24 ms·

We often hear the complaint here that nobody cares / cared about Snowden's revelations. But to me it seems he did provide a lot of the impetus for having HTTPS

by svara 7y ago

We often hear the complaint here that nobody cares / cared about Snowden's revelations. But to me it seems he did provide a lot of the impetus for having HTTPS virtually everywhere and a lot of the instant messenging apps being end-to-end encrypted. Most of WhatsApp's users are as non-technical as it gets, and yet they use the kind of encryption that only computer enthusiasts were interested in just a couple years ago. It's a great development (all the limitations and caveats notwithstanding) IMO.

newguy1234 7y ago
Agree Snowden is significant because he was able to encourage enough people to INSIST on strong privacy/encryption. Then it all comes down to basic game theory. Why would a company ever want to release any product without strong encryption (end-to-end) when users never complain about their data being encrypted. The only reason companies don't encrypt is when they have a vested interest in spying, either in their own interest or the government's interest. Anytime I see something not have strong encryption, it is a red flag to me that something nefarious is up.
- loktarogar 7y ago
  Encryption in the last decade has also become a hell of a lot easier to implement, so "why wouldn't we just do it" has less opposition
  - ethbro 7y ago
    I think this is underappreciated. High-quality crypto libraries / systems lead to broader implementation, which makes it harder for elements in mostly-free societies to pressure implementers. It's one thing for the NSA to quietly lean on ATT (and only ATT). It's a completely different thing for them to quietly lean on 1,000 different organizations and authors. Similarly, it's easy to sneak a CALEA-alike amendment into national law when only PGP exists. It's harder when the narrative becomes "The government wants to take {beloved product used by millions} away."
- shadowgovt 7y ago
  > Why would a company ever want to release any product without strong encryption (end-to-end) when users never complain about their data being encrypted. The only reason companies don't encrypt is when they have a vested interest in spying... I think the second thought doesn't follow from the thought before it. to my experience, the main reason companies don't encrypt is because it's simply makes it that much harder to debug problems and consistently provide successful connections for users. HTTPS can fail in ways that HTTP does not. If users aren't clamoring for encryption as a feature, the main reason not to provide it is simplicity and quality of service along the axis users appear to care about. If users want encryption enough that they're willing to tolerate that sometimes browser misconfiguration or server side error will cause the connection to fail because it cannot be trusted, then companies will implement it.
- rocqua 7y ago
  I don't think I know many people who insisted on strong privacy/encryption. However, after the Snowden revelations people did consider it a preference. In that sense, it helped.
tialaramex 7y ago
BCP 188 "Pervasive Monitoring Is an Attack" sets Best Common Practice for the IETF to say that mitigating pervasive monitoring is appropriate because it's an attack on the network. So that's a pretty long way from "nobody cares". It's very carefully written, it does not propose to make a moral judgement about whether the things Snowden revealed are evil only to show that in a technical sense they were an attack and so it made sense for the network to try to mitigate them. Work like D-PRIVE (privacy for DNS) was driven by this concern, and of course it influenced a lot of other work including QUIC.
- kortilla 7y ago
  While a BCP is indication that “nobody cares” is false, it’s pretty far from even a majority of people caring. If BCPs mattered, IP spoofing wouldn’t be an issue on the Internet.
  - baxtr 7y ago
    I think the reason the majority doesn’t care is that most people can’t imagine what could happen. They’re reading my WhatsApp messages? So what? I hardly have an answer for that, except for: imagine you’d live in an authoritarian state.
    - madads 7y ago
      I like the explanation that simply explains "privacy": When you are going to the toilet, and everybody knows that your going and what you'll do there, but you still close the door (for the most of us, most of the time).
      - Spivak 7y ago
        Sure, but people close the door out of modesty not really privacy. If there was a machine that provided a written transcript of what someone did in the bathroom with no video/audio I don’t think people would mind. Like when you’re in high-security areas and have to be monitored in the bathroom there might be a door between you and your guard but no real privacy. Or when people loudly object to strip-searches at the airport but the scanner that sees everything but then only shows a cutout highlighting suspicious areas to pat down are mostly fine.
deleted 7y ago
[deleted]
Andrew_nenakhov 7y ago
