6 ms·

> NSA literally has MITM proxies/interception of any traffic they want inside every major US tech company No, they don't.

vintermann 4mo ago
It's back to the question of how much you should give the benefit of doubt to powerful people who openly lie.
- strictnein 4mo ago
  It's just not technically feasible, so there's nothing to lie about. They're not MITMing petabytes/sec across dozens (hundreds?) of companies and they haven't broken TLS1.3. If I have a box at Digital Ocean and I'm communicating with it with TLS1.3 using a Let's Encrypt cert that I generated, where, exactly, does this magical MITM box come into play?
  - aleqs 4mo ago
    Of course it's feasible, you just intercept the traffic post-decryption on the cloud/server side. You don't control how/where your traffic to 3p cloud services is decrypted.
    - kelnos 4mo ago
      You keep saying this, but it's nonsensical. If I terminate TLS on the box that does processing, there's nothing to intercept. And these days (especially post-Snowden), many (most?) companies encrypt data when sending between servers within their own (private network) infrastructure.
      - aleqs 4mo ago
        You have no control about where TLS is terminated when you're talking to a 3p cloud service (with services you don't control/run like cloud LLM APIs). You also have no control about what spyware is installed on/around VMs you rent (and there's a lot). Also when talking about encryption between servers within datacenters you seem to be missing that in order for such multi -stage/path encryption (separate certs/keys) to be possible the data first has to be decrypted at each point, not to mention every major US tech company generally cooperates with the NSA and gives them access to anything they request (including allowing the installation of dedicated hardware to intercept decrypted traffic as has been publicly exposed documented many times already). Yours and others' claims that it's impossible and nonsensical is based on lack of understanding. Yours and others' claims that things somehow got better after Snowden is just a completely baseless statement - if you actually looked into what happened post-Snowden - absolutely nothing was done to prevent NSA spying on any communications they want, in fact it got significantly worse.
        strictnein 4mo ago
        > Yours and others' claims that it's impossible and nonsensical is based on lack of understanding. lol, no, it's really not. > Also when talking about encryption between servers within datacenters you seem to be missing that in order for such multi -stage/path encryption (separate certs/keys) to be possible the data first has to be decrypted at each point Why would I want the data to be decrypted at each point and why would datacenters do that? Encrypting and decrypting data is expensive computationally, so that's not how things work at all. There's no need to decrypt data to know where it needs to go. That's why we have TCP/IP and other similar stadards. The datacenters can maybe add another layer of encryption on top of my data as its moving around their networks, but there's absolutely no way for them to strip off my encryption. > Yours and others' claims that things somehow got better after Snowden is just a completely baseless statement Things didn't magically get better. A lot of people worked hard to improve the overall security posture of the industry.
        drdexebtjl 4mo ago
        > Why would I want the data to be decrypted at each point and why would datacenters do that? I think they mean the data must have existed in plain text before it was encrypted, and will exist in plain text after it is decrypted. At some point “your” server in a datacenter somewhere needs to decrypt the data to do something useful with it, after all you’re paying for compute, and homeomorphic encryption is too slow, so the work is done in unencrypted data. There it is. Your data in plain text in RAM. TLS will protect your data in transit, but it can’t protect you against a compromised recipient.
        gaadd33 4mo ago
        So the NSA streams the ram of every virtual machine and bare metal server on the internet to themselves so they can analyze the plain text that's being processed in ram and no one has noticed this network traffic? How could that even be possible? If I buy a 100Mbps network connection from someone, they just provision a bit more so that the NSA streaming doesn't impact or show up?
  - drdexebtjl 4mo ago
    That "box" is a virtual machine, no? Do you know what hypervisor is managing it? :)
    - chews 4mo ago
      ... not your machines, not your crypto...
    - strictnein 4mo ago
      So now this magical NSA decryption system is inside every hypervisor? You realize how ridiculous that is, right?
ai_critic 4mo ago
https://blog.encrypt.me/2013/11/05/ssl-added-and-removed-here-nsa-smiley/ https://blog.encrypt.me/2013/11/05/ssl-added-and-removed-her... https://en.wikipedia.org/wiki/Room_641A https://en.wikipedia.org/wiki/Room_641A Yeah, they did (and probably do).
- parineum 4mo ago
  How are they going to MITM communications with certs that never left my machine? Are you suggesting they broke TLS or that they've somehow acquired every private cert generated?
  - aleqs 4mo ago
    You just intercept the traffic after its decrypted on the server side, or are you suggesting you somehow send encrypted traffic that never gets decrypted?
    - gaadd33 4mo ago
      So the NSA streams the memory contents of every virtual machine and bare metal server on the internet to get the decrypted traffic? How would that even work at the scale of the internet?
