5 ms·

The really odd thing is that 85% of the general public will say "well of course they spy on email" even today, after Snowden's leaks showed that the Obama admin

The really odd thing is that 85% of the general public will say "well of course they spy on email" even today, after Snowden's leaks showed that the Obama administration had shut that down.

rl3 2y ago
Setting aside the fact that the leaks you're referring to are over a decade old at this point, they also established that GCHQ buffered the entirety of the UK's internet traffic for 72 hours, bit for bit. If you think there's no collection on e-mail, rather than just legal shell games being played with terminology and various compartments, then I've got a bridge to sell you. In fact, the bridge is made of metadata and nothing else.
- lern_too_spel 2y ago
  SMTP connections are wrapped in TLS these days, so even if you were to collect email transfers bit for bit, you wouldn't be able to read them, not even metadata.
  - potato3732842 2y ago
    IIRC there's been speculation that the NSA can/has brute forced TLS keys up through 4096 bit size. I read a paper once that crunched the numbers on energy cost and compute time and whatnot it comes out looking like a reasonable investment for them. Obviously they'd have to keep such an exercise on the DL if they did do it because increasing key size is pretty trivial.
    - kbolino 2y ago
      A 4096-bit RSA key is still well beyond the means of even a very capable state actor. The standard nowadays is 2048-bit RSA keys, cracking of which is also (probably) still beyond anyone's capabilities. Maybe a multi-year effort directed at a specific target might manage to crack a single key, but I wouldn't bet on it. RSA cracking efforts would almost certainly focus on smaller keys that are still being used despite the warnings. However, even if they did crack a major infrastructure provider's RSA key, TLS nowadays uses ephemeral key exchange which provides forward secrecy. So it doesn't matter if an intelligence agency collected every packet, they could not decipher the contents after the fact. They would have to actively interdict every TLS handshake and perform a man-in-the-middle attack against both parties all the time. It is extremely doubtful that this is happening en masse. Such a process would require an immense amount of online computing power directly in the path of all Internet traffic. Much of the compute available to intelligence agencies (and accounted for in back-of-the-envelope calculations by outside parties) is effectively offline due to airgaps. It's not like they want people doing to them what they're doing to others, after all. It's much easier to send an NSL to Google to read your email than to try to intercept it over the wire. The latter capability would be reserved for high-value targets unreachable by the US legal system, not mass surveillance.
      - rl3 2y ago
        >It's much easier to send an NSL to Google to read your email than to try to intercept it over the wire. The latter capability would be reserved for high-value targets unreachable by the US legal system, not mass surveillance. https://blog.encrypt.me/2013/11/05/ssl-added-and-removed-here-nsa-smiley/ https://blog.encrypt.me/2013/11/05/ssl-added-and-removed-her... That pissed a lot of people off at Google, and served as a major catalyst for their in-house RISC-V networking hardware.
        deleted 2y ago
        [deleted]
somenameforme 2y ago
What? No it didn't, not at all. The leaks clearly showed email as being one of the many things being directly surveilled. Here is one of the many slides directly acknowledging as much. [1] If you mean the rhetoric around it, then yeah - politicians lie, especially when engaging in what would be seen as deeply unpopular behavior. This isn't a shock. I assure you the admin that passed indefinite detention without charge or trial [2] wasn't some crusader for civil rights. Obama was just ridiculously charismatic and could sell a drowning man water, but he was no different than the rest in behavior. [1] - https://en.wikipedia.org/wiki/PRISM#/media/File:PRISM_Collection_Details.jpg https://en.wikipedia.org/wiki/PRISM#/media/File:PRISM_Collec... [2] - https://www.aclu.org/press-releases/president-obama-signs-indefinite-detention-bill-law https://www.aclu.org/press-releases/president-obama-signs-in...
- lern_too_spel 2y ago
  We were talking about mass surveillance. PRISM isn't that. They used to collect mass email metadata, using facilities like Room 641A. Snowden's leaks showed that they had already stopped. These days, it wouldn't even be technically possible, let alone legally possible, because pretty much all SMTP traffic is over TLS. Gmail won't even accept unencrypted SMTP connections.
  - somenameforme 2y ago
    What!?!? Yes PRISM is a mass surveillance program. And it's not metadata, it's piping entire content straight from the target to the NSA, in real time. This involves direct filtered data (such as Skype messages/videos) indirectly handed over by participating companies (which is probably all major tech companies in the US at this point), as well as raw upstream (essentially line tapping) data such as provided via STORMBREW. [1] [1] - https://en.wikipedia.org/wiki/STORMBREW https://en.wikipedia.org/wiki/STORMBREW
    - lern_too_spel 2y ago
      > Yes PRISM is a mass surveillance program You're more than 11 years behind the news. Less than a week after Greenwald published his initial ridiculous description of PRISM, it was corrected by the people who actually built the systems at the tech companies. He stupidly thought that the DITU was a machine at the companies that could get any data, when anybody with half a clue could have told him that it's obviously https://en.wikipedia.org/wiki/Data_Intercept_Technology_Unit https://en.wikipedia.org/wiki/Data_Intercept_Technology_Unit. The Wikipedia PRISM article's description is very clear and well-cited, and it includes Snowden's slides there to cross reference the description with. https://en.m.wikipedia.org/wiki/PRISM#The_program https://en.m.wikipedia.org/wiki/PRISM#The_program The FBI tells the companies to forward the communications of specific targets to the FBI. PRISM is a data integration system that ingests that data from the FBI into NSA systems.
serial_dev 2y ago
It’s really odd, indeed, that people think some reorg and a smooth politician didn’t in fact change the very nature of the surveillance companies.
- lern_too_spel 2y ago
  The leaks didn't talk about a reorg. They said the program had been shut down.

