6 ms·

many years ago, when i worked at google, we'd joke that every time fiber was 'cut' it was some rando government agency installing a tap. this was before intern

many years ago, when i worked at google, we'd joke that every time fiber was 'cut' it was some rando government agency installing a tap. this was before internal traffic was encrypted. of course, we were less than half joking.

yahwrong 7y ago
Like the 'government agency' doesn't already posses the encryption keys or other methods to extract information from encrypted data.
- sillysaurusx 7y ago
  Most governments don't, but even the NSA taps into unencrypted or weak links along the pipe. https://www.newyorker.com/news/amy-davidson/tech-companies-slap-back-at-the-n-s-a-s-smiley-face https://www.newyorker.com/news/amy-davidson/tech-companies-s... "SSL added and removed here! :)"
  - penagwin 7y ago
    My understanding is that they record encrypted traffic too. They can't read any of it - yet. But they're betting one day either a security vulnerability will be discovered, or computers will be fast enough to attack the encryption and allow them to read the data. So even though it's unreadable today, it might be in 10 years.
    - germinalphrase 7y ago
      I remember hearing a speech by a quantum computing researcher that was primarily funded by the NSA. He included an anecdote about how “they would prefer quantum computing didn’t exist, but if it’s going to exist - they want the first one”.
    - bduerst 7y ago
      That's a lot of data though, especially since it's usefulness goes down with time.
      - penagwin 7y ago
        It certainly is. According to the NSA technical director at the time (2013) the Utah datacenter has a capacity around 5 Zettabytes.
        martinald 7y ago
        That seems hard to believe. That would be five billion 1TB hard drives. Considering around 100 million hard drives are shipped per quarter, that would be over a decade of production.
        samb1729 7y ago
        Do you have a source for that 100 million figure? It strikes me as awfully low considering how many personal computers must surely exist in the world and how often they'd be replaced without reusing the drives, not even factoring in servers.
        martinald 7y ago
        Sorry, that's per quarter. So it would be more like over a decade of all worldwide HDD production. Still crazy high IMO.
        bduerst 7y ago
        For platter or SSD drives, sure. Some forms of magnetic tape storage can get up to 300 TB per cartridge though, which can scale up to petabytes in the right config. Still ridiculous for information that is worth less and less over time.
        martinald 7y ago
        300TB per cartridge in 2013? I think 10TB per cartridge was pretty high round then. That's still around half a billion tape cartridges, which are also very slow to read and write from.
  - abledon 7y ago
    Here's an article about the NSA cracking some parts of the web: https://arstechnica.com/information-technology/2015/10/how-the-nsa-can-break-trillions-of-encrypted-web-and-vpn-connections/ https://arstechnica.com/information-technology/2015/10/how-t... """ For commonly used 1024-bit keys, it would take about a year and cost a "few hundred million dollars" to crack just one of the extremely large prime numbers that form the starting point of a Diffie-Hellman negotiation. But it turns out that only a few primes are commonly used, putting the price well within the NSA's $11 billion-per-year budget dedicated to "groundbreaking cryptanalytic capabilities." """
- AdamN 7y ago
  That's super simplistic. Nobody magically 'has' anything. They need to do stuff (like this) to get anything.
  - jacquesm 7y ago
    Employ a 'reverse Snowden' and it's a done deal.
    - lima 7y ago
      Large companies have plenty of safeguards against internal threats, especially when things like encryption keys are concerned.
      - jacquesm 7y ago
        They all do, and in most of them there are obvious errors in processes or rights assignments. It is pretty rare to come across a company that takes the threat from within serious. That's the whole reason Snowden could do what he did and if the NSA gets it wrong then there is a fair chance that your average corporation has faults as well.
  - yahwrong 7y ago
    Oh I'm sorry I didn't think I needed to make long ass explination and give a history lesson on why the NSA is more than probably able decrypt whatever they want.
    - mrmuagi 7y ago
