7 ms·

Curious if they can also tap encrypted content? Maybe for high interest targets a certain amount of cracking power can be directed to it?

cronix 5y ago
Collect all, decrypt if/when able.
bullen 5y ago
Do you really think they would allow HTTPS if they couldn't read it?
- _8j50 5y ago
  Yes, if they have alternative means to discover that data. "They" don't need to decrypt TLS but if they did, they could. We are speculating here.
- fguerraz 5y ago
  It's unlikely that "they" can break TLS protected traffic at scale, however, it's likely that they don't need to. Usually, TLS is terminated on a load balancer and then the data in the data-centre flows in clear text. I is good practice to encrypt internal traffic but few companies do it because of the overhead. So "they" could sniff unencrypted traffic there, if they pay the data-centre providers. Also, NSA is known to have modified network gear [1], so if they do that on a load balancer (or hack a software one) they can just sniff the encrypted traffic downstream and extract the session keys from the equipment. Then they can just decrypt the traffic without having to actually break RSA/ECC. Other governments have had less subtle approaches by doing MITM attacks with compromised certificate roots, which is now somewhat mitigated with certificate pinning in modern browsers. And of course there is the topic of secure protocols but compromised by design apps, such as WhatsApp. Even admitting that the Signal protocol is implemented correctly in WhatsApp, because the app is closed-source, they can read the unencrypted traffic from the app itself, and if they get caught doing it, they can say it's for moderation purposes [2]. If all of the above fails, you can always rely on Pegasus or similar. Once you have a rootkit on the device, you have access to everything in clear-text. [1] https://arstechnica.com/tech-policy/2014/05/photos-of-an-nsa-upgrade-factory-show-cisco-router-getting-implant/ https://arstechnica.com/tech-policy/2014/05/photos-of-an-nsa... [2] https://gizmodo.com/whatsapp-moderators-can-read-your-messages-1847629241 https://gizmodo.com/whatsapp-moderators-can-read-your-messag...
  - hilbert42 5y ago
    "Also, NSA is known to have modified network gear <...> they can just sniff the encrypted traffic downstream and extract the session keys from the equipment. Then they can just decrypt the traffic without having to actually break RSA/ECC." Exactly, this fact seems to have been lost on many. There's nothing wrong with using encryption on a day-to-day basis such as when we use https web pages, or buy something online, or when we don't want Google to read our email but it's another matter altogether when the stakes are much higher such as, say, leaking human rights abuses from within the confines of a totalitarian state. When the stakes are high there are many other considerations to address. Not only do you have to consider what happens inside a server but also think about its physical security along with the possibility that data recovery tools may be used by the State to recover a copy of a critical email you sent after which you deleted. And that's just for staters. An important rule to always assume and to adhere to before going online is that it's a safe bet that the State will be able to access anything you say or do on your PC, smartphone and or when you are online - and that it will be able to do so long after the event.
xuki 5y ago
Now that CloudFlare is a thing there is an incredible obvious way to snoop encrypted data..
- _8j50 5y ago
  Not really.. i mean to sites whose owners set them up with cloudflare... sure but cdns aren't knew. Akamai,fastly,etc... are a thing. But it's not that different than compromising could provider or server hosting providers. I think you misunderstand the purpose of dragnet, it is to identify targets of interest. Decrypting content is not needed, i mean it is desirable but even with sni encryption and DoH it is possible to identify targets of interest. Once identified,from what I have heard, they target your device or a common server targets of interest use, compromising those allows them to see much more than decrypted TLS. Since we are speculating, what makes you so sure submarine cable tapping spies that can compromise cloudflare (or coerce) cannot do the same with say... Let'sEncrypt's root signing keys? They don't even have to mess with CT logs that way. Unless you are sayinf the handful of private keys used to encrypt most TLS traffic are impossible to compromise, even with nation state resources.
hulitu 5y ago
The only benefit of https today seems to be planned obsolescence. There are a lot of certificates issued by states or organization which cannot be reasonable trusted. Also in case of a lot of OS' (android, ios, Macosx, windows) you do not control your endpoint. So i do not see any added benefit for https.
- brigandish 5y ago
  > So i do not see any added benefit for https Doesn't it, at least, protect against snooping by (most) non-state actors? I'm pretty sure MI6 can break into my house, that doesn't mean I'm going to give up on locking my door.
marcan_42 5y ago
They can easily crack content using 1024-bit Diffie-Hellman key exchanges with hardcoded parameters, which used to be common in VPN software and some servers. There was a big collective facepalm in the crypto community when this was revealed. Basically, they found a way to spend a lot of compute power once to crack a parameter set, then they can use it basically for free for any sessions using those parameters. Other than that and backdoored software (e.g. stuff using RSA Bsafe with Dual-EC-DRBG, which has an NSA backdoor, or those Juniper VPNs which used the same), I don't think they can do much about modern TLS besides exploit obvious flaws in the implementations.
- goalieca 5y ago
  Vpn configurations are so often poorly chosen and we should not let critical infrastructure run on outdated IPsec for instance. It may seem natural to build such infrastructure for a life span of 20-30 years but do you remember what state of the art was back in 2001? Most of that is now basically considered broken. Software is living and should never be « set-and-forget »
  - analognoise 5y ago
