17 ms·

I don't know why so many people here are patting themselves on the back over this. This is not the kind of encryption people were talking about in the 90s and 0

I don't know why so many people here are patting themselves on the back over this. This is not the kind of encryption people were talking about in the 90s and 00s. A lot of this encryption is not point-to-point. It merely secures user's interaction with some middleman (or their server). What would the numbers be if you subtracted all the traffic that can be snooped on by Google, Amazon and Cloudflare?

paxys 7y ago
The encryption is still point-to-point, just that the website you are connecting to has chosen to make their "point" AWS or Cloudflare or whatever else. You could as easily host something in your own DC or from a machine under your desk.
stjohnswarts 7y ago
What are you talking about about? I think you better look up how https/tls works??? Sure you have to trust the certificate authority. Also can you imagine the scandal that would erupt if Google or AWS cloud was discovered to be eavesdropping on companies running things in their cloud? I don't think so.
- megous 7y ago
  The point is that if you're communicating with someone via Google, encryption terminates at Google, not with the other party.
- gpm 7y ago
  > can you imagine the scandal that would erupt if Google or AWS cloud was discovered to be eavesdropping on companies running things in their cloud Remember the "SSL added and removed here" image? https://thumbs.mic.com/MTBjNTQzNTMzZiMvbWVtejZOdjJsaUdUVkZEa3I1cVgyVkRjTlFFPS8weDQwOjQ5MXgzNDkvODAweDQ1MC9maWx0ZXJzOmZvcm1hdChqcGVnKTpxdWFsaXR5KDgwKS9odHRwczovL3MzLmFtYXpvbmF3cy5jb20vcG9saWN5bWljLWltYWdlcy9kMjg1N2Q0MzliNGEwMDcyNmQwMzYwMGVjMTEzMzdkMjA2MDE4MWM2OTIzYjliN2NmYzc5ZGIyMjkxNDMwOWY0LmpwZw.jpg https://thumbs.mic.com/MTBjNTQzNTMzZiMvbWVtejZOdjJsaUdUVkZEa...
  - UncleMeat 7y ago
    That wasn't eavesdropping by Google. That was Google not using encrypted traffic on internal wires. And that changed a lot of years ago.
    - gpm 7y ago
      Yes, it was the US government eavesdropping for them without their consent, but the end result is basically the same. Yes, that exact hole was patched, but the point is it wasn't the end of the world that great grandparent implied it would be.
      - lern_too_spel 7y ago
        Google Compute Engine didn't even exist at the time that slide was made, or at least was not publicly available. That slide was about government intercepting Google's traffic, not cloud customer traffic.
        gpm 7y ago
        It was certainly smaller, but GCE was first publicly available in April/May 2013, Snowden leaked things in June 2013. I'm not quite sure when this slide was released but sometime after that. Google moved to fix the problem after the start of the leaks. Pretty quickly (good for them), but after.
        srj 7y ago
        I'm pretty sure RPC privacy boost was underway before the leaks. It was just launched more hurriedly after they came out.
        lern_too_spel 7y ago
        The slide was created long before Snowden leaked it, which is before GCE was publicly available. I said, "before the slide was made," not "before the slide was leaked."
  - 7y ago
- Hello71 7y ago
  https://en.wikipedia.org/wiki/Global_surveillance_disclosures_(2013%E2%80%93present) https://en.wikipedia.org/wiki/Global_surveillance_disclosure...
- ivoras 7y ago
  I believe the OP is talking about encryption for user data, not merely for transport. Google, Amazon, &tc still store user data uninhibited and though they are often competent about security, they also often provide data to state actors as a normal course of action. The fact the a web browser communicates safely with an endpoint doesn't mean that endpoint isn't a bad apple itself. In some cases these endpoints are logging proxies to other servers and services, and though transport is again encrypted, the data is normally accessible by operators of such services. Cloud computing has taken away the ownership of data from individuals, and that sounds like it has seeds of some kind of a revolution brewing.
  - Xorlev 7y ago
    Can you define "uninhibited"?
- wolco 7y ago
  If that was discovered nothing would happen or change. To some degree has happened with Windows 10, android/iOS for personal computing. They wouldn't monitor themselves but provide access to law agencies anyhow.
- lukeschlather 7y ago
