4 ms·

> to counteract the increasing threat of total communications surveillance by governments So I guess SSL man in the middle will be coming soon? If it isn't her

> to counteract the increasing threat of total communications surveillance by governments So I guess SSL man in the middle will be coming soon? If it isn't here already, of course. Doesn't anyone else feel that the answer to over-surveillance from the government isn't a technological arms race but a political debate about the virtues of freedom?

elemeno 15y ago
It's already here and it's been here for a while. I work in the financial industry where there are some strict regulatory requirements about information flow (you know, things like like insider trading and maintaining firewalls between different parts of big banks and stuff like that) and all the large banks that I know of are performing an SSL man-in-the-middle on their gateways and have been for quite a while. Within a corporate setting it's very easy to do - you issue your own certs which are set to be trusted by internal computers and reencrypt with those at the gateways.
- pyre 15y ago
  I don't think that this is what was meant in the post you are replying to.
- bigiain 15y ago
  That works when "the corporation" controls your desktop and the certs your browser trusts, doesn't work so well when your (personal) smartphone or iPad is connecting out of the office over the cell network. The recent Mozilla/Trustwave (and DigiCert before) debacles make it very clear that a nation-state level adversary is almost certainly capable of SSL mitm-ing just about any internet traffic they want. Unless you're getting your data in and out of your country via encrypted packets over ham radio (and into a country you trust), there's just too few businesses a government agency would have to "lean on" to ensure your SSL encrypted packets are reliably secure.
bigiain 15y ago
Keep in mind too, that "encrypt everything" only solves part of the "problem" of communications surveillance. If the apparently-not-april-fools-gag reports out of the UK [1] over the weekend are to be believed, police agencies are deciding amongst themselves that the time/date/length/frequency/endpoints of any internet communication are things that they don't need warrants or oversight for. Encrypting the _contents_ of your email/texts/phonecalls/websitevisits still gives them access to the social graph in which you're communicating. Suppose one of your "brogrammer" colleaues sends out email to a group of recipients every Friday afternoon, one to you with some regular work-related business, and a dozen to his 'bros'. You send your usual response, and so do his bros, then he texts a particular number, gets a call back from that number. When that number becomes part of an investigation and turns out ,say, to be a cocaine dealers "burner phone" - guess what _you_ just started to look like part of? And if you've got some hacktivist-motivated software in place to strongly encrypt the mail between you and your coworker, how do you think _that's_ going to look to the investigators? (feel free to invent your own bad scenario about the "war on terror" or the "saving children from pedophiles" or the "occupy movement" or "overzealous corporate IP enforcement" instead of the "war on drugs") I don't know how to solve that - but some TOR-like multi-juristiction-distributed email/text/IM routing mechanism, where the source/destination information is part of the encrypted payload so "they" only get to see the hop between you and your nearest node, along with (crypographically) randomised message forwarding delays, payload padding, and "bogus messages" to mitigate traffic analysis (the first to stop someone noticing "Alice sent a message into node 1 and Bob simultaneously received a message from node 2", the second prevents leaks like "Alice sent a 13.2k message into node 1, and Bob received a 13.2k message from node 2", and the third to solve "Alice sent 8 messages into node 1 and Bob received 8 messages from node 2") [1] http://www.examiner.com/technology-in-national/u-k-gov-t-set-to-announce-real-time-phone-email-web-monitoring-proposal http://www.examiner.com/technology-in-national/u-k-gov-t-set...
- JonnieCache 15y ago
  >some TOR-like multi-juristiction-distributed email/text/IM routing mechanism, where the source/destination information is part of the encrypted payload so "they" only get to see the hop between you and your nearest node, along with (crypographically) randomised message forwarding delays, payload padding, and "bogus messages" to mitigate traffic analysis http://secushare.org/ http://secushare.org/
nextparadigms 15y ago
You're right of course. Finding alternatives like these should never be a long term solution, but only a temporary solution. Because if we treat it like a technical problem and not a political one, then it will only be a matter of time before they find ways to make those solutions illegal, or to monitor and breach them through the Government's agencies.
mike-cardwell 15y ago
The answer is to do both. You can have a political debate about freedom and come to sane conclusions. Ten years or one terrorist attack later and you're back having the same debate with a possibly different conclusion. And don't forget, every country in the World would need to have this debate. And I'm pretty sure, countries will always consider the surveillance of people in foreign countries fare game if they can get away with it. The US and the UK (my home) certainly will. We should strive for technical solutions which make mass surveillance either impossible, or more realistically so expensive it becomes infeasible. Money talks.

