5 ms·

(L)Awful Interception

148 points by Sami_Lehtinen 5y ago

qersist3nce 5y ago
I've only heard good things about mullvad and their Wireguard-based VPN solution (...so long as random reddit comments and forum posts are to be trusted). I wonder what 5/9/14 eyes actually do with the intercepted data? Isn't mere processing of the said data, a gargantuan task? Is this where Palantir comes to play or is it more like of a `cat atlantic_pipeline | grep bomb` thing?
- encryptluks2 5y ago
  It is really awesome. I was looking for a solution that allowed me to use the native Wireguard implementation without needing a third-party proprietary client. Mullvad was it and port forwarding was just one additional benefit. Vopono works great for my use cases, although I have a hard time sending everything through a VPN because pretty much every VPN provider is going to put you into captcha hell or some services straight up block you when you're behind a VPN.
  - kaino128 5y ago
    Yes, it’s great to be able to just use pure WireGuard - I’m allergic to the idea of VPN providers expecting you to run their proprietary app. WireGuard has a great iOS app these days too.
- mschuster91 5y ago
  > or is it more like of a `cat atlantic_pipeline | grep bomb` thing For what us ordinary people know, there are "selectors", something similar in purpose to regular expressions, that can filter out data out of the streams (not just raw IP communications, but also phone call metadata and PIR datasets from airlines) for storage and human inspection. Think of stuff like the phone numbers, names or email addresses of known or suspected "terrorists", drug dealers, organized criminals, or whomever else ends up on one of the flag lists.
  - bbarnett 5y ago
    It also can be used once shortlists are determined. EG, we suspect person 1. Now, do a deep search on 1, find associates, do deep search one those.
    - colejohnson66 5y ago
      And it gets even “better”: the “association” goes three levels deep. Basically, your friends’ friends’ friends. So if Alice knows Bob, Bob also knows Charlie, and Charlie also knows Dave, the mere suspicion against Alice is enough to sweep Dave into the dragnet. https://www.theguardian.com/world/interactive/2013/oct/28/nsa-files-decoded-hops https://www.theguardian.com/world/interactive/2013/oct/28/ns...
  - deleted 5y ago
    [deleted]
KarlKemp 5y ago
This feels like mullad is trying to tell us something? Or, maybe, it's just slightly inept at lobbying for their cause? It should really end with a specific call to action, or at least mention if there's any legislation going through the process right now that needs support or opposition? I guess the call-to-action is to use Mullvad (which I happen to do, and can't complain about). For Germany, I will add http://freiheitsrechte.org/ http://freiheitsrechte.org/ as the local equivalent of ACLU & EFF that one might want to join.
- SV_BubbleTime 5y ago
  Do take into consideration that this is a Mullvad VPN ad.
- Semaphor 5y ago
  Never heard of GFF, thanks for the link. For anyone who speaks German, the wikipedia article [0] has a decent summary of them. [0]: https://de.wikipedia.org/wiki/Gesellschaft_f%C3%BCr_Freiheitsrechte https://de.wikipedia.org/wiki/Gesellschaft_f%C3%BCr_Freiheit...
- maqp 5y ago
  You might want to remind people what commercial VPNs are good for: it masks the IP from _COMMERCIAL_ entities. It doesn't protect from the NSAs of the world because they have no restrictions in what VPN foreign servers they compromise, and FVEY routinely bypasses constitutional protections by compromising servers of opposing countries, e.g. GCHQ and NSA exchange data they extract from the opposing countries citizens. Mullvad and other VPNs only provide trivial layer of IP address masking, they don't automatically block the endless list of tracking elements from HTTP headers to web bugs, LSOs, JWTs, cookies, webRTC, or canvas fingerprinting, and user actions on the site. It's also the case simply downloading a bunch of browser plugins will probably make your browser look unique, if it wasn't already. The best protection you have for anonymous browsing is with the Tor Browser, where every Tor user falls into three buckets depending on the privacy slider setting. Commercial VPN to access the Internet is mostly a "feel good" service that offloads trust under foreign jurisdiction that might not e.g. have laws wrt. torrenting, but don't think for a second it provides safeguards against governments. It's not that Wireguard isn't excellent protocol, it's that the server is performance aside, just an ordinary computer that can be compromised invisibly with one expensive zero-day and a persistent rootkit, and there's nothing the companies can do about it.
around_here 5y ago
Ah yes “forced to surveil the populace”. This is horsehockey. They already do it, they just don’t want to be told what to do by daddy government. It’s “resistance as a competitive advantage”, minus the real resistance.
n8cpdx 5y ago
How trustworthy are these VPN services? I use them because it's the best I can do, but I'm very suspicious. I would think the NSA is misappropriating my tax dollars if they hadn't compromised all of the VPN providers years ago. We also know the US has a history of selling compromised security equipment (https://www.washingtonpost.com/graphics/2020/world/national-security/cia-crypto-encryption-machines-espionage/ https://www.washingtonpost.com/graphics/2020/world/national-...) Don't get me wrong, I wish the NSA wasn't what it is, but if I'm paying for the federal government to be doing work, I expect them to do it exceedingly well. So what's the case the United States is so incompetent as to let Mullvad go untapped? Edit: the answer is that there apparently is no case. maqp was writing up the answer to my question in a response to another comment while I was writing mine. Edit 2: My personal threat model largely accepts that the NSA, CIA, and FBI can have their way with me in the unlikely event that they notice my existence. I can live with that because they have no reason to take notice. Despite my annoying moral values, I'm not a threat to the state. However, I find the focus on nation-state actors in an ad for a service that clearly can't protect from them to be distressingly dishonest.