  Google and AWS aren't eavesdropping directly. However a lot of companies are running unencrypted connections between their load balancers and their backend services. And we know from the Snowden documents the US Government does passive data collection there.
  - freeflight 7y ago
    The USG does not need to look for weak points to do passive data collection. Due to the third-party doctrine [0], they can simply demand access, don't even need a legal warrant. Because there's no reasonable expectation of privacy for data you willingly gave to third parties. [0] https://en.wikipedia.org/wiki/Third-party_doctrine https://en.wikipedia.org/wiki/Third-party_doctrine
    - lukeschlather 7y ago
      It's easier to do it quietly though. If there's unencrypted network traffic, they just need to demand access from someone with physical access to the switches, plant a listening device, and everyone with logical access will be blissfully unaware. If they want to MITM encrypted traffic they need to demand access from somebody with access to the certificates, who is going to be higher paid and more likely to speak to at least a lawyer before granting access.
svara 7y ago
You're not wrong, but the realistic alternative is having it the same way, just without any encryption.
- whydoyoucare 7y ago
  Which is fine too, since not all communication needs to be secure (even on the internet). These numbers are meaningless without a proper context and can potentially create a "security theater".
  - SlowRobotAhead 7y ago
    >Which is fine too, since not all communication needs to be secure (even on the internet). There was just an article on the front page today about "I have nothing to hide" and why it's wrong.
    - whydoyoucare 7y ago
      An example may illustrate my point: download software zip/tar files from a non-secure link. Obtain the signature and checksum files over a secure link, and verify the integrity of the software offline. Not every communication is about hiding personal stuff.
      - JoshTriplett 7y ago
        And then find that your file doesn't match, because your ISP brokenly injected a human-targeted message at the start of your download, or some proxy corrupted it by stripping out the executable (yes, this happens)... Absolutely nothing is lost by encrypting the downloaded data as well.
  - andrewmunsell 7y ago
    There's plenty of reasons to secure all communication as much as possible, regardless of the content. Even if you don't care about what your ISP sees from a privacy standpoint, they still can inject ads or other content into your webpages if the connection isn't secured (at least, from the perspective of your ISP). And this helps prevent attacks against users in coffee shops or other public, unsecured WiFi.
deleted 7y ago
[deleted]
kpU8efre7r 7y ago
Moving the goalposts.
samatman 7y ago
Several reasons: - The good is not the enemy of the perfect. - This eliminates an entire class of attacks, namely, man-in-the-middle. - A lot of (most?) user interactions require the server to know what the user wants, and it's unclear how this can happen if the server can't view the user's data.
- phonethrowaway 7y ago
  MITM is not mitigated at all by HTTPS. What makes you think that? Do you understand how certificate signing works?
  - jdormit 7y ago
    ...do you? Unless the attacker has access to the private key associated with the SSL certificate, they can't read any HTTPS traffic encrypted via that certificate - mitigating the ability of that bad actor to perform a MITM attack.
    - qvrjuec 7y ago
      The above poster is still technically correct though, getting the cert is just 1 more obstacle in the way of the attack, which isn't as much of an obstacle as one would think for some actors(see China).
      - profmonocle 7y ago
        Certificate transparency would make it blatantly obvious if Chinese CAs were issuing bogus certificates. (And if they issued certs without submitting them to CT logs they wouldn't be accepted by Chrome or Safari, so it wouldn't be very useful.) Sure, they could do it, but it wouldn't be long until there were no Chinese CAs trusted by any browser.
        judge2020 7y ago
        An attack like this could still be done for CLI clients/library clients such as curl (ie. server-to-server connections), none of which I'm aware of incorporate CT log verification.
ridaj 7y ago
The acceleration of this global trend in recent years can reasonably be attributed to the actions of one person.

