5 ms·
That's wonderful you are willing to help everybody (seriously). But, I think people need to be aware that it's not just email: "The intrusive device is capable
by garraeth 11y ago
That's wonderful you are willing to help everybody (seriously).
But, I think people need to be aware that it's not just email: "The intrusive device is capable of capturing and analyzing all network traffic to and from the Berkeley campus, and has enough local storage to save over 30 days of all this data ("full packet capture"). This can be presumed to include your email, all the websites you visit, all the data you receive from off campus or data you send off campus."
Is there anything we can do to protect ourselves from, say, posting something into a HN forum? Or any chat program? Or FB chat, etc...?
- jsprogrammer 11y ago>Is there anything we can do to protect ourselves from, say, posting something into a HN forum? Or any chat program? Or FB chat, etc...? TLS or other encryption. However, if they [UCOP, vendor, other] get your key(s) they will be able to read archived traffic.
- nsgi 11y agoNot with Perfect Forward Secrecy
- jsprogrammer 11y agoPFS just adds additional keys.
- mehrdada 11y agoKeys that are supposedly short-lived on the client and the server. And if you are assuming they already control the client or the server endpoint, then the entire discussion is moot, but considering we are talking about archived packets at a router interface, the parent comment is very valid.
- jsprogrammer 11y agoIt is certainly valid, but is also covered by my original case. I just wanted to be explicit about the connection between the posts.
- lallysingh 11y agoSNI still identifies the hostname rather well.
- dylz 11y agoI VPN to a trusted host (colo) when on airbears2/calvisitor.
- kuschku 11y agoHow can the host be trusted? Are we sure the NSA doesn’t just do the very same thing to the network the host is connected to?
- dylz 11y agoThey probably do, but frames of reference - this is outside of my threat model. By "trusted" I mean something you reasonably control, not things like like privateinternetaccess/the next cheap vpn/FREE TORRENT SUPER PRIVACY STEALING NSA VPN/etc.
- pdkl95 11y ago> capturing and analyzing all network traffic > 30 days of ... "full packet capture" Also known as "XKEYSCORE".
- dmix 11y agoNot quite true, XKEYSCORE [1] is the GUI layer application for navigating the data using selectors. The UC systems sounds more like the job of TURMOIL [2] and other middleman taps that feed data into selector filtering systems, decrypt information, and allow injection of content into network traffic. Also notably, a system like this in such a privileged place on the network has potential to go beyond simply surveillance and can be used for offensive purposes by injecting malicious content. Especially if control of the system falls into the wrong hands. These types of risks which come about by introducing a tap like this are rarely considered, people tend to focus on the passive data surveillance side as the primary issue. But as a student or faculty, I'd be more concerned about the distribution of malware. Many foreign actors (basically, China) could exploit it to steal research information from students and faculty. PGP emails wouldn't protect against a rootkit. [1] https://en.wikipedia.org/wiki/XKeyscore https://en.wikipedia.org/wiki/XKeyscore [2] https://en.wikipedia.org/wiki/Turbulence_%28NSA%29 https://en.wikipedia.org/wiki/Turbulence_%28NSA%29
- zrm 11y ago> Is there anything we can do to protect ourselves from, say, posting something into a HN forum? Or any chat program? Or FB chat, etc...? Tor.
- Balgair 11y agoMaybe, but if you log in via their wireless or a hard connection you still have to go through their routers. I imagine that is the point of archival. I say this with a barest understanding of how the TOR browser interfaces with your computer, the local routers, and the internet at large. If someone is knowledgeable, please, let us all know: can the UC archive if you use TOR? If not, this is a good work around while the courts take their time.
- zrm 11y agoThe local router should only see something that looks like a TLS encrypted connection to a Tor relay.
- mavhc 11y agoCould start sending petabytes of data to other researchers at other universities, swamp the system. Otherwise use TLS for everything, seems like HN, and all chat programs do already
- julian_1 11y agoSSL interception/MIM is a thing if the OS images (eg. on campus hardware) are prepared with the browser certs to enable it.
- mavhc 11y agoTrue, but a) you'd be able to check that (unless they're crazy good and have altered all the apps too), b) they can't retroactively add it, c) doesn't work for BYOD, and d) not sure how it works in usa, but in uk it's often the case that each department runs its own IT