7 ms·

> Amazon Chime is a communications service that transforms online meetings with a secure, easy-to-use application that you can trust. - Amazon, PRISM partner

by benevol 10y ago

tdmule 10y ago
Has this been substantiated? To my knowledge Amazon denies being a part of PRISM and the only thing a quick search reveals is that denial and Snowden criticizing Amazon for not being HTTPS by default on some of their endpoints.
- benevol 10y ago
  Have you read Snowden's Leaks? All of the major tech companies have been on board for a long time (and that was years ago). How can you believe that a giant like Amazon will somehow magically not be part of it? It's time for the country to sharpen its critical thinking skills.
  - jamesrcole 10y ago
    > All of the major tech companies have been on board and > How can you believe that [...] Amazon [isn't] part of it? I don't know what they say, but what you're saying here is unclear. Do the leaks mention Amazon or not?
    - tdmule 10y ago
      The closest I can see to someone asserting they do is https://www.mhpbooks.com/is-amazon-one-of-the-companies-working-with-the-nsa-to-spy-on-you/ https://www.mhpbooks.com/is-amazon-one-of-the-companies-work... But the thrust of that article is more suspicion that Amazon is not mentioned in the leaks and questioning the reliability of the company's word. It does cite one source, described in the article as non-mainstream, which asserts that Amazon was a part of PRISM, but that source fails to cite any leak. http://www.marketoracle.co.uk/Article40822.html http://www.marketoracle.co.uk/Article40822.html Edit: I should mention that the first article casting doubt on Amazon's reliability is published by an independent publishing company, historically an industry that has been at odds with Amazon and harmed by its business practices.
  - nl 10y ago
    All of the major tech companies have been on board for a long time (and that was years ago). I have read the Snowden leaks. This is one of those times when details matter, and in those details you are wrong. I wrote this previously[1] about Apple, but it applies here too: The problem is that PRISM has conflated two separate things, and it is unclear how much of that conflation occurred at the NSA and how much outside. Apple was (and is) compliant in the "release customer details with a court order" thing, which it seems is part of the PRISM data. However, there was a second part, where the NSA got bulk access to communications without a court order. It is unclear which companies were complicit in this part. We know Google wasn't (because the NSA slide decks show how they had to intercept Google's inter and intra-data center links which were unencrypted at the time - and Google undertook a crash program to fix that). Apple's statements are pretty clear: they say they only release information with a court order. That means they weren't complicit in bulk collection - but they may have been hacked at the time like Google was. [1] https://news.ycombinator.com/item?id=13517740 https://news.ycombinator.com/item?id=13517740
    - Pyxl101 10y ago
      Yes, this is a crucial distinction and matches my understanding from what I've read of these public documents: PRISM is a program in which the NSA intercepted Internet and other communications, and then reconstructed the meaning of those communications at a higher level -- that is, interpreting HTTP requests to Google as searches, email views, and whatever else. I did not see any evidence in the leaked documentation nor the reporting on those primary sources that the companies involved were complicit. If this evidence exists I would be very interested to know, but from Google's actions subsequent to the leaks it did not seem they agreed with the program or were complying with it, and instead took actions to oppose the program by encrypting their communications links internally, and indirectly by advocating encryption in public Internet protocols such as HTTP and SMTP.
    - nym 10y ago
      I was under the impression that Google gave bulk access to the NSA, and the NSA wiretapped them regardless. I don't have a source to substantiate that claim though.
leonroy 10y ago
Having done a lot of work with financial firms in the past, I found that they're incredibly wary of any agency having access to any of their data. As a consequence any telephony or messaging product we built had to have a self hosted deployment as part and parcel of our product offering. This meant we usually went for a Java backend which gave us great packaging and install tools. It also meant we had .deb and .rpm packages for all our products. I can't tell you how much those packages helped. Once you start bundling up your software deployments as proper versioned installation packages you become quite spoilt in the DevOps department - it's hard to use Chef/Puppet or Vagrantfiles for software installations now!
leonroy 10y ago
Having done a lot of work with financial firms in the past, I found that they're incredibly wary of any agency having access to any of their data. As a consequence any telephony or messaging product we built had to have a self hosted deployment as part and parcel of our product offering. This meant we usually went for a Java backend which gave us great packaging and install tools. It also meant we had .deb and .rpm packages for all our products. I can't tell you how much those packages helped. Once you start bundling up your software deployments as proper versioned installation packages you become quite spoilt in the DevOps department - it's hard to use Chef/Puppet or Vagrantfiles for software installations now!
leonroy 10y ago
Having done a lot of work with financial firms in the past, I found that they're incredibly wary of any agency having access to any of their data. As a consequence any telephony or messaging product we built had to have a self hosted deployment as part and parcel of our product offering. This meant we usually went for a Java backend which gave us great packaging and install tools. It also meant we had .deb and .rpm packages for all our products. I can't tell you how much those packages helped. Once you start bundling up your software deployments as proper versioned installation packages you become quite spoilt in the DevOps department - it's hard to use Chef/Puppet or Vagrantfiles for software installations now!
colmmacc 10y ago
"Amazon never participated in the NSA’s PRISM program." - Stephen Schmidt, CISO @ AWS https://aws.amazon.com/blogs/security/privacy-and-data-security/ https://aws.amazon.com/blogs/security/privacy-and-data-secur... (Full disclosure: I work on AWS}.
- deleted 10y ago
  [deleted]
  - StavrosK 10y ago
    He wouldn't voluntarily make a comment lying about it either.
    - ekianjo 10y ago
      the NSA chief had no problem to lie dirEctly in front of Congress.
    - Zach_the_Lizard 10y ago
      If it was classified information, he would likely not be able to admit it. After double checking, the slides do not mention Amazon. Amazon could be involved with spying though, just not under the same program. We'll never know for sure. What a world we live in.
    - deleted 10y ago
      [deleted]
- Zach_the_Lizard 10y ago
  And what do all the PRISM documents say? You don't admit this as it's bad for business.
  - docdendrite 10y ago
    They say corporate data centers were surreptitiously wiretapped.
  - 10y ago

