4 ms·

According to google, about 90% of the web traffic on chrome is now encrypted [1]. Does it matter that they are tapping a cable? The metadata can’t be that usefu

by cm2187 6y ago

According to google, about 90% of the web traffic on chrome is now encrypted [1]. Does it matter that they are tapping a cable? The metadata can’t be that useful. [1] https://transparencyreport.google.com/https/overview?hl=en_GB https://transparencyreport.google.com/https/overview?hl=en_G...

noitpmeder 6y ago
You're assuming that most traffic is web traffic (opposed to non-browser traffic) and that encryption is secure.
tjoff 6y ago
If it didn't matter they sure would not tap it.
- cm2187 6y ago
  The infrastructure may have been built when that number was low (Snowden was ages ago)
pastrami_panda 6y ago
I've heard that metadata can be very useful (sometimes more so than the actual data). I don't remember the argument very well or where I read it, but it was something along the lines of analyzing the timing of activities to connect individuals to groups and events iirc.
boxfire 6y ago
That metadata is surely still useful when you know frequency and target IP addresses. In addition not everyone uses google services and browsers, and so its really narrow to say 'chrome is encrypted, so who cares?'... This metadata by the way is exactly how you can calculate correspondence and association of graphs of people and information. How is that not exactly a breach of exactly what people fear most? It doesnt matter what data you are looking at, it matters who else is looking.
- cm2187 6y ago
  No the 90% I was refering to is chrome web traffic, not google service (toward the bottom, “Percentage of pages loaded over HTTPS in Chrome by platform”)
  - boxfire 6y ago
    Right, and chrome is trying _Hard_ to make that happen, whereas opera, firefox, etc, are not necessarily automatically upgrading to https:// https:// where possible from http:// http:// URIs, etc. Its highly unrepresentative of anything but a google chrome user experience.
noja 6y ago
> The metadata can’t be that useful. Yet they are collecting it. It's almost as if it could be useful! You need to read the Snowden book.
AndyMcConachie 6y ago
Why can't the NSA just force a web PKI cert provider to create a fake certificate for them? We know from the Lavabit case that once you start keeping private keys away from the feds they start making problems for you. Prove to me that every single root your browser trusts is not compromised.
- detaro 6y ago
  To catch that we have Certificate Transparency. It's not 100%, but makes it a risky proposition and not viable for large scale.
  - danishguy 6y ago
    These kinds of attacks are usually run by a major threat actor (i.e. nation state), targeted, and not run at large scale. Certificate transparency is unlikely to help in this case. Key pinning was the more secure option. For some issues see: https://www.agwa.name/blog/post/how_will_certificate_transparency_logs_be_audited_in_practice https://www.agwa.name/blog/post/how_will_certificate_transpa... https://tools.ietf.org/html/draft-ietf-trans-threat-analysis-16 https://tools.ietf.org/html/draft-ietf-trans-threat-analysis...
- Jon_Lowtek 6y ago
  Who says they don't? TAO - tailored access operations - is known to intercept physical delivery and re-solder chips onto hardware to get access. It is all a question of "how much do you spent on a specific target". However every such change could tip the target off: if you replace the certificate and the target knows the key of the cert they expect, that will tip them off. Now a lot of these tools are about mass surveillance and big data: collecting metadata about everyone, not about some well defined target, then run big data analysis on it to discover targets. Like you have one person who is flagged and they talk a lot to this "HackerNews-Server" and so all others who talk to that server get an increase in score and now multiple of those people have a score above a treshhold and get flagged. Can't do that if you don't spy on everyone. But they can't run active intrusion against every civilian ever without exploding costs and high chance of being detected.
- 6y ago
Jon_Lowtek 6y ago
"We kill people based on metadata" ~~ General Michael Hayden, former director of the NSA
- cm2187 6y ago
  Yeah but he was referring to direct phone contacts. You connecting to a Skype or Facebook server doesn’t tell you anything.
  - Jon_Lowtek 6y ago
    Well the article focuses on backbone cable tapping, but they collect metadata of "who talks to whom" from facebook and microsoft, too. Lets say someone is using a northern european vpn-server to connect to facebook and that vpn-server is not cooperating. Decloaking is statistical analysis against timing and rough size of packages, so tapping the cables on both ends of the vpn-server and recording metadata for all its connections is key, even if they can't break the encryption.
unionpivo 6y ago
At scale metadata is MORE usefull than the specifics of the communication (web, phone, messages, videostreeams, ...) Who talks to whom, When do they talk, how longm from where. What sites do they access, ... It enables you to pick a person, find his friends, where do they meet(online and offline), where do they keep money, where do they spend it. What news do they read, what music, what their political leanings are etc. It enables you to see the big picture. (of either a single individual or entire group of people) The content only becomes useful, once you have general idea what is going on.
danishguy 6y ago
"Encrypted" You can still see the domain name until ESNI becomes a thing. Also websites are still fingerprintable with TLS, sometimes even down to the exact URL accessed.

