSA would then need to subpoena each targeted company's key. Wide reach is easy (go for the 5-10 biggest fish), comprehensive reach nigh impossible.
[1] http://vincent.bernat.im/en/blog/2011-ssl-perfect-forward-se...
Earlier quoted context omitted.
A key thing to point out, all a root CA does is verify your public key. The NSA can't get Google's private key from Equifax and they can't even impersonate Google if the end user is using Chrome even if Equifax signed a cert for them. The reason is because Chrome basically checks to see if the cert matches up with a known good copy. Also, if your platform supports it, Gmail has perfect forward secrecy meaning that ev…
I was under the impression having the ability to subpoena a key or cert from either the CA or the company issued the cert would give the NSA carte blanche on decrypting any (encrypted) data they may have gathered by other means. Since I don't seem to be understanding the associated technology as well as I thought I was, could you point me towards some relevant reading on this topic? How/Why are the current implementa…
Earlier quoted context omitted.
A key thing to point out, all a root CA does is verify your public key. The NSA can't get Google's private key from Equifax and they can't even impersonate Google if the end user is using Chrome even if Equifax signed a cert for them. The reason is because Chrome basically checks to see if the cert matches up with a known good copy. Also, if your platform supports it, Gmail has perfect forward secrecy meaning that ev…
I was under the impression having the ability to subpoena a key or cert from either the CA or the company issued the cert would give the NSA carte blanche on decrypting any (encrypted) data they may have gathered by other means. Since I don't seem to be understanding the associated technology as well as I thought I was, could you point me towards some relevant reading on this topic? How/Why are the current implementa…
Love the evil faces in the infographic with the twisted eyes. Notice how the sysadmin is not evil.
Earlier quoted context omitted.
There is no level on anonymity, either you are, or you are not. Addendum for achievement: Connect to Tor from a public accessible network/wifi that is free from surveillance using a pristine installation and never use that network-device again. Addendum 2: If you use the network device twice, you may achieve only pseudonymity.
Valid point that anonymity is a binary property, but, if you wanted to talk about levels you could perhaps measure the level of difficulty of finding your identity, or the likelihood of accurately doing so.
If you choose to communicate a second time from the same endpoint with the same equipment you may achieve only pseudonymity.
Since Tor doesn't limit the encapsulated protocols, it depends on the implementation and awareness of the user and you can't put a number or percentage on that.
Imho the Tor-role has changed, it provides access against censorship, DPI, region-partioning and hidden services. Simply try to access youtube or any other global service via different tor exits, that may be intresting, not from an anonymity point of view.
I think this is misleading. I now believe that the NSA has the private keys for substantially all SSL certs in use, and I expect that a non-trivial percentage of Tor nodes are run by the government. SSL certs require cooperation of a trusted registrar even for the biggest companies -- Google's is signed by Equifax, for example. Given what we've seen in the last few days, requesting keys from the root CAs is a no-brai…
Getting a root's key does not enable them to decrypt the traffic. Getting the server's SSL private key USUALLY means you can retroactively decrypt, but it is possible (though uncommon) for servers to be configured to use ephemeral keys (EDH modes) which provide perfect forward secrecy (that is, the property that the session key can't be recovered even with later compromise of the server's long-term key).
Interesting sidenote: AFAIK there are no widely-supported (TLS 1.1 or below) methods of mitigating the BEAST attack while enabling PFS - those modes are TLS 1.2+ which isn't widely spoken yet.
This is all irrelevant though. The issue is with the tech companies giving them the plaintext data themselves. No amount of transport-layer encryption helps with that.
You have to stop using US services.
I think this is misleading. I now believe that the NSA has the private keys for substantially all SSL certs in use, and I expect that a non-trivial percentage of Tor nodes are run by the government. SSL certs require cooperation of a trusted registrar even for the biggest companies -- Google's is signed by Equifax, for example. Given what we've seen in the last few days, requesting keys from the root CAs is a no-brai…
> SSL certs require cooperation of a trusted registrar even for the biggest companies -- Google's is signed by Equifax, for example. Given what we've seen in the last few days, requesting keys from the root CAs is a no-brainer. Getting a root's key does not enable them to decrypt the traffic. Getting the server's SSL private key USUALLY means you can retroactively decrypt, but it is possible (though uncommon) for ser…
Earlier quoted context omitted.
A key thing to point out, all a root CA does is verify your public key. The NSA can't get Google's private key from Equifax and they can't even impersonate Google if the end user is using Chrome even if Equifax signed a cert for them. The reason is because Chrome basically checks to see if the cert matches up with a known good copy. Also, if your platform supports it, Gmail has perfect forward secrecy meaning that ev…
I was under the impression having the ability to subpoena a key or cert from either the CA or the company issued the cert would give the NSA carte blanche on decrypting any (encrypted) data they may have gathered by other means. Since I don't seem to be understanding the associated technology as well as I thought I was, could you point me towards some relevant reading on this topic? How/Why are the current implementa…