- badRNG 5y ago
  There's a difference between what the NSA and CIA can do and what the FBI can do. Even if you are an outspoken dissident, the FBI likely won't burn the supposed fact that they have backdoored all VPN companies to try to prosecute you. The value in clandestine backdoors like these are for intelligence, not law enforcement.
  - voxic11 5y ago
    With parallel construction the FBI doesn't need to burn anything.
- bjoli 5y ago
  I generally don't trust VPNs that seem to have a huge budget to spend on advertising, because that usually means they have had a shotload of investment that a VPN service will never be able to return to the investors. These VPNs are invariably owned in some weird ownership structure in jurisdictions I don't have any confidence in.
deleted 5y ago
[deleted]
nivenkos 5y ago
Mullvad are the best VPN service out there by far IMO - and writing vopono: https://github.com/jamesmcm/vopono https://github.com/jamesmcm/vopono - I used many of them! I think most VPN users just want something to access different Netflix catalogues though, and Mullvad doesn't play that cat and mouse game.
kkielhofner 5y ago
Strange the article doesn't mention CALEA[0] for the United States. This is what actual local/state/federal law enforcement uses (with a court order) for data/voice intercept. What's interesting about CALEA is it (essentially) requires compliance via devices with "LI" (lawful intercept) functionality and/or third party providers to provide "tap/trace" functionality in such a way that it's not even visible/detectable to the network provider, network admins, etc. This LI functionality is typically implemented at the network device/operating system level as defined by an ETSI standard[1]. I've never implemented it personally but from what I understand it basically allows for an LI provider to siphon off tap/trace data with something like a VPN back to the LI provider, who is also the contact for response to warrants, etc. So what happens is the LI provider gets a warrant for something like "give us everything to/from this device or phone number". The provider verifies the legality of the warrant, uses the ETSI standard to one or more devices on the provider network, receives the data, and then provides it to law enforcement (in real time). The network provider isn't even aware of the court order. The old trope in Mafia movies of "I got a guy inside the phone company to tip us off" hasn't been accurate since CALEA came into effect in 1995. [0] https://www.fcc.gov/public-safety-and-homeland-security/policy-and-licensing-division/general/communications-assistance https://www.fcc.gov/public-safety-and-homeland-security/poli... [1] https://www.etsi.org/technologies/lawful-interception https://www.etsi.org/technologies/lawful-interception
stavros 5y ago
By the way, the Max Schrems mentioned in the article has started an EU Privacy watchdog project: https://noyb.eu/ https://noyb.eu/ Please suport them with an annual donation, they seem very dedicated and the work they're doing is very worthwhile (and have already gotten significant results).
Wavelets 5y ago
This is sort of an aside, but I find it interesting that so many people’s threat models include the NSA/CIA. I see it all over the privacy-focused forums and subreddits I read. Don’t get me wrong - I believe privacy is a fundamental right and a carte blanche dragnet approach used by these agencies is not appropriate, but paying $10/mo for ProtonMail and ProtonVPN isn’t going to address that threat. That said, there is a balance between digital security/privacy and living a normal life. If you are truly trying to hide your online activities from those agencies, you are going to need to live a very specific lifestyle. I’m more concerned about my privacy being utterly raped for advertising purposes. That’s why I use a paid VPN, paid privacy-focused DNS, paid ProtonMail account, use Signal, etc. I could probably be better served from self hosting some of these things, but this is a good balance for me. It seems to me that this concern - hiding data from Google, Microsoft, Verizon, etc. - is secondary to hiding from the NSA/CIA in many open privacy conversations. Note - I am sympathetic to the fact that there are hostile governments all over the world and privacy-tooling is mandatory for whistle blowers, activists, protestors, journalists, etc.
- ufo 5y ago
  I think this comment would also have worked without the "r" word.
IronWolve 5y ago
My info is dated, back in the day when LI was passed became federal law, I working in telecom and we had to have LI ports on all backbone ISP routers. No idea what legal process they had there, but operations didn't touch the LI ports. I heard it had a federal portal that the feds could access directly. This was almost 2 decades ago, but on mobiles, they had a custom portal where you put in a phone number, and all traffic is logged, location, etc. Also they had a department to handle just warrants for data for mobiles. This is almost the same way we did for child porn cases about 10 years later in photo hosting. Either a photo matched a known md5 sum of content, or a cop would submit a warrant, legal would contact operations and ask us to run the warrant script. The script would zip up the entire user's data and burn to dvd. The cop would walk into the data center and pick it up. No chain of custody would include an employee. I'm assuming facebook/twitter has portals for feds now, since they already have government portals for cities/state employees.