Ironically, Telegram markets itself as the most private and secure messenger, but in reality, it's much less private than WhatsApp or Viber: any regular (non-secret) Telegram chats are not end-to-end encrypted - if they were, you wouldn't be able to access them from a new device after authorization with a password.
- freeflight 7y ago
  To add to the irony: Telegram has evolved in a bit of a darknet on its own where people casual share content that would be near impossible to find on the surface web.
  - x220 7y ago
    how do I get in on this?
    - dvtrn 7y ago
      First rule of fight club
      - PhasmaFelis 7y ago
        Tell all your friends while pretending that it's a secret?
    - ignoramous 7y ago
      Install the telegram app, register, and use the search button to find whatever it is that you want to. It isn't darknet in terms of anonymity; its wildnet in terms of content.
- kome 7y ago
  they are not end-to-end encrypted but they are encrypted. Also, I read that WhatsApp is going to switch to the same mode, for user convenience: https://bgr.com/2019/07/29/whatsapp-update-to-bring-multi-platform-accounts-ipad-mac-android/ https://bgr.com/2019/07/29/whatsapp-update-to-bring-multi-pl...
account73466 7y ago
He was very useful to inform the wider audience about global surveillance, make it "we already know that - boring!" and accelerate the progress of laws to extend it. In the end, this was his mission. edit: thank you for the downvote, well-informed stranger!
- blotter_paper 7y ago
  19 days before Snowden flew to Hong Kong, former FBI counter-terrorism agent Tim Clemente spilled the beans on CNN[0] (for context, informarion from a phonecall between one of the Boston Marathon bombers and his wife had been leaked to the media): >BURNETT: Tim, is there any way, obviously, there is a voice mail they can try to get the phone companies to give that up at this point. It's not a voice mail. It's just a conversation. There's no way they actually can find out what happened, right, unless she tells them? >CLEMENTE: No, there is a way. We certainly have ways in national security investigations to find out exactly what was said in that conversation. It's not necessarily something that the FBI is going to want to present in court, but it may help lead the investigation and/or lead to questioning of her. We certainly can find that out. >BURNETT: So they can actually get that? People are saying, look, that is incredible. >CLEMENTE: No, welcome to America. All of that stuff is being captured as we speak whether we know it or like it or not. This could be coincidental timing, but I've always wondered if the Snowden leak was a way of controlling the national discussion around the issue and putting an agent in place (Snowden) who could be a relatively moderate voice that the pro-privacy crowd could group around, while also creating a dramatic story with the potential for international espionage that allows pro-surveillance voices to distract from the they're-spying-on-us narrative by accusing Snowden of being a Chinese/Russian pawn. I don't feel comfortable saying Snowden is still working for the US government, but I'm certainly suspicious of him. [0]: http://transcripts.cnn.com/TRANSCRIPTS/1305/01/ebo.01.html http://transcripts.cnn.com/TRANSCRIPTS/1305/01/ebo.01.html
  - x220 7y ago
    Snowden released a large collection of documents. Judging by his interview with Joe Rogan, he's a passionate advocate for encryption and says that the US is creating a tool for complete oppression. It's harder to get more apocalyptic than that.
partiallypro 7y ago
I think this has a lot more to do with Google punishing web results without https than it does with Snowden, couple that with Cloudflare and Let's Encrypt and you have an easy path.
- 6nf 7y ago
  This is the more important factor at play here. Browsers (Google Chrome mainly) are forcing everyone to go SSL lest you end up with a 'insecure site' warning for all your visitors. Most websites don't care about NSA intercepting their data.
  - notatoad 7y ago
    Practically speaking, i think you're right - the "not secure" badge of shame in chrome is the most important convincing factor for website owners. but getting that through at google must have taken some convincing of various execs, and i'm sure snowden helped with that.
- petjuh 7y ago
  Yeah, Google has done much for privacy and it's kind of ironic how people believe those who say it's malicious. The only crime Google ever did was to be successful.
  - partiallypro 7y ago
    I think you can separate their punishing https with their lack of privacy in their core products.
edoo 7y ago
What happens if an agency gets in deep with one of the common trusted authorities shipped with every browser, or is an authority, or just hacked their root keys, or bought access like they did with RSA? It seems like they could man in the middle all day and the only difference would be the cert issuer, which means it would be invisible if used in a limited fashion.
- codedokode 7y ago
  It is still better than situation where everyone would use HTTP and naively believe that authorities will respect their right for privacy.
  - edoo 7y ago
