3 ms·

A couple of things: 1)how sure can we be that switching to SSL really got rid of the sniffing going on? I'm asking because I assume that it's totally within th

by pilif 16y ago

A couple of things: 1)how sure can we be that switching to SSL really got rid of the sniffing going on? I'm asking because I assume that it's totally within the capabilities of the government to sneak-install a CA certificate on clients. Or they don't bother and trust people to just click through the security warning. 2) is that "identify your friends" check maybe a bit pointless as the needed answers can probably be determined using data from already hacked accounts. 3) playing devil's advocate here: if the laws of Tunesia allow for the government to do such things, is it Facebooks place to violate those laws? And: could they be pressed into giving away that data anyways due to political pressure from wherever? I wouldn't use Facebook to post anything that I would not want a third party to see - unless I encrypted it beforehand.

edanm 16y ago
About 2), I'm not sure how that's possible. I've written details of the method that I think they used in another comment, but basically, they're showing you tagged pictures of friends and asking you who it is. A computer will be unable to translate the picture of a friend to a name.
- PakG1 16y ago
  Why not? Facial recognition algorithms are becoming common features. I'm not saying the Tunisian government would have had the ability to drum up a hack like that, but the concept has been proven possible by several independent entities.
  - tonfa 16y ago
    At this point of complexity, it might be easier for them to get a valid cert and mitm everything.
gojomo 16y ago
These matters aren't binary and solutions don't have to work for all time; raising the sophistication and effort required to bulk-compromise accounts for now is a worthwhile goal. Of course requiring SSL won't save people from widely-trusted rogue CAs, ignoring all security warnings, or even very active man-in-the-middle attacks which hide from users that SSL was ever being required. But each of those attacks requires a larger investment than tampering with a plain HTTP page. Same with the social verifier: if the agents had already studied a specific person's network of friends, and need to break that one account, with effort they can. But their previous automatic dragnet was broken. Facebook may have been in a stickier position if the Tunisian government had attempted a superficially 'legal' demand for user information. But the government didn't. And even if it had, unless Facebook has Tunisian offices/hosting, the government's pull over what Facebook does on its US-based servers would be very limited. To even try ordering Facebook around would have worsened the domestic discontent. (The article reports that it was rumored at one point Facebook would be blocked nationwide.)

by pilif 16y ago

edanm 16y ago

About 2), I'm not sure how that's possible. I've written details of the method that I think they used in another comment, but basically, they're showing you tagged pictures of friends and asking you who it is. A computer will be unable to translate the picture of a friend to a name.

PakG1 16y ago
Why not? Facial recognition algorithms are becoming common features. I'm not saying the Tunisian government would have had the ability to drum up a hack like that, but the concept has been proven possible by several independent entities.
- tonfa 16y ago
  At this point of complexity, it might be easier for them to get a valid cert and mitm everything.

gojomo 16y ago

These matters aren't binary and solutions don't have to work for all time; raising the sophistication and effort required to bulk-compromise accounts for now is a worthwhile goal. Of course requiring SSL won't save people from widely-trusted rogue CAs, ignoring all security warnings, or even very active man-in-the-middle attacks which hide from users that SSL was ever being required. But each of those attacks requires a larger investment than tampering with a plain HTTP page. Same with the social verifier: if the agents had already studied a specific person's network of friends, and need to break that one account, with effort they can. But their previous automatic dragnet was broken. Facebook may have been in a stickier position if the Tunisian government had attempted a superficially 'legal' demand for user information. But the government didn't. And even if it had, unless Facebook has Tunisian offices/hosting, the government's pull over what Facebook does on its US-based servers would be very limited. To even try ordering Facebook around would have worsened the domestic discontent. (The article reports that it was rumored at one point Facebook would be blocked nationwide.)