    What? Software is immortal and binary - there are no transcription errors or mutations in a correct copy routine. Why shouldn't software be set and forget? Don't Ada and VHDL have massive amounts of re-use of things written in the 80's and 90's?
    - sidpatil 5y ago
      The software may not change, but the world around it does.
      - analognoise 5y ago
        That's bullshit I regularly re-use old code. Let's just admit it - that's a cover for today's bad programmers.
aborsy 5y ago
Compromising Certificate Authorities and various root endpoints is probably what’s is done since https became ubiquitous.
- fguerraz 5y ago
  That is way too obvious and I doubt any western country would do it on their homeland, the political risk is just too big.
  - kongin 5y ago
    You both overestimate and underestimate the intelligence of intelligence agencies.
    - fguerraz 5y ago
      I'm not saying they can't pull it off, but why use this method that is very detectable when you can use others that are transparent to the user (see my other comment)?
  - bigiain 5y ago
    Yeah. You don’t do this to your own country people. You get one of your five eyes friends to do it for you.
  - endymi0n 5y ago
    It‘s not exactly like there‘s no precedent… https://news.ycombinator.com/item?id=9076351 https://news.ycombinator.com/item?id=9076351
- tinus_hn 5y ago
  Compromising certificate authorities does not help in decrypting the data that is transmitted unless it is an active attack that modifies data.
- tialaramex 5y ago
  Because we have Certificate Transparency the evidence if this was happening is publicly available (whereas without CT it's just given to everybody connecting to this hypothetical bogus server) So, where's the evidence? Without CT you could imagine that the spooks are snooping on everybody else and that's why you don't have any evidence -- they knew you were too smart, but with CT you can go look for evidence they snooped your grandmother's online bingo or your second cousin's Trump fandom forum, and well, seems like there just isn't any. The Russians don't care if they're known to be doing crimes, that's why they sent assassins to England to murder an ex-spy and then offered the most stupid transparent lie about the men being "tourists". But the NSA is kinda sensitive about this stuff, they like plausible deniability. So, why would they choose a method that provides a signed paper trail proving they did it?
tinus_hn 5y ago
You can always keep the encrypted data until technology has advanced far enough to easily decrypt it.
- tialaramex 5y ago
  There's an excellent chance you will wait forever. I'm going to give the same example I always do. In 1977 they standardised DES. DES was already publicly known to be weak in two specific ways, the keys are too short (56-bits), and the block size is too small (64-bits). This was done intentionally. Today you can break DES... by exploiting these two weaknesses with today's cheaper hardware. No other meaningful attacks on DES worked, it has performed exactly as designed for well over forty years. At the turn of the century DES was replaced by AES. AES has 128-bit or 256-bit keys, and 128 bit blocks. So, brute force attacks known to be viable for DES are never going to be possible for AES because physics. You would need one of those mathematical breakthroughs that never happened for DES in, as I wrote, almost fifty years. Don't hold your breath. Because of this, encrypted material probably gets less valuable over time, as keys which did exist and might become available to you in future are instead lost or destroyed. And the pace accelerates. With TLS 1.2 it was plausible that you (assuming "you" are a powerful adversary able to do stuff like seize people's property) could seize a running HTTPS server and use its "ephemeral" secrets to decrypt traffic from yesterday, or maybe even last week, but in TLS 1.3 the mechanism is more fleeting, perhaps you can decrypt messages from ten minutes ago, but without the client's help perhaps not at all.
  - tinus_hn 5y ago
    Storage is almost free so you can easily afford to wait just about forever, you don’t need to crack AES to crack TLS because you can also crack the key exchange or find a weakness in the RNG or the algorithm and we all know everybody knows something is impossible until someone comes around and does it.
    - brigandish 5y ago
      The perfect is the enemy of the good. By that I mean that there is no perfect security, at some point, if given long enough, security of any system (computer or otherwise) can/will be broken. The point is to slow it down for long enough that it is of no use. I have to wonder what kind of information is useful enough to wait forever for? What kind of personal information of mine, for example, will be useful after I'm dead? There may be something. Even if we look at state actors it doesn't change - if China's government manages to decrypt something the UK has that is useful now, like some advanced technology, will it still be advanced when its encryption is cracked? Slow them down for even 20 years and it'll be too long to wait.
LatteLazy 5y ago
During the cold war both sides recorded everything because they realised that today's "unbreakable" encryption would be nothing in 10 years time. That's not quite so true anymore as Moores law is stumbling, but it's still a pretty cheap strategy, you just need a big pile of storage...
- _8j50 5y ago
  I hate it when people say that, especially when they know very well bruteforce isn't exactly the only way to break a cipher. I think if theu are honest, they all admit all of it is speculation (educated, but still), no one knows if there will be a discovery in physics, mathematics or information theory that can undo a cipher. Or even just a weakness in the cipher.
azalemeth 5y ago
Even if they can't, one of the key things to come out of Snowden's revelations was that the metadata of the state of the network alone is sufficiently interesting to be worth keeping. Unless everyone talks to everyone else with a constant bandwidth message, information _will_ leak. It's just a matter of "how much".
- recov 5y ago
  I'm always happy to see snowden mentioned, and how his leaks seemingly will never go away. One of my fears was that he would be forgotten in 1-2 years.

