3 ms·

After the Snowden revelations regarding FOXACID and QUANTUM going largely undressed in the tor project, people have every right to feel sketched out with using

• xyst 2y ago
  Wonder what has replaced “Xkeyscore” given the wide adoption of TLS. I know ISPs, especially national ISPs like AT&T (see: titanpointe - 33 thomas st, nyc) would feed data to NSA since traffic at the time was mostly via http (rather than https). I suppose the unencrypted dns queries are still useful (although DNSSEC is supposed to defend against snooping/deep packet inspection)
  • xenophonf 2y ago
    DNSSEC is an authentication mechanism. It does not encrypt queries or responses. You might be thinking of DNS-over-HTTPS (DoH) or DNS-over-TLS (DoT). There's also DNSCurve. https://en.wikipedia.org/wiki/DNSCurve https://en.wikipedia.org/wiki/DNSCurve
    • no-dr-onboard 2y ago
      DoH and DNSSEC don't use ECH (encrypted client hello) From what I remember, only DoT uses ECH https://media.ccc.de/v/chaoscolloquium-1-dns-privacy-security https://media.ccc.de/v/chaoscolloquium-1-dns-privacy-securit...
      • _rdvw 2y ago
        ECH can be used regardless of DoT, DoH, dnscrypt, or plain as long as your resolver passes HTTPS queries. You can easily test this: dig @8.8.8.8 https pq.cloudflareresearch.com
  • bornfreddy 2y ago
    A lot of pages are now behind CF, hosted on AWS,... It would surprise me if these providers didn't share their data with the 3-letter agencies.
    • tonetegeatinst 2y ago
      I'd argue any data center of cloudflare is just as valuable to fiber tap, just like the undersea fiber cables.
  • greyface- 2y ago
    Lots of juicy Internet protocols are still running in cleartext. OCSP, for example, and DNS, as you noted. And the IP-level metadata of TLS connections is still enough to uniquely identify which entities are communicating with each other in many situations. I very much doubt XKeyscore has been retired.
  • yupyupyups 2y ago
    >Wonder what has replaced “Xkeyscore” given the wide adoption of TLS. Cloudflare is a US-based company that does MITM attacks on all traffic of the websites that it protects. It's part of how their DDoS mitigation works. Many people still use large US-based mail providers such as Outlook or Gmail. Many large services use AWS, GCP or Azure. Perhaps there are ways for the NSA to access customers' virtual storage or MITM attack traffic between app backends and the load balancer where TLS is not used.
    • tonetegeatinst 2y ago
      Worse is how most email providers require SMS confirmation or a secondary email.
    • sophacles 2y ago
      It is MITM, but is it an attack? Literally the website owner hires Cloudflare explicity to decrypt and filter the traffic. Attack implies that it's unwanted behavior, yet the reality seems to imply that its wanted behavior by the site owner at a minimum, although continued use of the site by visitors also suggests that they want that behavior (or they'd go elsewhere).
      • EasyMark 2y ago
        Isn’t the attack assuming that NSA/FBI/TLO has full access to the MITM connection at will? I mean that doesn’t seem too far fetched does it give various revelations over the years and things like The Patriot Act actually passing when it’s obviously unconstitutional
    • snewman 2y ago
      Often the connection between the load balancer and app backend also uses TLS. I've operated a large / complex service on AWS and all internal communications at each level were encrypted. Of course, in principle, a cloud provider could tap in anywhere you're using their services – ELB (load balancer), S3, etc. I presume they could even provide backdoors into EC2 instances if they were willing to take the reputational risk. But even if you assume the NSA or whoever is able to tap into internal network links within a data center, that alone wouldn't necessarily accomplish much (depending on the target).
  • treebeard901 2y ago
    >> Wonder what has replaced “Xkeyscore” given the wide adoption of TLS. A nationwide invisible firewall, with man in the middle decryption and permanent storage of all unencrypted data. All run by the major backbones and ISPs.
    • yencabulator 2y ago
      > man in the middle decryption How would that work?
      • ARandomerDude 2y ago
        Start an NSA cutout called Cloudflare. Configure sites to use an SSL/TLS connection to Cloudflare, then a separate SSL/TLS connection from Cloudflare to your actual machine. Then have the marketing team call it "Strict" encryption. Make it free so everyone uses it.
        • treebeard901 2y ago
          It is also a lot easier since ceetificate pinning has fallen out of favor. Many sites use LetsEncrypt. The Certificate Authority system itself is not reliable. In a way it is the perfect solution from a Govt perspective. Other countries have systems at this scale and larger. China for example.
          • yencabulator 2y ago
            What makes the CA system reliable is browsers insisting on Certificate Transparency before trusting a cert. If an attacker creates an evil cert by stealing the ACME verification traffic, there's a permanent record of it. Big corps can monitor the ledger to see what certs have been handed out to their domains.
  • zaik 2y ago
    DNSSEC does NOT protect against snooping.
  • tptacek 2y ago
    DNSSEC is a replacement for the commercial WebPKI that is run by world governments.