22 ms·

Sure, there's been good journalist work compiling the state of the art here: http://www.spiegel.de/international/world/nsa-documents-attacks-on-vpn-ssl-tls-ssh-

Sure, there's been good journalist work compiling the state of the art here: http://www.spiegel.de/international/world/nsa-documents-attacks-on-vpn-ssl-tls-ssh-tor-a-1010525.html http://www.spiegel.de/international/world/nsa-documents-atta... But also, being familiar with the cryptography you are attempting to have conversation about is a basic starter. For example, there were attacks listed in the prior comment following the "oh there's a ton" header. You seemed to have glazed past those, but they are familiar topics to those who habituate themselves with the technicalities of cryptography and its practice.

EugeneOZ 10y ago
Thanks for the link. I've read all of the docs (presentations slides) related to ssl/tls and found only one weak point (Debian sessions). And none of them have information about decryption of collected traffic - collected encrypted traffic is useless, only possible (at this moment) way is to intercept multiple things in live mode and try to decode data. It's sad, but I'm still saying "use encryption", because alternative is "don't use encryption" and it's obviously worse. So I'm much more responsible than those who are trying to propose second option.
- jwtadvice 10y ago
  Sure thing! Unfortunately I'm afraid that you missed a lot of the content! You had asked for specific documents, not news reporting that pieced the context together (for example following the code names of the various programs together to understand how the system works as a pipeline). In doing so, I'm afraid you're deeply underestimating the capabilities of the NSA, which expert analysis of the documents in question along with the technologies, related programs and internal customer requests indicate something much more startling than Debian session issues. To put a point on that: TLS is broken at scale for billions of internet browsing sessions across platforms. Give the short amount of time you've looked at the documents, I understand the misinterpretation you've arrived at. At the same time it's really impressive that you bothered to try to read the documents at all and should be commended. Please feel encouraged to continue reading. A large number of documents are hosted on edwardsnowden dot com and search functionality is provided here: https://search.edwardsnowden.com/ https://search.edwardsnowden.com/ Der Spiegel, The Guardian and The Intercept provided good analysis of the documents as they were being released and that can be found at the websites respectively. > It's sad, but I'm still saying "use encryption", because alternative is "don't use encryption" and it's obviously worse. So I'm much more responsible than those who are trying to propose second option. Yes. I agree with this. Just don't recommend this as 'enough' to people who have serious need to protect their communications. If someone is worried about their porn habits, sure. But recommending this for sensitive use (journalists, dissidents, organizers, politicians, administrators) can lead to very serious outcomes. For these cases, it is important to have frank conversations about the limitations of freely available and widely distributed tools.

EugeneOZ 10y ago

Thanks for the link. I've read all of the docs (presentations slides) related to ssl/tls and found only one weak point (Debian sessions). And none of them have information about decryption of collected traffic - collected encrypted traffic is useless, only possible (at this moment) way is to intercept multiple things in live mode and try to decode data. It's sad, but I'm still saying "use encryption", because alternative is "don't use encryption" and it's obviously worse. So I'm much more responsible than those who are trying to propose second option.

jwtadvice 10y ago
Sure thing! Unfortunately I'm afraid that you missed a lot of the content! You had asked for specific documents, not news reporting that pieced the context together (for example following the code names of the various programs together to understand how the system works as a pipeline). In doing so, I'm afraid you're deeply underestimating the capabilities of the NSA, which expert analysis of the documents in question along with the technologies, related programs and internal customer requests indicate something much more startling than Debian session issues. To put a point on that: TLS is broken at scale for billions of internet browsing sessions across platforms. Give the short amount of time you've looked at the documents, I understand the misinterpretation you've arrived at. At the same time it's really impressive that you bothered to try to read the documents at all and should be commended. Please feel encouraged to continue reading. A large number of documents are hosted on edwardsnowden dot com and search functionality is provided here: https://search.edwardsnowden.com/ https://search.edwardsnowden.com/ Der Spiegel, The Guardian and The Intercept provided good analysis of the documents as they were being released and that can be found at the websites respectively. > It's sad, but I'm still saying "use encryption", because alternative is "don't use encryption" and it's obviously worse. So I'm much more responsible than those who are trying to propose second option. Yes. I agree with this. Just don't recommend this as 'enough' to people who have serious need to protect their communications. If someone is worried about their porn habits, sure. But recommending this for sensitive use (journalists, dissidents, organizers, politicians, administrators) can lead to very serious outcomes. For these cases, it is important to have frank conversations about the limitations of freely available and widely distributed tools.