cronix 5y ago

Collect all, decrypt if/when able.

bullen 5y ago

Do you really think they would allow HTTPS if they couldn't read it?

_8j50 5y ago
Yes, if they have alternative means to discover that data. "They" don't need to decrypt TLS but if they did, they could. We are speculating here.
fguerraz 5y ago
It's unlikely that "they" can break TLS protected traffic at scale, however, it's likely that they don't need to. Usually, TLS is terminated on a load balancer and then the data in the data-centre flows in clear text. I is good practice to encrypt internal traffic but few companies do it because of the overhead. So "they" could sniff unencrypted traffic there, if they pay the data-centre providers. Also, NSA is known to have modified network gear [1], so if they do that on a load balancer (or hack a software one) they can just sniff the encrypted traffic downstream and extract the session keys from the equipment. Then they can just decrypt the traffic without having to actually break RSA/ECC. Other governments have had less subtle approaches by doing MITM attacks with compromised certificate roots, which is now somewhat mitigated with certificate pinning in modern browsers. And of course there is the topic of secure protocols but compromised by design apps, such as WhatsApp. Even admitting that the Signal protocol is implemented correctly in WhatsApp, because the app is closed-source, they can read the unencrypted traffic from the app itself, and if they get caught doing it, they can say it's for moderation purposes [2]. If all of the above fails, you can always rely on Pegasus or similar. Once you have a rootkit on the device, you have access to everything in clear-text. [1] https://arstechnica.com/tech-policy/2014/05/photos-of-an-nsa-upgrade-factory-show-cisco-router-getting-implant/ https://arstechnica.com/tech-policy/2014/05/photos-of-an-nsa... [2] https://gizmodo.com/whatsapp-moderators-can-read-your-messages-1847629241 https://gizmodo.com/whatsapp-moderators-can-read-your-messag...
- hilbert42 5y ago
  "Also, NSA is known to have modified network gear <...> they can just sniff the encrypted traffic downstream and extract the session keys from the equipment. Then they can just decrypt the traffic without having to actually break RSA/ECC." Exactly, this fact seems to have been lost on many. There's nothing wrong with using encryption on a day-to-day basis such as when we use https web pages, or buy something online, or when we don't want Google to read our email but it's another matter altogether when the stakes are much higher such as, say, leaking human rights abuses from within the confines of a totalitarian state. When the stakes are high there are many other considerations to address. Not only do you have to consider what happens inside a server but also think about its physical security along with the possibility that data recovery tools may be used by the State to recover a copy of a critical email you sent after which you deleted. And that's just for staters. An important rule to always assume and to adhere to before going online is that it's a safe bet that the State will be able to access anything you say or do on your PC, smartphone and or when you are online - and that it will be able to do so long after the event.