> Amazon Chime is a communications service that transforms online meetings with a secure, easy-to-use application that you can trust. - Amazon, PRISM partner

by benevol 10y ago

> Amazon Chime is a communications service that transforms online meetings with a secure, easy-to-use application that you can trust. - Amazon, PRISM partner

tdmule 10y ago

Has this been substantiated? To my knowledge Amazon denies being a part of PRISM and the only thing a quick search reveals is that denial and Snowden criticizing Amazon for not being HTTPS by default on some of their endpoints.

benevol 10y ago
Have you read Snowden's Leaks? All of the major tech companies have been on board for a long time (and that was years ago). How can you believe that a giant like Amazon will somehow magically not be part of it? It's time for the country to sharpen its critical thinking skills.
- jamesrcole 10y ago
  > All of the major tech companies have been on board and > How can you believe that [...] Amazon [isn't] part of it? I don't know what they say, but what you're saying here is unclear. Do the leaks mention Amazon or not?
  - tdmule 10y ago
    The closest I can see to someone asserting they do is https://www.mhpbooks.com/is-amazon-one-of-the-companies-working-with-the-nsa-to-spy-on-you/ https://www.mhpbooks.com/is-amazon-one-of-the-companies-work... But the thrust of that article is more suspicion that Amazon is not mentioned in the leaks and questioning the reliability of the company's word. It does cite one source, described in the article as non-mainstream, which asserts that Amazon was a part of PRISM, but that source fails to cite any leak. http://www.marketoracle.co.uk/Article40822.html http://www.marketoracle.co.uk/Article40822.html Edit: I should mention that the first article casting doubt on Amazon's reliability is published by an independent publishing company, historically an industry that has been at odds with Amazon and harmed by its business practices.
- nl 10y ago
  All of the major tech companies have been on board for a long time (and that was years ago). I have read the Snowden leaks. This is one of those times when details matter, and in those details you are wrong. I wrote this previously[1] about Apple, but it applies here too: The problem is that PRISM has conflated two separate things, and it is unclear how much of that conflation occurred at the NSA and how much outside. Apple was (and is) compliant in the "release customer details with a court order" thing, which it seems is part of the PRISM data. However, there was a second part, where the NSA got bulk access to communications without a court order. It is unclear which companies were complicit in this part. We know Google wasn't (because the NSA slide decks show how they had to intercept Google's inter and intra-data center links which were unencrypted at the time - and Google undertook a crash program to fix that). Apple's statements are pretty clear: they say they only release information with a court order. That means they weren't complicit in bulk collection - but they may have been hacked at the time like Google was. [1] https://news.ycombinator.com/item?id=13517740 https://news.ycombinator.com/item?id=13517740
  - Pyxl101 10y ago
    Yes, this is a crucial distinction and matches my understanding from what I've read of these public documents: PRISM is a program in which the NSA intercepted Internet and other communications, and then reconstructed the meaning of those communications at a higher level -- that is, interpreting HTTP requests to Google as searches, email views, and whatever else. I did not see any evidence in the leaked documentation nor the reporting on those primary sources that the companies involved were complicit. If this evidence exists I would be very interested to know, but from Google's actions subsequent to the leaks it did not seem they agreed with the program or were complying with it, and instead took actions to oppose the program by encrypting their communications links internally, and indirectly by advocating encryption in public Internet protocols such as HTTP and SMTP.
  - nym 10y ago
    I was under the impression that Google gave bulk access to the NSA, and the NSA wiretapped them regardless. I don't have a source to substantiate that claim though.

leonroy 10y ago

Having done a lot of work with financial firms in the past, I found that they're incredibly wary of any agency having access to any of their data. As a consequence any telephony or messaging product we built had to have a self hosted deployment as part and parcel of our product offering. This meant we usually went for a Java backend which gave us great packaging and install tools. It also meant we had .deb and .rpm packages for all our products. I can't tell you how much those packages helped. Once you start bundling up your software deployments as proper versioned installation packages you become quite spoilt in the DevOps department - it's hard to use Chef/Puppet or Vagrantfiles for software installations now!

leonroy 10y ago

colmmacc 10y ago

"Amazon never participated in the NSA’s PRISM program." - Stephen Schmidt, CISO @ AWS https://aws.amazon.com/blogs/security/privacy-and-data-security/ https://aws.amazon.com/blogs/security/privacy-and-data-secur... (Full disclosure: I work on AWS}.

deleted 10y ago
[deleted]
- StavrosK 10y ago
  He wouldn't voluntarily make a comment lying about it either.
  - ekianjo 10y ago
    the NSA chief had no problem to lie dirEctly in front of Congress.
  - Zach_the_Lizard 10y ago
    If it was classified information, he would likely not be able to admit it. After double checking, the slides do not mention Amazon. Amazon could be involved with spying though, just not under the same program. We'll never know for sure. What a world we live in.
  - deleted 10y ago
    [deleted]
Zach_the_Lizard 10y ago
And what do all the PRISM documents say? You don't admit this as it's bad for business.
- docdendrite 10y ago
  They say corporate data centers were surreptitiously wiretapped.
- 10y ago