5 ms·

VPN will not protect your privacy, as VPN providers are monitored by state police and VPN protocols have been broken and backdoored by intelligence agencies (as

VPN will not protect your privacy, as VPN providers are monitored by state police and VPN protocols have been broken and backdoored by intelligence agencies (as disclosed in the Snowden Documents).

EugeneOZ 10y ago
just setup own vps with vpn and use encryption
- jwtadvice 10y ago
  https://en.wikipedia.org/wiki/Karma_Police_(surveillance_program) https://en.wikipedia.org/wiki/Karma_Police_(surveillance_pro... The GCHQ sit on the internet infrastructure, decrypt TLS sessions, and correlate accounts and activity to individual granularity. The backbone of the internet is tapped, including from the termination of IPSEC/IKE into your VPN out to the internet again. Giving the advice to people to "use encryption" and "use VPN" is going to get people killed. Please, be responsible.
  - EugeneOZ 10y ago
    Decrypt tls sessions? Please fuck off.
    - xorxornop 10y ago
      They do, if your connection can be forced into using a low grade cipher, or you made the mistake of allowing DH[E] with a common group. Both mistakes which were (are?) common, incidentally. They were decrypting a good fraction of global TLS traffic not so long ago...
      - EugeneOZ 10y ago
        It's social engineering, not tls decryption.
        jwtadvice 10y ago
        If you go down that route, convincing the public to use and standardizing backdoored and broken cryptography would also count as social engineering. The communications are decrypted. This is done through a combination of backdoored cryptography, state of the art cryptanalysis, and mass social engineering (propaganda). Namely, you're not proposing something that's mutually exclusive to decryption of data.
        EugeneOZ 10y ago
        I wrote what I wanted to write, enough with sophisms.
        jwtadvice 10y ago
        I understand that you wrote what you wanted to write. Unfortunately what you wrote was FUD in the worst case and misinformed in the best. Anyway I think we both are at a point where we understand the other's point of view. Thank you for the conversation. I believe we both hope a lot of HN folks will stumble over it over the next few days. :)
        EugeneOZ 10y ago
        And again you are trying to offend me even when i'm trying to stay calm in this conversation. And it's all just because I recommended to use encryption, lol. Fuck off and bye.
        jwtadvice 10y ago
        Eugene. We agree about the need to use encryption. We disagree about it's limitations, and how to use it effectively. Unfortunately this isn't a theoretical debate. Journalists, for example, around the world are being killed at increasing rates by governments, with this year reaching an all time high. State surveillance is an issue of tremendous importance for civil rights and personal freedoms. Our conversation and recommendations have to be sober and give candid, informed advice. I think you absolutely have the right motivations: to encourage people to protect themselves from state coercion and violence.
    - jwtadvice 10y ago
      Oh there's a ton of ways to do it, from stripping, downgrade attacks, backdoored constants, precomputed tables for low order groups, shadow ca certs, etc. I recommend reading the Snowden Documents, which disclosed a number of successful at-scale attacks on the PKI infrastructure. I find it surprising there's so much ignorance in the Hacker News community about the state of encryption, especially given the newsworthiness of the Snowden Disclosures. I also find the prevalence of 'shoot the messenger' regarding HN folks getting angry at me for pointing out publicly known issues with the current practice of commercial and consumer encryption.
      - EugeneOZ 10y ago
        Quote from his documents about tls DECRYPTION (exactly decryption) would be much more convincing than "oh there is a ton".
        jwtadvice 10y ago
        Sure, there's been good journalist work compiling the state of the art here: http://www.spiegel.de/international/world/nsa-documents-attacks-on-vpn-ssl-tls-ssh-tor-a-1010525.html http://www.spiegel.de/international/world/nsa-documents-atta... But also, being familiar with the cryptography you are attempting to have conversation about is a basic starter. For example, there were attacks listed in the prior comment following the "oh there's a ton" header. You seemed to have glazed past those, but they are familiar topics to those who habituate themselves with the technicalities of cryptography and its practice.
        EugeneOZ 10y ago
        Thanks for the link. I've read all of the docs (presentations slides) related to ssl/tls and found only one weak point (Debian sessions). And none of them have information about decryption of collected traffic - collected encrypted traffic is useless, only possible (at this moment) way is to intercept multiple things in live mode and try to decode data. It's sad, but I'm still saying "use encryption", because alternative is "don't use encryption" and it's obviously worse. So I'm much more responsible than those who are trying to propose second option.
  - jamez1 10y ago
    >decrypt TLS sessions How do they do that? Do you understand how TLS works? They would have to MITM every session, and it would be immediately obvious as the key exchange wouldn't line up. Unless you're implying they've found a way to solve the discrete logarithm problem?