    I'd almost prefer to be on http knowing I was insecure than be on https and wrongly believing I was secure.
    - JohnFen 7y ago
      Well, I don't really trust random certs even when they're signed by a respected CA -- but I still prefer using HTTPS. Even if the cert is fraudulent, HTTPS is still encrypting stuff and will protect me from other random attackers. Security is never a binary secure/insecure proposition. There are shades of gray. The key is to use what security you can, but never think "I'm secure now". As an old mentor once told me: the moment that you think you're secure is the moment that you're at the greatest risk, but you should still lock your door.
      - edoo 7y ago
        They teach that adage in business school too. That when you think you have full control of an organization is when you have the least control.
- matheusmoreira 7y ago
  They could definitely do that. They could also mandate the use of "national security certificates". https://en.wikipedia.org/wiki/Kazakhstan_man-in-the-middle_attack https://en.wikipedia.org/wiki/Kazakhstan_man-in-the-middle_a...
noitkjerh 7y ago
Snowden was a factor, but not the only one: - CPUs didn't have hardware acceleration for encryption (AES-NI) like they have today, so activating SSL on your webserver actually decreased your throughput a lot - It was expensive and complicated to get a certificate for your website, now LetsEncrypt provides them freely and easily
- brycesbeard 7y ago
  Wasn’t the server load for ssl something like 3-5%? That doesn’t strike me as much of a factor as the complexity involved, especially with the confusion added by eg Thawte hawking their enhanced validation product.
  - avian 7y ago
    "On our production frontend machines, SSL/TLS accounts for less than 1% of the CPU load" according to Google back in January 2010 [1]. This was about the same time as Intel introduced AES instructions, but the post suggests that this wasn't a big factor in their conclusion that TLS simply isn't computationally expensive. [1] https://www.imperialviolet.org/2010/06/25/overclocking-ssl.html https://www.imperialviolet.org/2010/06/25/overclocking-ssl.h...
  - jsjohnst 7y ago
    > Wasn’t the server load for ssl something like 3-5%? Depends on the packets per second being handled. I’ve pegged a CPU core easily doing encryption just a bit over a decade ago due to high data rate. If you’re pushing >500Mb/sec without CPU accelerated encryption (or NIC offloading) it puts a pretty hefty strain on resources.
- herf 7y ago
  My P4 could do >400gbps AES128 in 2003. (We tested encrypted connections over Firewire.)
hcarvalhoalves 7y ago
If people really listened to Snowden they wouldn't be relying on CA authorities for certificates.
- est31 7y ago
  There have been fradulent certificates in the wild in the past but the CAs doing it usually get kicked out pretty quickly. That's what Google's certificate transparency project is for. And they are increasing requirements further and further. Hopefully one day we'll get to a state where the infrastructure of multiple independent companies in different countries needs to be compromised in order for one successful forgery. But even now certificate transparency has greatly reduced the number of entities able to forge certificates.
  - hcarvalhoalves 7y ago
    State actors.
  - maqp 7y ago
    The problems is, companies like VeriSign offer LEA services Quoting https://papers.ssrn.com/sol3/papers.cfm?abstract_id=1591033 https://papers.ssrn.com/sol3/papers.cfm?abstract_id=1591033 “Verisign also operates a ‘Lawful Intercept’ service called NetDiscovery. This service is provided to ‘... [assist] government agen- cies with lawful interception and subpoena requests for subscriber records.’ If you now try to search for NetDiscovery or LEA services for CAs, you won't find any, but I guarantee you they haven't disappeared anywhere.
    - tialaramex 7y ago
      The CA doesn't have anything that helps you do Lawful Intercept. They just vouch for people's identities. If you can persuade them to fraudulently vouch for your agency as being some other subscriber then this unavoidably produces a smoking gun which everybody can see, just like when Israel produces fake passports so its agents can travel abroad to murder people. It doesn't let them passively intercept. The CA could not, gun to its head, help you do that. The mathematics just doesn't work that way, any more than the US Federal Reserve could intervene to make three dollars twice as many as five dollars.
skizm 7y ago
Maybe a noob question, but are whatsapp's messages secure from Facebook? Would some motivated employee at Facebook be able to read everyone's messages if they wanted? If no, how do we know?
- cfitz 7y ago
  If you’re talking about decrypting messages encrypted created and read via SSL (what they imply is the case), it’s not possible unless you have the private key, versus the widely available public key. I doubt it’s lying around in Facebooks repositories but I’ve never worked there so cannot say that is the case with certainty. This is all assuming they are even using modern SSL and are careful with user data. Unfortunately, not a great track record there for FB.