148 points by Sami_Lehtinen 5y ago

I've only heard good things about mullvad and their Wireguard-based VPN solution (...so long as random reddit comments and forum posts are to be trusted). I wonder what 5/9/14 eyes actually do with the intercepted data? Isn't mere processing of the said data, a gargantuan task? Is this where Palantir comes to play or is it more like of a `cat atlantic_pipeline | grep bomb` thing?

encryptluks2 5y ago
It is really awesome. I was looking for a solution that allowed me to use the native Wireguard implementation without needing a third-party proprietary client. Mullvad was it and port forwarding was just one additional benefit. Vopono works great for my use cases, although I have a hard time sending everything through a VPN because pretty much every VPN provider is going to put you into captcha hell or some services straight up block you when you're behind a VPN.
- kaino128 5y ago
  Yes, it’s great to be able to just use pure WireGuard - I’m allergic to the idea of VPN providers expecting you to run their proprietary app. WireGuard has a great iOS app these days too.
mschuster91 5y ago
> or is it more like of a `cat atlantic_pipeline | grep bomb` thing For what us ordinary people know, there are "selectors", something similar in purpose to regular expressions, that can filter out data out of the streams (not just raw IP communications, but also phone call metadata and PIR datasets from airlines) for storage and human inspection. Think of stuff like the phone numbers, names or email addresses of known or suspected "terrorists", drug dealers, organized criminals, or whomever else ends up on one of the flag lists.
- bbarnett 5y ago
  It also can be used once shortlists are determined. EG, we suspect person 1. Now, do a deep search on 1, find associates, do deep search one those.
  - colejohnson66 5y ago
    And it gets even “better”: the “association” goes three levels deep. Basically, your friends’ friends’ friends. So if Alice knows Bob, Bob also knows Charlie, and Charlie also knows Dave, the mere suspicion against Alice is enough to sweep Dave into the dragnet. https://www.theguardian.com/world/interactive/2013/oct/28/nsa-files-decoded-hops https://www.theguardian.com/world/interactive/2013/oct/28/ns...
- deleted 5y ago
  [deleted]

KarlKemp 5y ago

This feels like mullad is trying to tell us something? Or, maybe, it's just slightly inept at lobbying for their cause? It should really end with a specific call to action, or at least mention if there's any legislation going through the process right now that needs support or opposition? I guess the call-to-action is to use Mullvad (which I happen to do, and can't complain about). For Germany, I will add http://freiheitsrechte.org/ http://freiheitsrechte.org/ as the local equivalent of ACLU & EFF that one might want to join.