VPN will not protect your privacy, as VPN providers are monitored by state police and VPN protocols have been broken and backdoored by intelligence agencies (as disclosed in the Snowden Documents).

EugeneOZ 10y ago

just setup own vps with vpn and use encryption

jwtadvice 10y ago
https://en.wikipedia.org/wiki/Karma_Police_(surveillance_program) https://en.wikipedia.org/wiki/Karma_Police_(surveillance_pro... The GCHQ sit on the internet infrastructure, decrypt TLS sessions, and correlate accounts and activity to individual granularity. The backbone of the internet is tapped, including from the termination of IPSEC/IKE into your VPN out to the internet again. Giving the advice to people to "use encryption" and "use VPN" is going to get people killed. Please, be responsible.
- EugeneOZ 10y ago
  Decrypt tls sessions? Please fuck off.
  - xorxornop 10y ago
    They do, if your connection can be forced into using a low grade cipher, or you made the mistake of allowing DH[E] with a common group. Both mistakes which were (are?) common, incidentally. They were decrypting a good fraction of global TLS traffic not so long ago...
    - EugeneOZ 10y ago
      It's social engineering, not tls decryption.
      - jwtadvice 10y ago
        If you go down that route, convincing the public to use and standardizing backdoored and broken cryptography would also count as social engineering. The communications are decrypted. This is done through a combination of backdoored cryptography, state of the art cryptanalysis, and mass social engineering (propaganda). Namely, you're not proposing something that's mutually exclusive to decryption of data.
        EugeneOZ 10y ago
        I wrote what I wanted to write, enough with sophisms.
        jwtadvice 10y ago
        I understand that you wrote what you wanted to write. Unfortunately what you wrote was FUD in the worst case and misinformed in the best. Anyway I think we both are at a point where we understand the other's point of view. Thank you for the conversation. I believe we both hope a lot of HN folks will stumble over it over the next few days. :)
        EugeneOZ 10y ago
        And again you are trying to offend me even when i'm trying to stay calm in this conversation. And it's all just because I recommended to use encryption, lol. Fuck off and bye.
        jwtadvice 10y ago
        Eugene. We agree about the need to use encryption. We disagree about it's limitations, and how to use it effectively. Unfortunately this isn't a theoretical debate. Journalists, for example, around the world are being killed at increasing rates by governments, with this year reaching an all time high. State surveillance is an issue of tremendous importance for civil rights and personal freedoms. Our conversation and recommendations have to be sober and give candid, informed advice. I think you absolutely have the right motivations: to encourage people to protect themselves from state coercion and violence.
  - jwtadvice 10y ago
    Oh there's a ton of ways to do it, from stripping, downgrade attacks, backdoored constants, precomputed tables for low order groups, shadow ca certs, etc. I recommend reading the Snowden Documents, which disclosed a number of successful at-scale attacks on the PKI infrastructure. I find it surprising there's so much ignorance in the Hacker News community about the state of encryption, especially given the newsworthiness of the Snowden Disclosures. I also find the prevalence of 'shoot the messenger' regarding HN folks getting angry at me for pointing out publicly known issues with the current practice of commercial and consumer encryption.
    - EugeneOZ 10y ago
      Quote from his documents about tls DECRYPTION (exactly decryption) would be much more convincing than "oh there is a ton".
      - jwtadvice 10y ago
        Sure, there's been good journalist work compiling the state of the art here: http://www.spiegel.de/international/world/nsa-documents-attacks-on-vpn-ssl-tls-ssh-tor-a-1010525.html http://www.spiegel.de/international/world/nsa-documents-atta... But also, being familiar with the cryptography you are attempting to have conversation about is a basic starter. For example, there were attacks listed in the prior comment following the "oh there's a ton" header. You seemed to have glazed past those, but they are familiar topics to those who habituate themselves with the technicalities of cryptography and its practice.
        EugeneOZ 10y ago
        Thanks for the link. I've read all of the docs (presentations slides) related to ssl/tls and found only one weak point (Debian sessions). And none of them have information about decryption of collected traffic - collected encrypted traffic is useless, only possible (at this moment) way is to intercept multiple things in live mode and try to decode data. It's sad, but I'm still saying "use encryption", because alternative is "don't use encryption" and it's obviously worse. So I'm much more responsible than those who are trying to propose second option.
- jamez1 10y ago
  >decrypt TLS sessions How do they do that? Do you understand how TLS works? They would have to MITM every session, and it would be immediately obvious as the key exchange wouldn't line up. Unless you're implying they've found a way to solve the discrete logarithm problem?