- newscracker 7y ago
  As much as I despise Facebook and its properties, the “how do we know” question can only be answered based on the trust that there would be at least one person in the company/team who would be a whistleblower if the end to end encryption is removed (with their knowledge and not through some state sponsored hacking). With that background, a motivated employee cannot read WhatsApp messages that they have not sent or received themselves because WhatsApp uses the Signal protocol implementation. Coming to your first question, WhatsApp does share metadata with Facebook. So the fact that content isn’t shared is a moot point because a lot can be inferred from metadata alone to target people for any purpose. So WhatsApp is not really a secure messenger if Facebook is part of your threat model and is considered an adversary or an adversary who can be easily coerced or compromised.
cfitz 7y ago
We need to promote the use of messaging apps which default to SSL. It shows a user-focused product and perhaps a healthy company.
- maqp 7y ago
  SSL was THE thing in 1995. End-to-end encrypted email has existed since 1991 (PGP), and for instant messaging you've been able to use OTR since 2004. End-to-end encryption is what is needed, SSL is the bare minimum for everything. It's the seatbelt + airbag. You can't have a car without those anymore. E2EE is the ACC+AEB+ABS. You should not have a car without those anymore.
rocqua 7y ago
It is a very fair point that Snowden's revelations definitely had an impact. However, the impact you note was mostly technical. The public backlash to these revelations is what seems lacking. It had very small political effects, and seemingly very little effect on the NSA. They did not change their stance much, and their weren't really consequences for what the NSA was doing.
- flatiron 7y ago
  What’s more important though? The public can’t particularly change things at that level. They don’t live at that level. It’s our job to help them. Just as they help me on non computer related stuff all the time. A barber shouldn’t be in charge of web encryption. It’s on us.
  - mxcrossb 7y ago
    Also, I think the public has no problem with the government spying on other people. They just don’t want it spying on them. So in that regard, it opposing the policy, but instead mitigating the risk to your own communications is an expected result.
    - girvo 7y ago
      Though that gets... interesting, when we remember that the revelations were that the NSA was spying on <insert person here>, as it was/is untargeted dragnet “surveillance”. People still didn’t care though, politically
Macha 7y ago
I feel Firesheep deserves at least some of the credit too: https://en.wikipedia.org/wiki/Firesheep https://en.wikipedia.org/wiki/Firesheep
- cdine 7y ago
  Firesheep co-author here. Thanks and agreed :)
  - maqp 7y ago
    Kudos for your work!
  - lucasverra 7y ago
    Latest firefox tells me that site http://codebutler.github.io/firesheep/ http://codebutler.github.io/firesheep/ is unsecure got there from official blog https://codebutler.com/2010/10/24/firesheep/ https://codebutler.com/2010/10/24/firesheep/ Maybe force https when requesting http ? https://drive.google.com/file/d/1maSpqYfFoBoCyao14VKzLKPMlm9H9k6w/view?usp=drivesdk https://drive.google.com/file/d/1maSpqYfFoBoCyao14VKzLKPMlm9...
- girvo 7y ago
  Definitely. Considering the plethora of unencrypted wifi SSIDs that were out there back then, it was huge. Massively reported on in the MSM, too
yyyk 7y ago
Snowden played no role in HTTPS adoption, because people don't seriously expect HTTPS to defeat NSA. Most peoples' threat models are much more modest. HTTPS adoption has a lot more to do with Google and Mozilla pushing it in their browsers, and Let's Encrypt making getting certificates easy. I have mixed feeling about that - the cost of easy certificates was making spoofing far easier.
anonu 7y ago
> yet they use the kind of encryption that only computer enthusiasts were interested in I hear this so often about WhatsApp - that they are end-to-end encrypted... But I really have no proof that it's true or that I should trust Zuck. I am sure you can check the messages being communicated, and on the surface you'll confirm to yourself that messages are encrypted. But how do you know there are no weaknesses in the design? How do you know they didnt "flip the switch" to allow a backdoor?
- JustSomeNobody 7y ago
  WhatsApp does control the clear text on both ends. They can do whatever they want with it.
finnthehuman 7y ago
>But to me it seems he did provide a lot of the impetus for having HTTPS virtually everywhere HTTPS connections are full of 3rd party surveillance systems that still have access to and monitor parts of the cleartext. WhatsApp is connected to the Facebook data vacuum (yes, just "metadata", but as the Snowden revelations you cite show, the metadata is the desirable surveillance records). If anything, this is a step backwards because it uses the pretense of security while providing none and really just being a fight for exclusive data across multiple corporate surveillance systems.