paxys 7y ago

The encryption is still point-to-point, just that the website you are connecting to has chosen to make their "point" AWS or Cloudflare or whatever else. You could as easily host something in your own DC or from a machine under your desk.

stjohnswarts 7y ago

What are you talking about about? I think you better look up how https/tls works??? Sure you have to trust the certificate authority. Also can you imagine the scandal that would erupt if Google or AWS cloud was discovered to be eavesdropping on companies running things in their cloud? I don't think so.

megous 7y ago
The point is that if you're communicating with someone via Google, encryption terminates at Google, not with the other party.
gpm 7y ago
> can you imagine the scandal that would erupt if Google or AWS cloud was discovered to be eavesdropping on companies running things in their cloud Remember the "SSL added and removed here" image? https://thumbs.mic.com/MTBjNTQzNTMzZiMvbWVtejZOdjJsaUdUVkZEa3I1cVgyVkRjTlFFPS8weDQwOjQ5MXgzNDkvODAweDQ1MC9maWx0ZXJzOmZvcm1hdChqcGVnKTpxdWFsaXR5KDgwKS9odHRwczovL3MzLmFtYXpvbmF3cy5jb20vcG9saWN5bWljLWltYWdlcy9kMjg1N2Q0MzliNGEwMDcyNmQwMzYwMGVjMTEzMzdkMjA2MDE4MWM2OTIzYjliN2NmYzc5ZGIyMjkxNDMwOWY0LmpwZw.jpg https://thumbs.mic.com/MTBjNTQzNTMzZiMvbWVtejZOdjJsaUdUVkZEa...
- UncleMeat 7y ago
  That wasn't eavesdropping by Google. That was Google not using encrypted traffic on internal wires. And that changed a lot of years ago.
  - gpm 7y ago
    Yes, it was the US government eavesdropping for them without their consent, but the end result is basically the same. Yes, that exact hole was patched, but the point is it wasn't the end of the world that great grandparent implied it would be.
    - lern_too_spel 7y ago
      Google Compute Engine didn't even exist at the time that slide was made, or at least was not publicly available. That slide was about government intercepting Google's traffic, not cloud customer traffic.
      - gpm 7y ago
        It was certainly smaller, but GCE was first publicly available in April/May 2013, Snowden leaked things in June 2013. I'm not quite sure when this slide was released but sometime after that. Google moved to fix the problem after the start of the leaks. Pretty quickly (good for them), but after.
        srj 7y ago
        I'm pretty sure RPC privacy boost was underway before the leaks. It was just launched more hurriedly after they came out.
        lern_too_spel 7y ago
        The slide was created long before Snowden leaked it, which is before GCE was publicly available. I said, "before the slide was made," not "before the slide was leaked."
- 7y ago
Hello71 7y ago
https://en.wikipedia.org/wiki/Global_surveillance_disclosures_(2013%E2%80%93present) https://en.wikipedia.org/wiki/Global_surveillance_disclosure...
ivoras 7y ago
I believe the OP is talking about encryption for user data, not merely for transport. Google, Amazon, &tc still store user data uninhibited and though they are often competent about security, they also often provide data to state actors as a normal course of action. The fact the a web browser communicates safely with an endpoint doesn't mean that endpoint isn't a bad apple itself. In some cases these endpoints are logging proxies to other servers and services, and though transport is again encrypted, the data is normally accessible by operators of such services. Cloud computing has taken away the ownership of data from individuals, and that sounds like it has seeds of some kind of a revolution brewing.
- Xorlev 7y ago
  Can you define "uninhibited"?
wolco 7y ago
If that was discovered nothing would happen or change. To some degree has happened with Windows 10, android/iOS for personal computing. They wouldn't monitor themselves but provide access to law agencies anyhow.
lukeschlather 7y ago
Google and AWS aren't eavesdropping directly. However a lot of companies are running unencrypted connections between their load balancers and their backend services. And we know from the Snowden documents the US Government does passive data collection there.
- freeflight 7y ago
  The USG does not need to look for weak points to do passive data collection. Due to the third-party doctrine [0], they can simply demand access, don't even need a legal warrant. Because there's no reasonable expectation of privacy for data you willingly gave to third parties. [0] https://en.wikipedia.org/wiki/Third-party_doctrine https://en.wikipedia.org/wiki/Third-party_doctrine
  - lukeschlather 7y ago
    It's easier to do it quietly though. If there's unencrypted network traffic, they just need to demand access from someone with physical access to the switches, plant a listening device, and everyone with logical access will be blissfully unaware. If they want to MITM encrypted traffic they need to demand access from somebody with access to the certificates, who is going to be higher paid and more likely to speak to at least a lawyer before granting access.