by cm2187 6y ago

noitpmeder 6y ago

You're assuming that most traffic is web traffic (opposed to non-browser traffic) and that encryption is secure.

tjoff 6y ago

If it didn't matter they sure would not tap it.

cm2187 6y ago
The infrastructure may have been built when that number was low (Snowden was ages ago)

pastrami_panda 6y ago

I've heard that metadata can be very useful (sometimes more so than the actual data). I don't remember the argument very well or where I read it, but it was something along the lines of analyzing the timing of activities to connect individuals to groups and events iirc.

boxfire 6y ago

That metadata is surely still useful when you know frequency and target IP addresses. In addition not everyone uses google services and browsers, and so its really narrow to say 'chrome is encrypted, so who cares?'... This metadata by the way is exactly how you can calculate correspondence and association of graphs of people and information. How is that not exactly a breach of exactly what people fear most? It doesnt matter what data you are looking at, it matters who else is looking.

cm2187 6y ago
No the 90% I was refering to is chrome web traffic, not google service (toward the bottom, “Percentage of pages loaded over HTTPS in Chrome by platform”)
- boxfire 6y ago
  Right, and chrome is trying _Hard_ to make that happen, whereas opera, firefox, etc, are not necessarily automatically upgrading to https:// https:// where possible from http:// http:// URIs, etc. Its highly unrepresentative of anything but a google chrome user experience.

noja 6y ago

> The metadata can’t be that useful. Yet they are collecting it. It's almost as if it could be useful! You need to read the Snowden book.

AndyMcConachie 6y ago

Why can't the NSA just force a web PKI cert provider to create a fake certificate for them? We know from the Lavabit case that once you start keeping private keys away from the feds they start making problems for you. Prove to me that every single root your browser trusts is not compromised.

detaro 6y ago
To catch that we have Certificate Transparency. It's not 100%, but makes it a risky proposition and not viable for large scale.
- danishguy 6y ago
  These kinds of attacks are usually run by a major threat actor (i.e. nation state), targeted, and not run at large scale. Certificate transparency is unlikely to help in this case. Key pinning was the more secure option. For some issues see: https://www.agwa.name/blog/post/how_will_certificate_transparency_logs_be_audited_in_practice https://www.agwa.name/blog/post/how_will_certificate_transpa... https://tools.ietf.org/html/draft-ietf-trans-threat-analysis-16 https://tools.ietf.org/html/draft-ietf-trans-threat-analysis...
Jon_Lowtek 6y ago
Who says they don't? TAO - tailored access operations - is known to intercept physical delivery and re-solder chips onto hardware to get access. It is all a question of "how much do you spent on a specific target". However every such change could tip the target off: if you replace the certificate and the target knows the key of the cert they expect, that will tip them off. Now a lot of these tools are about mass surveillance and big data: collecting metadata about everyone, not about some well defined target, then run big data analysis on it to discover targets. Like you have one person who is flagged and they talk a lot to this "HackerNews-Server" and so all others who talk to that server get an increase in score and now multiple of those people have a score above a treshhold and get flagged. Can't do that if you don't spy on everyone. But they can't run active intrusion against every civilian ever without exploding costs and high chance of being detected.
6y ago

Jon_Lowtek 6y ago

"We kill people based on metadata" ~~ General Michael Hayden, former director of the NSA

cm2187 6y ago
Yeah but he was referring to direct phone contacts. You connecting to a Skype or Facebook server doesn’t tell you anything.
- Jon_Lowtek 6y ago
  Well the article focuses on backbone cable tapping, but they collect metadata of "who talks to whom" from facebook and microsoft, too. Lets say someone is using a northern european vpn-server to connect to facebook and that vpn-server is not cooperating. Decloaking is statistical analysis against timing and rough size of packages, so tapping the cables on both ends of the vpn-server and recording metadata for all its connections is key, even if they can't break the encryption.

unionpivo 6y ago

At scale metadata is MORE usefull than the specifics of the communication (web, phone, messages, videostreeams, ...) Who talks to whom, When do they talk, how longm from where. What sites do they access, ... It enables you to pick a person, find his friends, where do they meet(online and offline), where do they keep money, where do they spend it. What news do they read, what music, what their political leanings are etc. It enables you to see the big picture. (of either a single individual or entire group of people) The content only becomes useful, once you have general idea what is going on.

danishguy 6y ago

"Encrypted" You can still see the domain name until ESNI becomes a thing. Also websites are still fingerprintable with TLS, sometimes even down to the exact URL accessed.