by svara 7y ago

newguy1234 7y ago

Agree Snowden is significant because he was able to encourage enough people to INSIST on strong privacy/encryption. Then it all comes down to basic game theory. Why would a company ever want to release any product without strong encryption (end-to-end) when users never complain about their data being encrypted. The only reason companies don't encrypt is when they have a vested interest in spying, either in their own interest or the government's interest. Anytime I see something not have strong encryption, it is a red flag to me that something nefarious is up.

loktarogar 7y ago
Encryption in the last decade has also become a hell of a lot easier to implement, so "why wouldn't we just do it" has less opposition
- ethbro 7y ago
  I think this is underappreciated. High-quality crypto libraries / systems lead to broader implementation, which makes it harder for elements in mostly-free societies to pressure implementers. It's one thing for the NSA to quietly lean on ATT (and only ATT). It's a completely different thing for them to quietly lean on 1,000 different organizations and authors. Similarly, it's easy to sneak a CALEA-alike amendment into national law when only PGP exists. It's harder when the narrative becomes "The government wants to take {beloved product used by millions} away."
shadowgovt 7y ago
> Why would a company ever want to release any product without strong encryption (end-to-end) when users never complain about their data being encrypted. The only reason companies don't encrypt is when they have a vested interest in spying... I think the second thought doesn't follow from the thought before it. to my experience, the main reason companies don't encrypt is because it's simply makes it that much harder to debug problems and consistently provide successful connections for users. HTTPS can fail in ways that HTTP does not. If users aren't clamoring for encryption as a feature, the main reason not to provide it is simplicity and quality of service along the axis users appear to care about. If users want encryption enough that they're willing to tolerate that sometimes browser misconfiguration or server side error will cause the connection to fail because it cannot be trusted, then companies will implement it.
rocqua 7y ago
I don't think I know many people who insisted on strong privacy/encryption. However, after the Snowden revelations people did consider it a preference. In that sense, it helped.

tialaramex 7y ago

BCP 188 "Pervasive Monitoring Is an Attack" sets Best Common Practice for the IETF to say that mitigating pervasive monitoring is appropriate because it's an attack on the network. So that's a pretty long way from "nobody cares". It's very carefully written, it does not propose to make a moral judgement about whether the things Snowden revealed are evil only to show that in a technical sense they were an attack and so it made sense for the network to try to mitigate them. Work like D-PRIVE (privacy for DNS) was driven by this concern, and of course it influenced a lot of other work including QUIC.

kortilla 7y ago
While a BCP is indication that “nobody cares” is false, it’s pretty far from even a majority of people caring. If BCPs mattered, IP spoofing wouldn’t be an issue on the Internet.
- baxtr 7y ago
  I think the reason the majority doesn’t care is that most people can’t imagine what could happen. They’re reading my WhatsApp messages? So what? I hardly have an answer for that, except for: imagine you’d live in an authoritarian state.
  - madads 7y ago
    I like the explanation that simply explains "privacy": When you are going to the toilet, and everybody knows that your going and what you'll do there, but you still close the door (for the most of us, most of the time).
    - Spivak 7y ago
      Sure, but people close the door out of modesty not really privacy. If there was a machine that provided a written transcript of what someone did in the bathroom with no video/audio I don’t think people would mind. Like when you’re in high-security areas and have to be monitored in the bathroom there might be a door between you and your guard but no real privacy. Or when people loudly object to strip-searches at the airport but the scanner that sees everything but then only shows a cutout highlighting suspicious areas to pat down are mostly fine.

deleted 7y ago

[deleted]

Andrew_nenakhov 7y ago

Ironically, Telegram markets itself as the most private and secure messenger, but in reality, it's much less private than WhatsApp or Viber: any regular (non-secret) Telegram chats are not end-to-end encrypted - if they were, you wouldn't be able to access them from a new device after authorization with a password.