svara 7y ago

You're not wrong, but the realistic alternative is having it the same way, just without any encryption.

whydoyoucare 7y ago
Which is fine too, since not all communication needs to be secure (even on the internet). These numbers are meaningless without a proper context and can potentially create a "security theater".
- SlowRobotAhead 7y ago
  >Which is fine too, since not all communication needs to be secure (even on the internet). There was just an article on the front page today about "I have nothing to hide" and why it's wrong.
  - whydoyoucare 7y ago
    An example may illustrate my point: download software zip/tar files from a non-secure link. Obtain the signature and checksum files over a secure link, and verify the integrity of the software offline. Not every communication is about hiding personal stuff.
    - JoshTriplett 7y ago
      And then find that your file doesn't match, because your ISP brokenly injected a human-targeted message at the start of your download, or some proxy corrupted it by stripping out the executable (yes, this happens)... Absolutely nothing is lost by encrypting the downloaded data as well.
- andrewmunsell 7y ago
  There's plenty of reasons to secure all communication as much as possible, regardless of the content. Even if you don't care about what your ISP sees from a privacy standpoint, they still can inject ads or other content into your webpages if the connection isn't secured (at least, from the perspective of your ISP). And this helps prevent attacks against users in coffee shops or other public, unsecured WiFi.

deleted 7y ago

[deleted]

kpU8efre7r 7y ago

Moving the goalposts.

samatman 7y ago

Several reasons: - The good is not the enemy of the perfect. - This eliminates an entire class of attacks, namely, man-in-the-middle. - A lot of (most?) user interactions require the server to know what the user wants, and it's unclear how this can happen if the server can't view the user's data.

phonethrowaway 7y ago
MITM is not mitigated at all by HTTPS. What makes you think that? Do you understand how certificate signing works?
- jdormit 7y ago
  ...do you? Unless the attacker has access to the private key associated with the SSL certificate, they can't read any HTTPS traffic encrypted via that certificate - mitigating the ability of that bad actor to perform a MITM attack.
  - qvrjuec 7y ago
    The above poster is still technically correct though, getting the cert is just 1 more obstacle in the way of the attack, which isn't as much of an obstacle as one would think for some actors(see China).
    - profmonocle 7y ago
      Certificate transparency would make it blatantly obvious if Chinese CAs were issuing bogus certificates. (And if they issued certs without submitting them to CT logs they wouldn't be accepted by Chrome or Safari, so it wouldn't be very useful.) Sure, they could do it, but it wouldn't be long until there were no Chinese CAs trusted by any browser.
      - judge2020 7y ago
        An attack like this could still be done for CLI clients/library clients such as curl (ie. server-to-server connections), none of which I'm aware of incorporate CT log verification.

ridaj 7y ago

The acceleration of this global trend in recent years can reasonably be attributed to the actions of one person.