PRISM fears give private search engine DuckDuckGo its best week ever

Post by dllthomas » Fri, Jun 14, 2013, 12:50 AM UTC

jerf wrote: post #94

paulsutter wrote: post #56

It's not safe to assume the NSA doesn't log DDG searches. Look at the PRISM logo - it's a beam splitter. Read the slide, look at the "Upstream" portion. http://commons.wikimedia.org/wiki/File:Upstream_slide_of_the... They're logging all your URLs and headers. How much are you willing to bet they can't decrypt https? I dont understand all the hubbub _is focused solely_ on direct server access (the bottom half of the s…

"How much are you willing to bet they can't decrypt https?" I'd bet quite a bit, though not "my life", that they do not have a generalized "read everything" ability for all forms of SSL. They may have what cryptographers would call "a crack", but that's a low bar, and doesn't prove they have a practical attack. However, DDG is currently using 128-bit RC4, which is very weak. [1] I wouldn't care to bet anything that t…

Post by dllthomas » Fri, Jun 14, 2013, 12:52 AM UTC

bigiain wrote: post #113

lurkinggrue wrote: post #69

Earlier quoted context omitted.

Email is unencrypted in transit.

That's not universally true - there's a remarkable amount of TLS/SSL encrypted email-in-transit, either via STARTTLS ESMTP commands or SSL over port 465 (and 993/995 for IPAM and POP3). I don't think there's a way to guarantee your mail always travels over TLS/SSL secured connections, but I suspect more of it does than you think.

Post by skeletonjelly » Fri, Jun 14, 2013, 12:56 AM UTC

eridius wrote: post #89

lurkinggrue wrote: post #69

Earlier quoted context omitted.

Email is unencrypted in transit.

What does that have to do with using a search engine? I'm pretty sure you aren't emailing them your queries.

Post by bigiain » Fri, Jun 14, 2013, 12:59 AM UTC

brvs wrote: post #122

bigiain wrote: post #116

Earlier quoted context omitted.

Why do you trust any binaries you've got? Where did your first-use/bootstrapping compiler come from? And even if you wrote your own OS and compiler from the ground up - who wrote your BIOS? Your network card firmware? Your disk controller software? Your CPU microcode? We _all_ abdicate our trust-chain _somewhere_

This is why it's important to look at PRISM as a political issue and not merely a technical one, like I see a ton of people doing now. The best solution to government spying isn't to tell everyone to use Linux and DuckDuckGo, it's to change the spying itself.

Post by icebraining » Fri, Jun 14, 2013, 1:07 AM UTC

jerf wrote: post #94

paulsutter wrote: post #56

It's not safe to assume the NSA doesn't log DDG searches. Look at the PRISM logo - it's a beam splitter. Read the slide, look at the "Upstream" portion. http://commons.wikimedia.org/wiki/File:Upstream_slide_of_the... They're logging all your URLs and headers. How much are you willing to bet they can't decrypt https? I dont understand all the hubbub _is focused solely_ on direct server access (the bottom half of the s…

"How much are you willing to bet they can't decrypt https?" I'd bet quite a bit, though not "my life", that they do not have a generalized "read everything" ability for all forms of SSL. They may have what cryptographers would call "a crack", but that's a low bar, and doesn't prove they have a practical attack. However, DDG is currently using 128-bit RC4, which is very weak. [1] I wouldn't care to bet anything that t…