freeflight 7y ago
To add to the irony: Telegram has evolved in a bit of a darknet on its own where people casual share content that would be near impossible to find on the surface web.
- x220 7y ago
  how do I get in on this?
  - dvtrn 7y ago
    First rule of fight club
    - PhasmaFelis 7y ago
      Tell all your friends while pretending that it's a secret?
  - ignoramous 7y ago
    Install the telegram app, register, and use the search button to find whatever it is that you want to. It isn't darknet in terms of anonymity; its wildnet in terms of content.
kome 7y ago
they are not end-to-end encrypted but they are encrypted. Also, I read that WhatsApp is going to switch to the same mode, for user convenience: https://bgr.com/2019/07/29/whatsapp-update-to-bring-multi-platform-accounts-ipad-mac-android/ https://bgr.com/2019/07/29/whatsapp-update-to-bring-multi-pl...

account73466 7y ago

He was very useful to inform the wider audience about global surveillance, make it "we already know that - boring!" and accelerate the progress of laws to extend it. In the end, this was his mission. edit: thank you for the downvote, well-informed stranger!

blotter_paper 7y ago
19 days before Snowden flew to Hong Kong, former FBI counter-terrorism agent Tim Clemente spilled the beans on CNN[0] (for context, informarion from a phonecall between one of the Boston Marathon bombers and his wife had been leaked to the media): >BURNETT: Tim, is there any way, obviously, there is a voice mail they can try to get the phone companies to give that up at this point. It's not a voice mail. It's just a conversation. There's no way they actually can find out what happened, right, unless she tells them? >CLEMENTE: No, there is a way. We certainly have ways in national security investigations to find out exactly what was said in that conversation. It's not necessarily something that the FBI is going to want to present in court, but it may help lead the investigation and/or lead to questioning of her. We certainly can find that out. >BURNETT: So they can actually get that? People are saying, look, that is incredible. >CLEMENTE: No, welcome to America. All of that stuff is being captured as we speak whether we know it or like it or not. This could be coincidental timing, but I've always wondered if the Snowden leak was a way of controlling the national discussion around the issue and putting an agent in place (Snowden) who could be a relatively moderate voice that the pro-privacy crowd could group around, while also creating a dramatic story with the potential for international espionage that allows pro-surveillance voices to distract from the they're-spying-on-us narrative by accusing Snowden of being a Chinese/Russian pawn. I don't feel comfortable saying Snowden is still working for the US government, but I'm certainly suspicious of him. [0]: http://transcripts.cnn.com/TRANSCRIPTS/1305/01/ebo.01.html http://transcripts.cnn.com/TRANSCRIPTS/1305/01/ebo.01.html
- x220 7y ago
  Snowden released a large collection of documents. Judging by his interview with Joe Rogan, he's a passionate advocate for encryption and says that the US is creating a tool for complete oppression. It's harder to get more apocalyptic than that.

partiallypro 7y ago

I think this has a lot more to do with Google punishing web results without https than it does with Snowden, couple that with Cloudflare and Let's Encrypt and you have an easy path.

6nf 7y ago
This is the more important factor at play here. Browsers (Google Chrome mainly) are forcing everyone to go SSL lest you end up with a 'insecure site' warning for all your visitors. Most websites don't care about NSA intercepting their data.
- notatoad 7y ago
  Practically speaking, i think you're right - the "not secure" badge of shame in chrome is the most important convincing factor for website owners. but getting that through at google must have taken some convincing of various execs, and i'm sure snowden helped with that.
petjuh 7y ago
Yeah, Google has done much for privacy and it's kind of ironic how people believe those who say it's malicious. The only crime Google ever did was to be successful.
- partiallypro 7y ago
  I think you can separate their punishing https with their lack of privacy in their core products.

edoo 7y ago

What happens if an agency gets in deep with one of the common trusted authorities shipped with every browser, or is an authority, or just hacked their root keys, or bought access like they did with RSA? It seems like they could man in the middle all day and the only difference would be the cert issuer, which means it would be invisible if used in a limited fashion.