The really odd thing is that 85% of the general public will say "well of course they spy on email" even today, after Snowden's leaks showed that the Obama administration had shut that down.

rl3 2y ago

Setting aside the fact that the leaks you're referring to are over a decade old at this point, they also established that GCHQ buffered the entirety of the UK's internet traffic for 72 hours, bit for bit. If you think there's no collection on e-mail, rather than just legal shell games being played with terminology and various compartments, then I've got a bridge to sell you. In fact, the bridge is made of metadata and nothing else.

lern_too_spel 2y ago
SMTP connections are wrapped in TLS these days, so even if you were to collect email transfers bit for bit, you wouldn't be able to read them, not even metadata.
- potato3732842 2y ago
  IIRC there's been speculation that the NSA can/has brute forced TLS keys up through 4096 bit size. I read a paper once that crunched the numbers on energy cost and compute time and whatnot it comes out looking like a reasonable investment for them. Obviously they'd have to keep such an exercise on the DL if they did do it because increasing key size is pretty trivial.
  - kbolino 2y ago
    A 4096-bit RSA key is still well beyond the means of even a very capable state actor. The standard nowadays is 2048-bit RSA keys, cracking of which is also (probably) still beyond anyone's capabilities. Maybe a multi-year effort directed at a specific target might manage to crack a single key, but I wouldn't bet on it. RSA cracking efforts would almost certainly focus on smaller keys that are still being used despite the warnings. However, even if they did crack a major infrastructure provider's RSA key, TLS nowadays uses ephemeral key exchange which provides forward secrecy. So it doesn't matter if an intelligence agency collected every packet, they could not decipher the contents after the fact. They would have to actively interdict every TLS handshake and perform a man-in-the-middle attack against both parties all the time. It is extremely doubtful that this is happening en masse. Such a process would require an immense amount of online computing power directly in the path of all Internet traffic. Much of the compute available to intelligence agencies (and accounted for in back-of-the-envelope calculations by outside parties) is effectively offline due to airgaps. It's not like they want people doing to them what they're doing to others, after all. It's much easier to send an NSL to Google to read your email than to try to intercept it over the wire. The latter capability would be reserved for high-value targets unreachable by the US legal system, not mass surveillance.
    - rl3 2y ago
      >It's much easier to send an NSL to Google to read your email than to try to intercept it over the wire. The latter capability would be reserved for high-value targets unreachable by the US legal system, not mass surveillance. https://blog.encrypt.me/2013/11/05/ssl-added-and-removed-here-nsa-smiley/ https://blog.encrypt.me/2013/11/05/ssl-added-and-removed-her... That pissed a lot of people off at Google, and served as a major catalyst for their in-house RISC-V networking hardware.
      - deleted 2y ago
        [deleted]

somenameforme 2y ago

What? No it didn't, not at all. The leaks clearly showed email as being one of the many things being directly surveilled. Here is one of the many slides directly acknowledging as much. [1] If you mean the rhetoric around it, then yeah - politicians lie, especially when engaging in what would be seen as deeply unpopular behavior. This isn't a shock. I assure you the admin that passed indefinite detention without charge or trial [2] wasn't some crusader for civil rights. Obama was just ridiculously charismatic and could sell a drowning man water, but he was no different than the rest in behavior. [1] - https://en.wikipedia.org/wiki/PRISM#/media/File:PRISM_Collection_Details.jpg https://en.wikipedia.org/wiki/PRISM#/media/File:PRISM_Collec... [2] - https://www.aclu.org/press-releases/president-obama-signs-indefinite-detention-bill-law https://www.aclu.org/press-releases/president-obama-signs-in...

lern_too_spel 2y ago
We were talking about mass surveillance. PRISM isn't that. They used to collect mass email metadata, using facilities like Room 641A. Snowden's leaks showed that they had already stopped. These days, it wouldn't even be technically possible, let alone legally possible, because pretty much all SMTP traffic is over TLS. Gmail won't even accept unencrypted SMTP connections.
- somenameforme 2y ago
  What!?!? Yes PRISM is a mass surveillance program. And it's not metadata, it's piping entire content straight from the target to the NSA, in real time. This involves direct filtered data (such as Skype messages/videos) indirectly handed over by participating companies (which is probably all major tech companies in the US at this point), as well as raw upstream (essentially line tapping) data such as provided via STORMBREW. [1] [1] - https://en.wikipedia.org/wiki/STORMBREW https://en.wikipedia.org/wiki/STORMBREW
  - lern_too_spel 2y ago
    > Yes PRISM is a mass surveillance program You're more than 11 years behind the news. Less than a week after Greenwald published his initial ridiculous description of PRISM, it was corrected by the people who actually built the systems at the tech companies. He stupidly thought that the DITU was a machine at the companies that could get any data, when anybody with half a clue could have told him that it's obviously https://en.wikipedia.org/wiki/Data_Intercept_Technology_Unit https://en.wikipedia.org/wiki/Data_Intercept_Technology_Unit. The Wikipedia PRISM article's description is very clear and well-cited, and it includes Snowden's slides there to cross reference the description with. https://en.m.wikipedia.org/wiki/PRISM#The_program https://en.m.wikipedia.org/wiki/PRISM#The_program The FBI tells the companies to forward the communications of specific targets to the FBI. PRISM is a data integration system that ingests that data from the FBI into NSA systems.

serial_dev 2y ago

It’s really odd, indeed, that people think some reorg and a smooth politician didn’t in fact change the very nature of the surveillance companies.

lern_too_spel 2y ago
The leaks didn't talk about a reorg. They said the program had been shut down.