xuki 5y ago

Now that CloudFlare is a thing there is an incredible obvious way to snoop encrypted data..

_8j50 5y ago
Not really.. i mean to sites whose owners set them up with cloudflare... sure but cdns aren't knew. Akamai,fastly,etc... are a thing. But it's not that different than compromising could provider or server hosting providers. I think you misunderstand the purpose of dragnet, it is to identify targets of interest. Decrypting content is not needed, i mean it is desirable but even with sni encryption and DoH it is possible to identify targets of interest. Once identified,from what I have heard, they target your device or a common server targets of interest use, compromising those allows them to see much more than decrypted TLS. Since we are speculating, what makes you so sure submarine cable tapping spies that can compromise cloudflare (or coerce) cannot do the same with say... Let'sEncrypt's root signing keys? They don't even have to mess with CT logs that way. Unless you are sayinf the handful of private keys used to encrypt most TLS traffic are impossible to compromise, even with nation state resources.

hulitu 5y ago

The only benefit of https today seems to be planned obsolescence. There are a lot of certificates issued by states or organization which cannot be reasonable trusted. Also in case of a lot of OS' (android, ios, Macosx, windows) you do not control your endpoint. So i do not see any added benefit for https.

brigandish 5y ago
> So i do not see any added benefit for https Doesn't it, at least, protect against snooping by (most) non-state actors? I'm pretty sure MI6 can break into my house, that doesn't mean I'm going to give up on locking my door.

marcan_42 5y ago

They can easily crack content using 1024-bit Diffie-Hellman key exchanges with hardcoded parameters, which used to be common in VPN software and some servers. There was a big collective facepalm in the crypto community when this was revealed. Basically, they found a way to spend a lot of compute power once to crack a parameter set, then they can use it basically for free for any sessions using those parameters. Other than that and backdoored software (e.g. stuff using RSA Bsafe with Dual-EC-DRBG, which has an NSA backdoor, or those Juniper VPNs which used the same), I don't think they can do much about modern TLS besides exploit obvious flaws in the implementations.

goalieca 5y ago
Vpn configurations are so often poorly chosen and we should not let critical infrastructure run on outdated IPsec for instance. It may seem natural to build such infrastructure for a life span of 20-30 years but do you remember what state of the art was back in 2001? Most of that is now basically considered broken. Software is living and should never be « set-and-forget »
- analognoise 5y ago
  What? Software is immortal and binary - there are no transcription errors or mutations in a correct copy routine. Why shouldn't software be set and forget? Don't Ada and VHDL have massive amounts of re-use of things written in the 80's and 90's?
  - sidpatil 5y ago
    The software may not change, but the world around it does.
    - analognoise 5y ago
      That's bullshit I regularly re-use old code. Let's just admit it - that's a cover for today's bad programmers.

aborsy 5y ago

Compromising Certificate Authorities and various root endpoints is probably what’s is done since https became ubiquitous.