codedokode 7y ago
It is still better than situation where everyone would use HTTP and naively believe that authorities will respect their right for privacy.
- edoo 7y ago
  I'd almost prefer to be on http knowing I was insecure than be on https and wrongly believing I was secure.
  - JohnFen 7y ago
    Well, I don't really trust random certs even when they're signed by a respected CA -- but I still prefer using HTTPS. Even if the cert is fraudulent, HTTPS is still encrypting stuff and will protect me from other random attackers. Security is never a binary secure/insecure proposition. There are shades of gray. The key is to use what security you can, but never think "I'm secure now". As an old mentor once told me: the moment that you think you're secure is the moment that you're at the greatest risk, but you should still lock your door.
    - edoo 7y ago
      They teach that adage in business school too. That when you think you have full control of an organization is when you have the least control.
matheusmoreira 7y ago
They could definitely do that. They could also mandate the use of "national security certificates". https://en.wikipedia.org/wiki/Kazakhstan_man-in-the-middle_attack https://en.wikipedia.org/wiki/Kazakhstan_man-in-the-middle_a...

noitkjerh 7y ago

Snowden was a factor, but not the only one: - CPUs didn't have hardware acceleration for encryption (AES-NI) like they have today, so activating SSL on your webserver actually decreased your throughput a lot - It was expensive and complicated to get a certificate for your website, now LetsEncrypt provides them freely and easily

brycesbeard 7y ago
Wasn’t the server load for ssl something like 3-5%? That doesn’t strike me as much of a factor as the complexity involved, especially with the confusion added by eg Thawte hawking their enhanced validation product.
- avian 7y ago
  "On our production frontend machines, SSL/TLS accounts for less than 1% of the CPU load" according to Google back in January 2010 [1]. This was about the same time as Intel introduced AES instructions, but the post suggests that this wasn't a big factor in their conclusion that TLS simply isn't computationally expensive. [1] https://www.imperialviolet.org/2010/06/25/overclocking-ssl.html https://www.imperialviolet.org/2010/06/25/overclocking-ssl.h...
- jsjohnst 7y ago
  > Wasn’t the server load for ssl something like 3-5%? Depends on the packets per second being handled. I’ve pegged a CPU core easily doing encryption just a bit over a decade ago due to high data rate. If you’re pushing >500Mb/sec without CPU accelerated encryption (or NIC offloading) it puts a pretty hefty strain on resources.
herf 7y ago
My P4 could do >400gbps AES128 in 2003. (We tested encrypted connections over Firewire.)

hcarvalhoalves 7y ago

If people really listened to Snowden they wouldn't be relying on CA authorities for certificates.

est31 7y ago
There have been fradulent certificates in the wild in the past but the CAs doing it usually get kicked out pretty quickly. That's what Google's certificate transparency project is for. And they are increasing requirements further and further. Hopefully one day we'll get to a state where the infrastructure of multiple independent companies in different countries needs to be compromised in order for one successful forgery. But even now certificate transparency has greatly reduced the number of entities able to forge certificates.
- hcarvalhoalves 7y ago
  State actors.
- maqp 7y ago
  The problems is, companies like VeriSign offer LEA services Quoting https://papers.ssrn.com/sol3/papers.cfm?abstract_id=1591033 https://papers.ssrn.com/sol3/papers.cfm?abstract_id=1591033 “Verisign also operates a ‘Lawful Intercept’ service called NetDiscovery. This service is provided to ‘... [assist] government agen- cies with lawful interception and subpoena requests for subscriber records.’ If you now try to search for NetDiscovery or LEA services for CAs, you won't find any, but I guarantee you they haven't disappeared anywhere.
  - tialaramex 7y ago
    The CA doesn't have anything that helps you do Lawful Intercept. They just vouch for people's identities. If you can persuade them to fraudulently vouch for your agency as being some other subscriber then this unavoidably produces a smoking gun which everybody can see, just like when Israel produces fake passports so its agents can travel abroad to murder people. It doesn't let them passively intercept. The CA could not, gun to its head, help you do that. The mathematics just doesn't work that way, any more than the US Federal Reserve could intervene to make three dollars twice as many as five dollars.

skizm 7y ago

Maybe a noob question, but are whatsapp's messages secure from Facebook? Would some motivated employee at Facebook be able to read everyone's messages if they wanted? If no, how do we know?

cfitz 7y ago
If you’re talking about decrypting messages encrypted created and read via SSL (what they imply is the case), it’s not possible unless you have the private key, versus the widely available public key. I doubt it’s lying around in Facebooks repositories but I’ve never worked there so cannot say that is the case with certainty. This is all assuming they are even using modern SSL and are careful with user data. Unfortunately, not a great track record there for FB.
newscracker 7y ago
As much as I despise Facebook and its properties, the “how do we know” question can only be answered based on the trust that there would be at least one person in the company/team who would be a whistleblower if the end to end encryption is removed (with their knowledge and not through some state sponsored hacking). With that background, a motivated employee cannot read WhatsApp messages that they have not sent or received themselves because WhatsApp uses the Signal protocol implementation. Coming to your first question, WhatsApp does share metadata with Facebook. So the fact that content isn’t shared is a moot point because a lot can be inferred from metadata alone to target people for any purpose. So WhatsApp is not really a secure messenger if Facebook is part of your threat model and is considered an adversary or an adversary who can be easily coerced or compromised.

