20 ms·
Some new snippets from the Snowden documents
- xhoptre 3y ago[flagged]
- azinman2 3y agoI doubt it’s connected but would be fascinating if true.
- johnnyworker 3y agoBecause they're so bad it would need a global system of total surveillance to catch them? Sure. https://news.ycombinator.com/item?id=11872642 https://news.ycombinator.com/item?id=11872642 ^ that is what that is. Or, in more detail: https://github.com/Enegnei/JacobAppelbaumLeavesTor/blob/master/JacobAppelbaumLeavesTor.md https://github.com/Enegnei/JacobAppelbaumLeavesTor/blob/mast... You can't connect real things like these documents with slander by people who do nothing to step on the toes of the NSA. That is all that the BS about Assange or Appelbaum being a sex menace or Snowden being a Russian asset is. "Oh noes, they're a threat to the work we're not doing". Nobody is asking you to get drinks with Assange or Appelbaum. They don't want to be your friend. It's okay if you don't like them, for whatever personal reasons (and choosing to fall for this crap falls under personal reasons). It's not okay to be part of a mob that murders people by throwing a pebble each with this plausible deniability, in this "genuinely curious" just wondering kind of way. Enough is enough. It certainly isn't fascinating. 3 letter agencies are torturing and murdering people, and having nothing better to do than gossip about gossip about messengers is just vulgar, boring, infantile cowardice, puffed up with not even clever words.
- Krasnol 3y agoThis is a genuine question, I am curious as to what drives men such as you to such comments.
- didntcheck 3y agoIt doesn't take much outlandish theorizing to wonder who might be interested in character assassination of people challenging surveillance
- deleted 3y ago[deleted]
- drunner 3y agoWhat an awful take.
- umeshunni 3y agowhat was the take?
- lcnPylGDnU4H9OF 3y agoThere is an option in your profile called “showdead”. You should be able to read the comment after updating that option to be affirmative.
- ementally 3y agoShould have just kept it off.
- lcnPylGDnU4H9OF 3y agoI love reading the controversial things. Admittedly, it’s very commonly low quality like OP in this thread but sometimes you get good if unpopular arguments. The challenge to my worldview is a utility that’s difficult to replace.
- neilv 3y ago> "How do they accomplish their goals with project BULLRUN? One way is that United States National Security Agency (NSA) participates in Internet Engineering Task Force (IETF) community protocol standardization meetings with the explicit goal of sabotaging protocol security to enhance NSA surveillance capabilities." "Discussions with insiders confirmed what is claimed in as of yet unpublished classified documents from the Snowden archive and other sources." (page 6-7, note 8) There's long been stories about meddling in other standards orgs (both to strengthen and to weaken them), but I don't recall hearing rumors about sabotage of IETF standards.
- jdougan 3y agoI'm curious as to how successful they were at subverting the IETF process. It wouldn't be impossible, but since much of the process is in the open it could be difficult, especially if they did it under their own name. I suspect most of it was done under different corporate identities, and probaby just managed to slow adoption of systematic security architectures. Of course, once the Snowden papers came out, all that effort was rendered moot as the IETF reacted pretty hard.
- esafak 3y agoIs there any write-up on the IETF reaction?
- jdougan 3y agoThere were a bunch at the time, a historical retrospective is "RFC 9446 Reflections on Ten Years Past the Snowden Revelations" https://www.rfc-editor.org/rfc/rfc9446.html https://www.rfc-editor.org/rfc/rfc9446.html
- gustavus 3y agoYa ever heard of the OAuth2 protocol? I spent almost half a decade working on identity stuff, and spending a lot of time in OAuth land. OAuth is an overly complicated mess that has many many ways to go wrong and very few ways to go right. If you told me the NSA/CIA had purposefully sabotaged the development of the OAuth2 protocol to make it so complex that no one can implement it securely it'd be the best explanation I've heard yet about why it is the monstrosity it is.
- older 3y ago[flagged]
- shmde 3y agoMy conspiracy theory is that AES 256 has been cracked by NSA/CIA but they just shut up about it so everyone feels safe.
- slackfan 3y agoTry to implement out-of-spec authentication and watch your logs fill up with bots.
- sunk1st 3y agoWhat’s the implication? Sorry. I can see it going either way.
- sandworm101 3y agoIf AES is cracked by the NSA then they know that there is a fault. They must therefore assume that others could know about it and might exploit that fault, either now or in the future. A massive amount of American infrastructure, including intelligence services, relies upon AES not having such holes. They wouldn't sit on such information.
- TrapLord_Rhodo 3y agoThe government is known to horde and deploy zero days for surveillance... That was part of the snowden leak. google/Ask chatgpt about Tailored Access Operations revealed under the snowden papers.
