At one point does the NSA become considered a terrorist organization in and of itself? It seems to me that they have stared too long into the abyss.
They already are in my book.
New NSA Leak Shows MITM Attacks Against Major Internet Services
121–130 of 149 posts
Re: New NSA Leak Shows MITM Attacks Against Major Internet Services
#122Trevor Perrin and I have been working on a dynamic certificate pinning proposal called TACK to help mitigate these types of attacks: http://tack.io In the current state of the world, we're all dependent on CA signatures for each connection we make to a website. TACK is a layer of indirection away from CA certificates, such that we'd only be dependent on CA signatures the very first time we contacted a website. It doe…
>In the current state of the world, we're all dependent on CA signatures for each connection we make to a website.
Now that you mentioned it, are those safe from say a government agency having access to the companies that serve as certificate authorities? Or is it all a house of cards, as it is now?
Re: New NSA Leak Shows MITM Attacks Against Major Internet Services
#123If you worry about the NSA spying on your company, DUMP MPLS WAN networking ASAP, it's unencrypted and basically just VLANS at layer 3.
The easiest way to snoop on all internal company data is to sniff those MPLS links at ISPs.
Re: New NSA Leak Shows MITM Attacks Against Major Internet Services
#124Trevor Perrin and I have been working on a dynamic certificate pinning proposal called TACK to help mitigate these types of attacks: http://tack.io In the current state of the world, we're all dependent on CA signatures for each connection we make to a website. TACK is a layer of indirection away from CA certificates, such that we'd only be dependent on CA signatures the very first time we contacted a website. It doe…
A point worth making here: antisurveillance technology like TACK does more than make it harder for NSA to MITM TLS. As we've apparently discovered, it also makes it possible for us to detect TLS subversion. It is, right now, a major news story if someone has obtained a malicious root certificate; we need to know when that happens and to which CAs those certs chain (which is discoverable from the certificate). If you…
I have high hopes for TACK too. The fact that it's not CA dependent is a big deal. I wrote a bit about that, and getting by with ditching the root CAs in Firefox here: https://rx4g.com/2013/09/13/of-flying-pigs-and-tofu/
Unfortunately, ditching the root CAs is way harder than it should be, and flat out impossible in a lot of environments. Compulsory trust isn't trust.
Re: New NSA Leak Shows MITM Attacks Against Major Internet Services
#125At one point does the NSA become considered a terrorist organization in and of itself? It seems to me that they have stared too long into the abyss.
They already are in my book.
Can you expand on that? Under what definition of terrorism is the NSA a terrorist organization?
It seems to me that their intent to be as clandestine as possible makes them distinctly non-terroristic.
Re: New NSA Leak Shows MITM Attacks Against Major Internet Services
#126Re: New NSA Leak Shows MITM Attacks Against Major Internet Services
#127At one point does the NSA become considered a terrorist organization in and of itself? It seems to me that they have stared too long into the abyss.
They become a terrorist organization when they target civilians to cause terror. Fortunately there's no evidence that they do.
Re: New NSA Leak Shows MITM Attacks Against Major Internet Services
#128Trevor Perrin and I have been working on a dynamic certificate pinning proposal called TACK to help mitigate these types of attacks: http://tack.io In the current state of the world, we're all dependent on CA signatures for each connection we make to a website. TACK is a layer of indirection away from CA certificates, such that we'd only be dependent on CA signatures the very first time we contacted a website. It doe…
> In the current state of the world, we're all dependent on CA signatures for each connection we make to a website. Now that you mentioned it, are those safe from say a government agency having access to the companies that serve as certificate authorities? Or is it all a house of cards, as it is now?
Some CAs make more of an effort to secure their crown jewels than others, but for the most part, it's a big house of cards.
Which is why nothing serious happens to Comodo and Verisign when they get hacked: anybody knowledgeable is already aware that a certificate means very little on its own, and we can't stop the internet anyway, so hey, life goes on.
Re: New NSA Leak Shows MITM Attacks Against Major Internet Services
#129Funny. I tried to submit the original Globo/Fantastico story to HN 4 days ago ( http://g1.globo.com/fantastico/noticia/2013/09/nsa-documents... ) but was blocked as spam. Schneier's credibility makes a lot of difference.
Of course. A simple visit to http://www.schneierfacts.com will tell you why.
Re: New NSA Leak Shows MITM Attacks Against Major Internet Services
#130Some firefox add-ons to help defend against mitm: Certificate Patrol (notifies you when certs change) https://addons.mozilla.org/en-us/firefox/addon/certificate-p... Force-TLS (force websites to always use HTTPS) https://addons.mozilla.org/en-us/firefox/addon/force-tls/ Perspectives (compare certs with peers to verify authenticity) https://addons.mozilla.org/en-us/firefox/addon/perspectives/
I've tried using Certificate Patrol, but Google and Facebook use loads of different certificates for the same URLs -- I guess it's a side-effect of large CDNs. Guess which websites I read the most? I ended up clicking Yes without reading, defeating the purpose of the tool -- a bit like what usually happens with NoScript.