cfitz 7y ago

We need to promote the use of messaging apps which default to SSL. It shows a user-focused product and perhaps a healthy company.

maqp 7y ago
SSL was THE thing in 1995. End-to-end encrypted email has existed since 1991 (PGP), and for instant messaging you've been able to use OTR since 2004. End-to-end encryption is what is needed, SSL is the bare minimum for everything. It's the seatbelt + airbag. You can't have a car without those anymore. E2EE is the ACC+AEB+ABS. You should not have a car without those anymore.

rocqua 7y ago

It is a very fair point that Snowden's revelations definitely had an impact. However, the impact you note was mostly technical. The public backlash to these revelations is what seems lacking. It had very small political effects, and seemingly very little effect on the NSA. They did not change their stance much, and their weren't really consequences for what the NSA was doing.

flatiron 7y ago
What’s more important though? The public can’t particularly change things at that level. They don’t live at that level. It’s our job to help them. Just as they help me on non computer related stuff all the time. A barber shouldn’t be in charge of web encryption. It’s on us.
- mxcrossb 7y ago
  Also, I think the public has no problem with the government spying on other people. They just don’t want it spying on them. So in that regard, it opposing the policy, but instead mitigating the risk to your own communications is an expected result.
  - girvo 7y ago
    Though that gets... interesting, when we remember that the revelations were that the NSA was spying on <insert person here>, as it was/is untargeted dragnet “surveillance”. People still didn’t care though, politically

Macha 7y ago

I feel Firesheep deserves at least some of the credit too: https://en.wikipedia.org/wiki/Firesheep https://en.wikipedia.org/wiki/Firesheep

cdine 7y ago
Firesheep co-author here. Thanks and agreed :)
- maqp 7y ago
  Kudos for your work!
- lucasverra 7y ago
  Latest firefox tells me that site http://codebutler.github.io/firesheep/ http://codebutler.github.io/firesheep/ is unsecure got there from official blog https://codebutler.com/2010/10/24/firesheep/ https://codebutler.com/2010/10/24/firesheep/ Maybe force https when requesting http ? https://drive.google.com/file/d/1maSpqYfFoBoCyao14VKzLKPMlm9H9k6w/view?usp=drivesdk https://drive.google.com/file/d/1maSpqYfFoBoCyao14VKzLKPMlm9...
girvo 7y ago
Definitely. Considering the plethora of unencrypted wifi SSIDs that were out there back then, it was huge. Massively reported on in the MSM, too

yyyk 7y ago

Snowden played no role in HTTPS adoption, because people don't seriously expect HTTPS to defeat NSA. Most peoples' threat models are much more modest. HTTPS adoption has a lot more to do with Google and Mozilla pushing it in their browsers, and Let's Encrypt making getting certificates easy. I have mixed feeling about that - the cost of easy certificates was making spoofing far easier.

anonu 7y ago

> yet they use the kind of encryption that only computer enthusiasts were interested in I hear this so often about WhatsApp - that they are end-to-end encrypted... But I really have no proof that it's true or that I should trust Zuck. I am sure you can check the messages being communicated, and on the surface you'll confirm to yourself that messages are encrypted. But how do you know there are no weaknesses in the design? How do you know they didnt "flip the switch" to allow a backdoor?

JustSomeNobody 7y ago
WhatsApp does control the clear text on both ends. They can do whatever they want with it.

finnthehuman 7y ago

>But to me it seems he did provide a lot of the impetus for having HTTPS virtually everywhere HTTPS connections are full of 3rd party surveillance systems that still have access to and monitor parts of the cleartext. WhatsApp is connected to the Facebook data vacuum (yes, just "metadata", but as the Snowden revelations you cite show, the metadata is the desirable surveillance records). If anything, this is a step backwards because it uses the pretense of security while providing none and really just being a fight for exclusive data across multiple corporate surveillance systems.