- AnimalMuppet 3y agoThey wouldn't go public with such information. They would very quietly get the most important parts moved off of it, quickly, with as little noise as possible.
- sandworm101 3y agoMoving any part of the US government off of AES would be noticed. The NSA doesn't send IT people to do installs. They set standards which are then incorporated into products by outside contractors selling to government agencies. Any attempted migration away from AES would be news here on HN within hours.
- ftyers 3y agoWow djb was on his committee, cool.
- tptacek 3y agoDJB is widely thought to be the entire reason he was in the program at all.
- dontdoxxme 3y agoMaybe not cool. There’s discussion in many places, but see https://news.ycombinator.com/item?id=13891900 https://news.ycombinator.com/item?id=13891900 for background.
- SV_BubbleTime 3y ago>https://en.wikipedia.org/wiki/Daniel_J._Bernstein https://en.wikipedia.org/wiki/Daniel_J._Bernstein I didn’t know who this was, others probably too.
- justusw 3y agoSo if governments are sniffing on high entropy traffic, could we just send normal seeming (SSH or whatever) packets with the payload coming from /dev/urandom? Would that be a denial of service?
- __MatrixMan__ 3y agoWhen they find a way to "decrypt" /dev/urandom output into, you know, whatever is expedient for them at some future date, do you think a secret judge in a secret court is going to believe that you were just moving around random noise for the lulz?
- ta988 3y agoYour random string at position 483828180 says IdIdIt that's our proof right here
- lmm 3y agoIf you could get enough people doing it, yes. But in practice the only people who would care enough would be the people the governments want to watch. Even a decent chunk of the crypto community would rather dunk on a cryptosystem they don't like than actually encrypt their emails (although of course how much of that is the NSA disrupting things is an open question).
- elcritch 3y agoI actually sorta think unencrypted email has been a boon for society as both corporations and government agencies have left paper trails that helped expose their misdeeds later.
- BlueTemplar 3y agoI thought there were wildly popular messaging apps now that were encrypted by default ?
- lmm 3y ago
- dmix 3y agoArticle references Russias SORM system which provides not only FSB but the police and tax agencies with basically fully access to everything on the internet including credit card transactions, this stuff started in 1995 and was penetrated by the NSA > Under SORM‑2, Russian Internet service providers (ISPs) must install a special device on their servers to allow the FSB to track all credit card transactions, email messages and web use. The device must be installed at the ISP's expense. originally there was a warrant system but it seemed quite liberal and they don’t bother with the secret court system “oversight” like the US: > Since 2010, intelligence officers can wiretap someone's phones or monitor their Internet activity based on received reports that an individual is preparing to commit a crime. They do not have to back up those allegations with formal criminal charges against the suspect. According to a 2011 ruling, intelligence officers have the right to conduct surveillance of anyone who they claim is preparing to call for "extremist activity." https://en.wikipedia.org/wiki/SORM?wprov=sfti1 https://en.wikipedia.org/wiki/SORM?wprov=sfti1 Then in 2016 a counter terrorism law was passed and it sounds like they ISPs/telecoms are required to store everything for 6 months and it merely has to be requested by “authorities” (guessing beyond just the FSB) without a court order > Internet and telecom companies are required to disclose these communications and metadata, as well as "all other information necessary" to authorities on request and without a court order https://en.wikipedia.org/wiki/Yarovaya_law?wprov=sfti1 https://en.wikipedia.org/wiki/Yarovaya_law?wprov=sfti1 > Equally troubling, the new counterterrorism law also requires Internet companies to provide to security authorities “information necessary for decoding” electronic messages if they encode messages or allow their users to employ “additional coding.” Since a substantial proportion of Internet traffic is “coded” in some form, this provision will affect a broad range of online activity.
- SenAnder 3y ago> Then in 2016 a counter terrorism law was passed and it sounds like they ISPs/telecoms are required to store everything for 6 months and it merely has to be requested by “authorities” (guessing beyond just the FSB) without a court order Russia is not alone. The EU required the same thing from 2006, until the EU Court struck it down in 2014: https://en.wikipedia.org/wiki/Data_Retention_Directive https://en.wikipedia.org/wiki/Data_Retention_Directive https://en.wikipedia.org/wiki/Data_retention#European_Union https://en.wikipedia.org/wiki/Data_retention#European_Union is a fun read in how the EU fined countries for adhering to their respective national constitutions and refusing to implement that directive. Looking beyond the EU, there are plenty of allegedly democratic countries on that wiki page with legally-required data retention: In 2015, the Australian government introduced mandatory data retention laws that allows data to be retained up to two years. [..] It requires telecommunication providers and ISPs to retain telephony, Internet and email metadata for two years, accessible without a warrant
- Dovthelachman 3y agosee https://dovthelachman.com/ https://dovthelachman.com/