elemeno 15y ago

It's already here and it's been here for a while. I work in the financial industry where there are some strict regulatory requirements about information flow (you know, things like like insider trading and maintaining firewalls between different parts of big banks and stuff like that) and all the large banks that I know of are performing an SSL man-in-the-middle on their gateways and have been for quite a while. Within a corporate setting it's very easy to do - you issue your own certs which are set to be trusted by internal computers and reencrypt with those at the gateways.

pyre 15y ago
I don't think that this is what was meant in the post you are replying to.
bigiain 15y ago
That works when "the corporation" controls your desktop and the certs your browser trusts, doesn't work so well when your (personal) smartphone or iPad is connecting out of the office over the cell network. The recent Mozilla/Trustwave (and DigiCert before) debacles make it very clear that a nation-state level adversary is almost certainly capable of SSL mitm-ing just about any internet traffic they want. Unless you're getting your data in and out of your country via encrypted packets over ham radio (and into a country you trust), there's just too few businesses a government agency would have to "lean on" to ensure your SSL encrypted packets are reliably secure.

bigiain 15y ago

Keep in mind too, that "encrypt everything" only solves part of the "problem" of communications surveillance. If the apparently-not-april-fools-gag reports out of the UK [1] over the weekend are to be believed, police agencies are deciding amongst themselves that the time/date/length/frequency/endpoints of any internet communication are things that they don't need warrants or oversight for. Encrypting the _contents_ of your email/texts/phonecalls/websitevisits still gives them access to the social graph in which you're communicating. Suppose one of your "brogrammer" colleaues sends out email to a group of recipients every Friday afternoon, one to you with some regular work-related business, and a dozen to his 'bros'. You send your usual response, and so do his bros, then he texts a particular number, gets a call back from that number. When that number becomes part of an investigation and turns out ,say, to be a cocaine dealers "burner phone" - guess what _you_ just started to look like part of? And if you've got some hacktivist-motivated software in place to strongly encrypt the mail between you and your coworker, how do you think _that's_ going to look to the investigators? (feel free to invent your own bad scenario about the "war on terror" or the "saving children from pedophiles" or the "occupy movement" or "overzealous corporate IP enforcement" instead of the "war on drugs") I don't know how to solve that - but some TOR-like multi-juristiction-distributed email/text/IM routing mechanism, where the source/destination information is part of the encrypted payload so "they" only get to see the hop between you and your nearest node, along with (crypographically) randomised message forwarding delays, payload padding, and "bogus messages" to mitigate traffic analysis (the first to stop someone noticing "Alice sent a message into node 1 and Bob simultaneously received a message from node 2", the second prevents leaks like "Alice sent a 13.2k message into node 1, and Bob received a 13.2k message from node 2", and the third to solve "Alice sent 8 messages into node 1 and Bob received 8 messages from node 2") [1] http://www.examiner.com/technology-in-national/u-k-gov-t-set-to-announce-real-time-phone-email-web-monitoring-proposal http://www.examiner.com/technology-in-national/u-k-gov-t-set...

JonnieCache 15y ago
>some TOR-like multi-juristiction-distributed email/text/IM routing mechanism, where the source/destination information is part of the encrypted payload so "they" only get to see the hop between you and your nearest node, along with (crypographically) randomised message forwarding delays, payload padding, and "bogus messages" to mitigate traffic analysis http://secushare.org/ http://secushare.org/

nextparadigms 15y ago

You're right of course. Finding alternatives like these should never be a long term solution, but only a temporary solution. Because if we treat it like a technical problem and not a political one, then it will only be a matter of time before they find ways to make those solutions illegal, or to monitor and breach them through the Government's agencies.

mike-cardwell 15y ago

The answer is to do both. You can have a political debate about freedom and come to sane conclusions. Ten years or one terrorist attack later and you're back having the same debate with a possibly different conclusion. And don't forget, every country in the World would need to have this debate. And I'm pretty sure, countries will always consider the surveillance of people in foreign countries fare game if they can get away with it. The US and the UK (my home) certainly will. We should strive for technical solutions which make mass surveillance either impossible, or more realistically so expensive it becomes infeasible. Money talks.