SV_BubbleTime 5y ago
Do take into consideration that this is a Mullvad VPN ad.
Semaphor 5y ago
Never heard of GFF, thanks for the link. For anyone who speaks German, the wikipedia article [0] has a decent summary of them. [0]: https://de.wikipedia.org/wiki/Gesellschaft_f%C3%BCr_Freiheitsrechte https://de.wikipedia.org/wiki/Gesellschaft_f%C3%BCr_Freiheit...
maqp 5y ago
You might want to remind people what commercial VPNs are good for: it masks the IP from _COMMERCIAL_ entities. It doesn't protect from the NSAs of the world because they have no restrictions in what VPN foreign servers they compromise, and FVEY routinely bypasses constitutional protections by compromising servers of opposing countries, e.g. GCHQ and NSA exchange data they extract from the opposing countries citizens. Mullvad and other VPNs only provide trivial layer of IP address masking, they don't automatically block the endless list of tracking elements from HTTP headers to web bugs, LSOs, JWTs, cookies, webRTC, or canvas fingerprinting, and user actions on the site. It's also the case simply downloading a bunch of browser plugins will probably make your browser look unique, if it wasn't already. The best protection you have for anonymous browsing is with the Tor Browser, where every Tor user falls into three buckets depending on the privacy slider setting. Commercial VPN to access the Internet is mostly a "feel good" service that offloads trust under foreign jurisdiction that might not e.g. have laws wrt. torrenting, but don't think for a second it provides safeguards against governments. It's not that Wireguard isn't excellent protocol, it's that the server is performance aside, just an ordinary computer that can be compromised invisibly with one expensive zero-day and a persistent rootkit, and there's nothing the companies can do about it.

around_here 5y ago

Ah yes “forced to surveil the populace”. This is horsehockey. They already do it, they just don’t want to be told what to do by daddy government. It’s “resistance as a competitive advantage”, minus the real resistance.

n8cpdx 5y ago

How trustworthy are these VPN services? I use them because it's the best I can do, but I'm very suspicious. I would think the NSA is misappropriating my tax dollars if they hadn't compromised all of the VPN providers years ago. We also know the US has a history of selling compromised security equipment (https://www.washingtonpost.com/graphics/2020/world/national-security/cia-crypto-encryption-machines-espionage/ https://www.washingtonpost.com/graphics/2020/world/national-...) Don't get me wrong, I wish the NSA wasn't what it is, but if I'm paying for the federal government to be doing work, I expect them to do it exceedingly well. So what's the case the United States is so incompetent as to let Mullvad go untapped? Edit: the answer is that there apparently is no case. maqp was writing up the answer to my question in a response to another comment while I was writing mine. Edit 2: My personal threat model largely accepts that the NSA, CIA, and FBI can have their way with me in the unlikely event that they notice my existence. I can live with that because they have no reason to take notice. Despite my annoying moral values, I'm not a threat to the state. However, I find the focus on nation-state actors in an ad for a service that clearly can't protect from them to be distressingly dishonest.

badRNG 5y ago
There's a difference between what the NSA and CIA can do and what the FBI can do. Even if you are an outspoken dissident, the FBI likely won't burn the supposed fact that they have backdoored all VPN companies to try to prosecute you. The value in clandestine backdoors like these are for intelligence, not law enforcement.
- voxic11 5y ago
  With parallel construction the FBI doesn't need to burn anything.
bjoli 5y ago
I generally don't trust VPNs that seem to have a huge budget to spend on advertising, because that usually means they have had a shotload of investment that a VPN service will never be able to return to the investors. These VPNs are invariably owned in some weird ownership structure in jurisdictions I don't have any confidence in.