      History lessons are pertinent to the degree you represent the facts therein accurately. Perhaps this is where the confusion arises. You claim the NSA has computational superiority to crack "whatever they want". If this is true, I posit that such a invention would be available to the private sector as it would represent and contain an immense technological innovation -- and not doing so would be a greater detriment than doing so.
- EddieCPU 7y ago
  @yahwrong: > Like the 'government agency' doesn't already posses the encryption keys or other methods to extract information from encrypted data. Shoosh, we're all supposed to engage in the charade that it isn't going on.
- lawn 7y ago
  They absolutely cannot crack all encryption schemes. It's ridiculous to even suggest it, even if they would have fully functioning quantum computers.
  - ct520 7y ago
    who said the data isn't valuable years down the line? Crack today, who knows. Crack in the future, more than likely.
    - rebuilder 7y ago
      This is a claim that has been made about the Total Information Awareness program, its offshoots and, specifically, the NSA's big datacenter that was in the news some years ago: that one of the things the NSA are doing is collecting all the data they can in the hope they can make sense of it later, even I'd they can't now.
- jcims 7y ago
  Not even limited to 'the government'. Improperly sanitized network gear shows up in second-hand markets all around the world. Happened at a former employer of mine and a 'finder' attempted to extort us over it. VPN PSKs on the equipment were still in use in the field (no PFS either, so years of captured content could ostensibly have been decrypted). Even equipment that appears to have been cleared out is probably hiding secrets in flash. The vendor of the equipment in this case had a separate command to wipe file contents. Deleting files just unlinked them in the flash fs.
  - jlgaddis 7y ago
    Yep, I personally bought a Cisco firewall off of eBay several years ago that still had its entire configuration on it, including the PSKs for several IPSec VPN connections as well as SNMP (v2) communities, weak "type 7" hashes for local user accounts, the shared secrets for a pair of RADIUS servers, and so on. Pretty much all of them (with the exception of the VPN PSKs) were sufficiently "generic" enough that I was convinced that they weren't device-specific, i.e., they were probably shared across many such devices. According to the login banner, the firewall came from a casino. I'm certain that my experience was not a unique one.
grecy 7y ago
Thanks to Snowden, we now know it to be factually true.
- SiempreViernes 7y ago
  Well, I think Snowden told us the tapping happens at the exchanges mainly. Was there a lot of cutting and splicing?
  - kitteh 7y ago
    The cable landing stations are an easier location to tap the subsea stuff. If you tour one there are rooms they won't let you in.
    - creato 7y ago
      > If you tour one there are rooms they won't let you in. I mean, I'd kind of expect not to be allowed in everywhere in such a facility for many reasons. You can't go anywhere you want in all kinds of public infrastructure (water treatment plants, power plants, etc.).
- catalogia 7y ago
  Do we? I'm under the impression they can install taps on fiber without disrupting service by bending the fiber just precisely right that a small amount of light bleeds out, or something like that.
  - etrautmann 7y ago
    There's an evanescent wave that can be detected if a short radius bend is introduced. I would imagine that this would introduce attenuation that might be detectable?
  - netheril96 7y ago
    But mistakes happen.
- deleted 7y ago
bigiain 7y ago
I've heard a really interesting war story from a Googler who was in the NOC when the Japanese earthquake that took out their nuclear power stations out hit - and cut the fibres on the sea bed. He reckons they were probably the first people on the planet to know something was happening. Apparently their immediate response was just to reroute everything through the cables on the other side of the country that were still top, and let their bosses know it was happening. They didn't slow down to ask for permission to light up half a country's worth of bandwidth, then just did it.
- jlgaddis 7y ago
  > Apparently their immediate response was just to reroute everything through the cables on the other side of the country that were still top, ... I'd be pretty surprised to learn that was a "manual" decision made by humans. I would expect -- especially in Google's case -- that the re-routing happened automatically (and nearly instantaneously, ~50ms) and the NOC engineers were simply "notified" about it.

