Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google Security Team Member on NSA: "Fuck These Guys"

plus.google.com

Post reply on HN
Print view View original

41–50 of 420 posts

Re: Google Security Team Member on NSA: "Fuck These Guys"

#41

Post by lawnchair_larry »

tantalor wrote: post #15
babar wrote: post #12

Earlier quoted context omitted.

Why do people assume the Chinese government is not able to use similar techniques?

The Chinese were targeting specific journalists and critics. Presumably to harass them. I'm not saying the US doesn't do that, but the evidence is not as clear.

They weren't actually. Google lied about that. It came out later that the real reason for the Chinese hacking gmail was to see which accounts had "lawful intercept" on them so they would know if their own spies had their cover blown. If the US knew about their spies, it was assumed that they would see the US sniffing the spies gmail accounts.

http://articles.washingtonpost.com/2013-05-20/world/39385755...

Re: Google Security Team Member on NSA: "Fuck These Guys"

#43

Post by Amadou »

digitalboss wrote: post #26
SCdF wrote: post #6

This has been asked before, but I'd love to hear from a dev (anonymously of course) who actually helped build this NSA madness. Is it like The Cube, where no one really knew what each piece was for? Is it that they are morally pro the NSA's attitude toward personal and corporate privacy, or do they just not care either way?

I asked this question 6 months ago, I liked the reply. ---- Most programmers are very much unlike you or I. Think about those legions of DoD/DoD contractor engineers that trust government implicitly and totally, and really don't give a shit about more "hacker"/"technologist" subjects. ---- https://news.ycombinator.com/item?id=5836416

The other half of that equation is that the requirements for a security clearance tend to filter out the people who are mentally predisposed to question authority.

It is a very rare person who can see all the things wrong with the various Wars on Dignity (drugs, terror, etc) and yet has a nose so clean as to qualify for a top secret clearance. It's kind of like the saying about walking a mile in someone else's shoes before you criticize them - most people just can't conceive of what life is like for someone with an entirely different set of experiences and the logic of authoritarianism is so deceptively simple.

That's not to say that the people with clearances aren't perceptive, just that they are likely to have a focus on other, more technical, issues.

Re: Google Security Team Member on NSA: "Fuck These Guys"

#45

Post by vinkelhake »

acqq wrote: post #39
vinkelhake wrote: post #23

Earlier quoted context omitted.

The RPC protocol is stated to be based on protocol buffers so the encoding is known. What you would need to do to reverse engineer it is coming up with matching message descriptions. But, even without that piece of the puzzle, reverse engineering a protocol that doesn't use encryption wouldn't be "extremely difficult". This is not an indication of an inside man. https://developers.google.com/protocol-buffers/docs/ove…

The only published information is how the values are encoded, not what is encoded (the specifications aren't transported together with the data) so to crack 1622 different protocols only involved in authorization according to the NSA slide is not such a small task, at least if they are interested in more than just recognizing e-mail addresses which can be found using regexps. And just counting the protocols proves th…

Yes, that's what I meant with "message descriptions". It's definitely not a small task, but again not something that I would say is extremely hard. It's just a lot of work.

I'm curious what 1622 represents here. 1622 different protocols, each with their different messages? Seems like a crazy amount. 1622 different message types for authorization? Even that seems like a stretch.

Re: Google Security Team Member on NSA: "Fuck These Guys"

#46

Post by frank_boyd »

ChuckMcM wrote: post #3

I wondered about that traffic, and getting confirmation from the source that the only way the NSA could have it would be by tapping into the internal network is as quite damning. Google has the best OpSec team I've ever known, it is my hope that they close this 'loophole' as completely as possible.

We still don't know if that was really a loophole or rather access given by Google (of course, they will decline that).

Re: Google Security Team Member on NSA: "Fuck These Guys"

#47

Post by kika »

maaku wrote: post #33
wmf wrote: post #13

Earlier quoted context omitted.

I would assume they use similar techniques within China and perhaps allied countries like North Korea and Cuba, but the US is performing wiretapping in at least the UK, Canada, Australia, and New Zealand. Also, how much non-Chinese Internet traffic passes through China?

> and perhaps allied countries like North Korea and Cuba Nobody is more distrusting of each other than two communist countries.

Well, when you eat off the hand of the other country you don't have much choice. Nobody actually asks you if you trust or not.

Re: Google Security Team Member on NSA: "Fuck These Guys"

#48

Post by justin66 »

thex86 wrote: post #9

Appreciate Mike speaking up like this. We need more people within the industry to speak up. Not just hackers. (People within these companies are also hackers, but they have more effect when they speak because they are part of a company)

I agree, but I do wonder what is going to happen when people start speaking up to say something quite the opposite. "I don't speak for my employer, but I think the NSA is quite awesome and I don't mind that they've been listening to us at all." Or something to that effect.

The clash might be interesting to watch.

Re: Google Security Team Member on NSA: "Fuck These Guys"

#49

Post by rurounijones »

Given the snippet of traffic involved, can they make an educated guess which links were compromised to get it? (It is DB replication traffic so if you know the source DB and the dest DB then you can work out the route... in theory anyway, with Google Complexity, who knows...)
Post reply on HN