Yahoo scanned customer emails for US intelligence • Hacker News Board

Re: Yahoo scanned customer emails for US intelligence

#71

Post by kafkaesq » Tue, Oct 04, 2016, 7:00 PM UTC

tptacek wrote: post #47

utefan001 wrote: post #38

Earlier quoted context omitted.

Don't forget this story. Qwest CEO Joseph Nacchio who claims to have resisted NSA spying is out of prison (2013) https://www.washingtonpost.com/news/the-switch/wp/2013/09/30...

Nacchio is no hero. He ran a $50MM pump-and-dump scam that personally netted him millions of dollars in profits at the expense of common shareholders, and he was indicted in a wave of similar prosecutions in the wake of the Enron fiasco. His offenses are there in black and white: with full knowledge that his company faced materially adverse changes unknown to his investors, he not only promoted the company but privat…

People like Nacchio are exploiting the good work real privacy advocates do, for their own personal enrichment.

Or it's possible for people to be dual-natured: capable both of flagrant chicanery and abuse, as well as acts of conviction and principled defiance.

Re: Yahoo scanned customer emails for US intelligence

#72

Post by Zigurd » Tue, Oct 04, 2016, 7:02 PM UTC

Some people here laud some companies for being good about user privacy and security. This shows they have not yet reached table stakes for privacy and security.

This is why no provider can be trusted. Every routine communication should be e2e encrypted. Otherwise this WILL happen.

Re: Yahoo scanned customer emails for US intelligence

#73

Post by pkaeding » Tue, Oct 04, 2016, 7:02 PM UTC

Yahoo was attributing its recently announced data breach to state-sponsored attackers.... Maybe that wasn't so far off the mark after all.

Re: Yahoo scanned customer emails for US intelligence

#74

Post by zmanian » Tue, Oct 04, 2016, 7:03 PM UTC

This is substantially worse than PRISM which operates on individual targeted persons and the upstream Verizon, AT&T program which collects plaintext over the public Internet.

This involved bulk search of data past the decryption layer.

Re: Yahoo scanned customer emails for US intelligence

#75

Post by tptacek » Tue, Oct 04, 2016, 7:04 PM UTC

kafkaesq wrote: post #71

tptacek wrote: post #47

Earlier quoted context omitted.

Nacchio is no hero. He ran a $50MM pump-and-dump scam that personally netted him millions of dollars in profits at the expense of common shareholders, and he was indicted in a wave of similar prosecutions in the wake of the Enron fiasco. His offenses are there in black and white: with full knowledge that his company faced materially adverse changes unknown to his investors, he not only promoted the company but privat…

People like Nacchio are exploiting the good work real privacy advocates do, for their own personal enrichment. Or it's possible for people to be dual-natured: capable both of flagrant chicanery and abuse, as well as acts of conviction and principled defiance.

The entangling of the FISA order and the insider trading scandal actually makes things worse. His most significant trades came just months after he refused the FISA order --- after which he claims NSA arranged to have DoD contracts with Qwest terminated. He did something with an obvious material impact on his shareholders, and secretly profited from it.

The reality, though, is that his tenure at Qwest appears broadly similar to the kinds of bullshit that was rife in corporate America at the time: accounting scandals, entirely unrelated to Qwest's government contracts, that boosted apparent growth and drove share prices higher than the fundamentals of the business could possibly justify.

Google, for instance, [qwest kmc telecom].

Re: Yahoo scanned customer emails for US intelligence

#76

Post by mason240 » Tue, Oct 04, 2016, 7:06 PM UTC

zmanian wrote: post #34

rdl wrote: post #22

I was honestly a bit unhappy when Stamos left Yahoo in the middle of a bunch of (what seemed like) cool projects for users -- seemed like he was just jumping ship from an objectively pretty crappy company to a continuing-to-accelerate rocketship, presumably for career reasons. However, if it went down like this -- he did probably the least destructive thing possible. I probably would have gone public or done somethin…

This should forever taint Marissa Meyer's reputation. Failure to save Yahoo is understandable. Disregard for user privacy and safety at this scale is unforgivable.

Did they really have a choice? It's pretty much a given now that 3-letter agencies get firehose access to any data they want.

Re: Yahoo scanned customer emails for US intelligence

#77

Post by kafkaesq » Tue, Oct 04, 2016, 7:06 PM UTC

kefka wrote: post #15

Lets take it a different way: You're knowingly sending your data to a 3rd party. You're not encrypting. It's not through the USPS (special protections). It seems bloody evident that, of course, your email provider can read your emails! Unless you're encrypting with GPG, then they can (and they can still read the signing keys). Yahoo, Google, and friends all scan, dedup, and all sorts of tricks to determine marketing…

I'd like to hear a discussion about the "Secrecy of text written on postcards"....

In a nutshell, there's a near-consensus (if I'm not mistaken) among judicial experts that in fact, email has the same expectations of privacy as regular, sealed postal mail (i.e. not postcards). So that's where the postcard analogy breaks down.

Re: Yahoo scanned customer emails for US intelligence

#78

Post by Zigurd » Tue, Oct 04, 2016, 7:07 PM UTC

bitmapbrother wrote: post #63

zzzcpan wrote: post #56

Earlier quoted context omitted.

Google is definitely in cahoots with the government and probably way deeper than Yahoo. Why would you even assume otherwise, given how much ties to the government they expose to the public these days?

Why would you assume they are? Do you have any proof to backup your theory? And try to provide actual proof.

> Why would you assume they are?

Because the odds of Yahoo being exceptionally bad and anyone else being exceptionally good about this are extremely low. The intelligence agency doing this wants 100% coverage - it would be absurd not to. Everyone has been told to do this.

Re: Yahoo scanned customer emails for US intelligence

#79

Post by chc » Tue, Oct 04, 2016, 7:07 PM UTC

duaneb wrote: post #5

mtgx wrote: post #4

Earlier quoted context omitted.

Sounds like she was a pretty terrible CEO all-around. But as a user, I would never use a service run by Marissa Mayer again. She lost that trust for good.

> But as a user, I would never use a service run by Marissa Mayer again. She lost that trust for good. Realistically, this is every American company. Why trust anyone?

It is impossible to live functionally in society without trusting someone on some level.

Re: Yahoo scanned customer emails for US intelligence

#80

Post by suprgeek » Tue, Oct 04, 2016, 7:08 PM UTC

The scariest part of the whole piece answers this question: Why are back doors with secret keys a BAD idea?

"... he had been left out of a decision that hurt users' security, the sources said. Due to a programming flaw, he told them hackers could have accessed the stored emails...."

The CEO of Yahoo must have known that this kind of scanning and storage puts their users at risk. She choose to do it anyway as being the path of least resistance against a more powerful adversary (US govt.). Bad judgement compounded by zero spine... Verizon looks like the perfect fit.