yahwrong 7y ago

Like the 'government agency' doesn't already posses the encryption keys or other methods to extract information from encrypted data.

sillysaurusx 7y ago
Most governments don't, but even the NSA taps into unencrypted or weak links along the pipe. https://www.newyorker.com/news/amy-davidson/tech-companies-slap-back-at-the-n-s-a-s-smiley-face https://www.newyorker.com/news/amy-davidson/tech-companies-s... "SSL added and removed here! :)"
- penagwin 7y ago
  My understanding is that they record encrypted traffic too. They can't read any of it - yet. But they're betting one day either a security vulnerability will be discovered, or computers will be fast enough to attack the encryption and allow them to read the data. So even though it's unreadable today, it might be in 10 years.
  - germinalphrase 7y ago
    I remember hearing a speech by a quantum computing researcher that was primarily funded by the NSA. He included an anecdote about how “they would prefer quantum computing didn’t exist, but if it’s going to exist - they want the first one”.
  - bduerst 7y ago
    That's a lot of data though, especially since it's usefulness goes down with time.
    - penagwin 7y ago
      It certainly is. According to the NSA technical director at the time (2013) the Utah datacenter has a capacity around 5 Zettabytes.
      - martinald 7y ago
        That seems hard to believe. That would be five billion 1TB hard drives. Considering around 100 million hard drives are shipped per quarter, that would be over a decade of production.
        samb1729 7y ago
        Do you have a source for that 100 million figure? It strikes me as awfully low considering how many personal computers must surely exist in the world and how often they'd be replaced without reusing the drives, not even factoring in servers.
        martinald 7y ago
        Sorry, that's per quarter. So it would be more like over a decade of all worldwide HDD production. Still crazy high IMO.
        bduerst 7y ago
        For platter or SSD drives, sure. Some forms of magnetic tape storage can get up to 300 TB per cartridge though, which can scale up to petabytes in the right config. Still ridiculous for information that is worth less and less over time.
        martinald 7y ago
        300TB per cartridge in 2013? I think 10TB per cartridge was pretty high round then. That's still around half a billion tape cartridges, which are also very slow to read and write from.
- abledon 7y ago
  Here's an article about the NSA cracking some parts of the web: https://arstechnica.com/information-technology/2015/10/how-the-nsa-can-break-trillions-of-encrypted-web-and-vpn-connections/ https://arstechnica.com/information-technology/2015/10/how-t... """ For commonly used 1024-bit keys, it would take about a year and cost a "few hundred million dollars" to crack just one of the extremely large prime numbers that form the starting point of a Diffie-Hellman negotiation. But it turns out that only a few primes are commonly used, putting the price well within the NSA's $11 billion-per-year budget dedicated to "groundbreaking cryptanalytic capabilities." """
AdamN 7y ago
That's super simplistic. Nobody magically 'has' anything. They need to do stuff (like this) to get anything.
- jacquesm 7y ago
  Employ a 'reverse Snowden' and it's a done deal.
  - lima 7y ago
    Large companies have plenty of safeguards against internal threats, especially when things like encryption keys are concerned.
    - jacquesm 7y ago
      They all do, and in most of them there are obvious errors in processes or rights assignments. It is pretty rare to come across a company that takes the threat from within serious. That's the whole reason Snowden could do what he did and if the NSA gets it wrong then there is a fair chance that your average corporation has faults as well.
- yahwrong 7y ago
  Oh I'm sorry I didn't think I needed to make long ass explination and give a history lesson on why the NSA is more than probably able decrypt whatever they want.
  - mrmuagi 7y ago
    History lessons are pertinent to the degree you represent the facts therein accurately. Perhaps this is where the confusion arises. You claim the NSA has computational superiority to crack "whatever they want". If this is true, I posit that such a invention would be available to the private sector as it would represent and contain an immense technological innovation -- and not doing so would be a greater detriment than doing so.
EddieCPU 7y ago
@yahwrong: > Like the 'government agency' doesn't already posses the encryption keys or other methods to extract information from encrypted data. Shoosh, we're all supposed to engage in the charade that it isn't going on.
lawn 7y ago
They absolutely cannot crack all encryption schemes. It's ridiculous to even suggest it, even if they would have fully functioning quantum computers.
- ct520 7y ago
  who said the data isn't valuable years down the line? Crack today, who knows. Crack in the future, more than likely.
  - rebuilder 7y ago
    This is a claim that has been made about the Total Information Awareness program, its offshoots and, specifically, the NSA's big datacenter that was in the news some years ago: that one of the things the NSA are doing is collecting all the data they can in the hope they can make sense of it later, even I'd they can't now.
jcims 7y ago
Not even limited to 'the government'. Improperly sanitized network gear shows up in second-hand markets all around the world. Happened at a former employer of mine and a 'finder' attempted to extort us over it. VPN PSKs on the equipment were still in use in the field (no PFS either, so years of captured content could ostensibly have been decrypted). Even equipment that appears to have been cleared out is probably hiding secrets in flash. The vendor of the equipment in this case had a separate command to wipe file contents. Deleting files just unlinked them in the flash fs.
- jlgaddis 7y ago
  Yep, I personally bought a Cisco firewall off of eBay several years ago that still had its entire configuration on it, including the PSKs for several IPSec VPN connections as well as SNMP (v2) communities, weak "type 7" hashes for local user accounts, the shared secrets for a pair of RADIUS servers, and so on. Pretty much all of them (with the exception of the VPN PSKs) were sufficiently "generic" enough that I was convinced that they weren't device-specific, i.e., they were probably shared across many such devices. According to the login banner, the firewall came from a casino. I'm certain that my experience was not a unique one.

grecy 7y ago

Thanks to Snowden, we now know it to be factually true.

SiempreViernes 7y ago
Well, I think Snowden told us the tapping happens at the exchanges mainly. Was there a lot of cutting and splicing?
- kitteh 7y ago
  The cable landing stations are an easier location to tap the subsea stuff. If you tour one there are rooms they won't let you in.
  - creato 7y ago
    > If you tour one there are rooms they won't let you in. I mean, I'd kind of expect not to be allowed in everywhere in such a facility for many reasons. You can't go anywhere you want in all kinds of public infrastructure (water treatment plants, power plants, etc.).
catalogia 7y ago
Do we? I'm under the impression they can install taps on fiber without disrupting service by bending the fiber just precisely right that a small amount of light bleeds out, or something like that.
- etrautmann 7y ago
  There's an evanescent wave that can be detected if a short radius bend is introduced. I would imagine that this would introduce attenuation that might be detectable?
- netheril96 7y ago
  But mistakes happen.
deleted 7y ago

bigiain 7y ago

I've heard a really interesting war story from a Googler who was in the NOC when the Japanese earthquake that took out their nuclear power stations out hit - and cut the fibres on the sea bed. He reckons they were probably the first people on the planet to know something was happening. Apparently their immediate response was just to reroute everything through the cables on the other side of the country that were still top, and let their bosses know it was happening. They didn't slow down to ask for permission to light up half a country's worth of bandwidth, then just did it.

jlgaddis 7y ago
> Apparently their immediate response was just to reroute everything through the cables on the other side of the country that were still top, ... I'd be pretty surprised to learn that was a "manual" decision made by humans. I would expect -- especially in Google's case -- that the re-routing happened automatically (and nearly instantaneously, ~50ms) and the NOC engineers were simply "notified" about it.