deleted 5y ago

[deleted]

nivenkos 5y ago

Mullvad are the best VPN service out there by far IMO - and writing vopono: https://github.com/jamesmcm/vopono https://github.com/jamesmcm/vopono - I used many of them! I think most VPN users just want something to access different Netflix catalogues though, and Mullvad doesn't play that cat and mouse game.

kkielhofner 5y ago

Strange the article doesn't mention CALEA[0] for the United States. This is what actual local/state/federal law enforcement uses (with a court order) for data/voice intercept. What's interesting about CALEA is it (essentially) requires compliance via devices with "LI" (lawful intercept) functionality and/or third party providers to provide "tap/trace" functionality in such a way that it's not even visible/detectable to the network provider, network admins, etc. This LI functionality is typically implemented at the network device/operating system level as defined by an ETSI standard[1]. I've never implemented it personally but from what I understand it basically allows for an LI provider to siphon off tap/trace data with something like a VPN back to the LI provider, who is also the contact for response to warrants, etc. So what happens is the LI provider gets a warrant for something like "give us everything to/from this device or phone number". The provider verifies the legality of the warrant, uses the ETSI standard to one or more devices on the provider network, receives the data, and then provides it to law enforcement (in real time). The network provider isn't even aware of the court order. The old trope in Mafia movies of "I got a guy inside the phone company to tip us off" hasn't been accurate since CALEA came into effect in 1995. [0] https://www.fcc.gov/public-safety-and-homeland-security/policy-and-licensing-division/general/communications-assistance https://www.fcc.gov/public-safety-and-homeland-security/poli... [1] https://www.etsi.org/technologies/lawful-interception https://www.etsi.org/technologies/lawful-interception

stavros 5y ago

By the way, the Max Schrems mentioned in the article has started an EU Privacy watchdog project: https://noyb.eu/ https://noyb.eu/ Please suport them with an annual donation, they seem very dedicated and the work they're doing is very worthwhile (and have already gotten significant results).

Wavelets 5y ago

This is sort of an aside, but I find it interesting that so many people’s threat models include the NSA/CIA. I see it all over the privacy-focused forums and subreddits I read. Don’t get me wrong - I believe privacy is a fundamental right and a carte blanche dragnet approach used by these agencies is not appropriate, but paying $10/mo for ProtonMail and ProtonVPN isn’t going to address that threat. That said, there is a balance between digital security/privacy and living a normal life. If you are truly trying to hide your online activities from those agencies, you are going to need to live a very specific lifestyle. I’m more concerned about my privacy being utterly raped for advertising purposes. That’s why I use a paid VPN, paid privacy-focused DNS, paid ProtonMail account, use Signal, etc. I could probably be better served from self hosting some of these things, but this is a good balance for me. It seems to me that this concern - hiding data from Google, Microsoft, Verizon, etc. - is secondary to hiding from the NSA/CIA in many open privacy conversations. Note - I am sympathetic to the fact that there are hostile governments all over the world and privacy-tooling is mandatory for whistle blowers, activists, protestors, journalists, etc.

ufo 5y ago
I think this comment would also have worked without the "r" word.

IronWolve 5y ago

My info is dated, back in the day when LI was passed became federal law, I working in telecom and we had to have LI ports on all backbone ISP routers. No idea what legal process they had there, but operations didn't touch the LI ports. I heard it had a federal portal that the feds could access directly. This was almost 2 decades ago, but on mobiles, they had a custom portal where you put in a phone number, and all traffic is logged, location, etc. Also they had a department to handle just warrants for data for mobiles. This is almost the same way we did for child porn cases about 10 years later in photo hosting. Either a photo matched a known md5 sum of content, or a cop would submit a warrant, legal would contact operations and ask us to run the warrant script. The script would zip up the entire user's data and burn to dvd. The cop would walk into the data center and pick it up. No chain of custody would include an employee. I'm assuming facebook/twitter has portals for feds now, since they already have government portals for cities/state employees.