fguerraz 5y ago
That is way too obvious and I doubt any western country would do it on their homeland, the political risk is just too big.
- kongin 5y ago
  You both overestimate and underestimate the intelligence of intelligence agencies.
  - fguerraz 5y ago
    I'm not saying they can't pull it off, but why use this method that is very detectable when you can use others that are transparent to the user (see my other comment)?
- bigiain 5y ago
  Yeah. You don’t do this to your own country people. You get one of your five eyes friends to do it for you.
- endymi0n 5y ago
  It‘s not exactly like there‘s no precedent… https://news.ycombinator.com/item?id=9076351 https://news.ycombinator.com/item?id=9076351
tinus_hn 5y ago
Compromising certificate authorities does not help in decrypting the data that is transmitted unless it is an active attack that modifies data.
tialaramex 5y ago
Because we have Certificate Transparency the evidence if this was happening is publicly available (whereas without CT it's just given to everybody connecting to this hypothetical bogus server) So, where's the evidence? Without CT you could imagine that the spooks are snooping on everybody else and that's why you don't have any evidence -- they knew you were too smart, but with CT you can go look for evidence they snooped your grandmother's online bingo or your second cousin's Trump fandom forum, and well, seems like there just isn't any. The Russians don't care if they're known to be doing crimes, that's why they sent assassins to England to murder an ex-spy and then offered the most stupid transparent lie about the men being "tourists". But the NSA is kinda sensitive about this stuff, they like plausible deniability. So, why would they choose a method that provides a signed paper trail proving they did it?

tinus_hn 5y ago

You can always keep the encrypted data until technology has advanced far enough to easily decrypt it.

tialaramex 5y ago
There's an excellent chance you will wait forever. I'm going to give the same example I always do. In 1977 they standardised DES. DES was already publicly known to be weak in two specific ways, the keys are too short (56-bits), and the block size is too small (64-bits). This was done intentionally. Today you can break DES... by exploiting these two weaknesses with today's cheaper hardware. No other meaningful attacks on DES worked, it has performed exactly as designed for well over forty years. At the turn of the century DES was replaced by AES. AES has 128-bit or 256-bit keys, and 128 bit blocks. So, brute force attacks known to be viable for DES are never going to be possible for AES because physics. You would need one of those mathematical breakthroughs that never happened for DES in, as I wrote, almost fifty years. Don't hold your breath. Because of this, encrypted material probably gets less valuable over time, as keys which did exist and might become available to you in future are instead lost or destroyed. And the pace accelerates. With TLS 1.2 it was plausible that you (assuming "you" are a powerful adversary able to do stuff like seize people's property) could seize a running HTTPS server and use its "ephemeral" secrets to decrypt traffic from yesterday, or maybe even last week, but in TLS 1.3 the mechanism is more fleeting, perhaps you can decrypt messages from ten minutes ago, but without the client's help perhaps not at all.
- tinus_hn 5y ago
  Storage is almost free so you can easily afford to wait just about forever, you don’t need to crack AES to crack TLS because you can also crack the key exchange or find a weakness in the RNG or the algorithm and we all know everybody knows something is impossible until someone comes around and does it.
  - brigandish 5y ago
    The perfect is the enemy of the good. By that I mean that there is no perfect security, at some point, if given long enough, security of any system (computer or otherwise) can/will be broken. The point is to slow it down for long enough that it is of no use. I have to wonder what kind of information is useful enough to wait forever for? What kind of personal information of mine, for example, will be useful after I'm dead? There may be something. Even if we look at state actors it doesn't change - if China's government manages to decrypt something the UK has that is useful now, like some advanced technology, will it still be advanced when its encryption is cracked? Slow them down for even 20 years and it'll be too long to wait.

LatteLazy 5y ago

During the cold war both sides recorded everything because they realised that today's "unbreakable" encryption would be nothing in 10 years time. That's not quite so true anymore as Moores law is stumbling, but it's still a pretty cheap strategy, you just need a big pile of storage...

_8j50 5y ago
I hate it when people say that, especially when they know very well bruteforce isn't exactly the only way to break a cipher. I think if theu are honest, they all admit all of it is speculation (educated, but still), no one knows if there will be a discovery in physics, mathematics or information theory that can undo a cipher. Or even just a weakness in the cipher.

azalemeth 5y ago

Even if they can't, one of the key things to come out of Snowden's revelations was that the metadata of the state of the network alone is sufficiently interesting to be worth keeping. Unless everyone talks to everyone else with a constant bandwidth message, information _will_ leak. It's just a matter of "how much".

recov 5y ago
I'm always happy to see snowden mentioned, and how his leaks seemingly will never go away. One of my fears was that he would be forgotten in 1-2 years.