      - aleqs 4mo ago
        How it works is they build a huge virtual strawman which decrypts and reads all of the data for them then posts online about how NSA spying on people is literally impossible.
  - deleted 4mo ago
    [deleted]
  - ceejayoz 4mo ago
    How closely have you reviewed your browser's list of default trusted CAs?
chews 4mo ago
[flagged]
- strictnein 4mo ago
  Yes, you have collected a lot of random bits of information from over a decade ago. I'm sure everything you say is still relevant today, especially the conspiracy nonsense. Some of us actually work in security, while others think the NSA and CIA are some magically powerful orgs. Explain how, even with the mystical Room 641A, the NSA can't break a TLS1.3 protected communication channel without either party knowing about it. Assume you have generated a cert with Let's Encrypt. How, exactly, does that work?
  - sailfast 4mo ago
    Thank you.
  - aleqs 4mo ago
    Explain to me how you are going to encrypt your LLM API calls with your let's encrypt cert. There are also multiple ways/places traffic you send to typical cloud/tech company is decrypted and can be intercepted. (Surprised I have to point this out to someone who 'actually works in security ' lol) Not to mention US tech companies fully cooperate with the NSA in many cases and are aware of this going on.
    - chews 4mo ago
      why is europe going to such great lengths to build datacenters and ensure they have no connection to US jurisdiction... GDPR means nothing if there is a persistent threat installed on every instance.
    - strictnein 4mo ago
      > Explain to me how you are going to encrypt your LLM API calls with your let's encrypt cert. I mean, there's goal post moving and there's just building a whole new stadium across the country.
distill17801 4mo ago
It's generally accepted fact that the NSA broke HTTPS, for some of the time, for some of the services. It's unclear what they do have, but you'd be naive to assume consumer HTTPS is keeping them out. It's too complicated. Do you know everything about CA, SSL, HTTPS, and so on? You make $250k a year working on it? Do you _really_, _really_, know everything? Then you're fired because you're lying to yourself, so you're probably unbearable to work with. We were all freaking out about this with AT&T Thing nearly twenty years ago: and when nobody cared (Bush ran two terms! it helped to pretend AT&T was the only one affected), it gave "them" implicit permission to do it again with Google / Yahoo thing (it helped to pretend those were the only two cloud providers affected) ten years ago. Now, we're all pretending that capitalism is real, and that the three letter agencies are just sittin' on the sidelines, while the world's largest data archiving opportunity is happening voluntarily (some are even PAYING for it!), at some wild-growth companies (with leaders who have too much to lose), who also have existed for just a few years? A 5 year old could probably blackmail Sam Altman, what about all the other middle management? The individual contributors (if they still exist) are of no concern: work is a commodity, it's easy to silo a worker's knowledge. Surveillance opportunity is 10x social media from last decade, because they still have social media, and now, they've began thinking for people. How easy when it is an app on your smartphone. Those mind control experiments back in the 60's with Acid are looking silly by now. Besides, how do you know that the response you're getting wasn't manipulated (and define 'manipulated' across a spectrum of training to nefarious actors impersonating models, by power of court order.) If you think all of that is unfounded ridiculous blasphemy, let me distract you with this instead: if the AI bubble bursts, the compute will be repurposed for mass AI / ML driven CCTV surveillance. Hell, maybe they'll find a way to give you a tax break if you sell your CCTV footage. "NSA literally has MITM proxies/interception of any traffic they want inside every major US tech company" even if this statement is an exaggeration, by playing the long game, they get themselves setup to access what they want in the future. I'm not for or against, but I do live in a safe place thanks to such surveillance (generally in the USA), and I want you to know that this AI Thing is only the latest chapter in the intelligence story.
- strictnein 4mo ago
  What does it mean to "break HTTPS"? Also, there's no such thing as "consumer HTTPS". As for the rest of this... how many conspiracy theories are you trying to pack into a statement? > "even if this statement is an exaggeration" It's not an exaggeration, it is simply false.

vintermann 4mo ago

It's back to the question of how much you should give the benefit of doubt to powerful people who openly lie.

strictnein 4mo ago
It's just not technically feasible, so there's nothing to lie about. They're not MITMing petabytes/sec across dozens (hundreds?) of companies and they haven't broken TLS1.3. If I have a box at Digital Ocean and I'm communicating with it with TLS1.3 using a Let's Encrypt cert that I generated, where, exactly, does this magical MITM box come into play?
- aleqs 4mo ago
  Of course it's feasible, you just intercept the traffic post-decryption on the cloud/server side. You don't control how/where your traffic to 3p cloud services is decrypted.
  - kelnos 4mo ago
    You keep saying this, but it's nonsensical. If I terminate TLS on the box that does processing, there's nothing to intercept. And these days (especially post-Snowden), many (most?) companies encrypt data when sending between servers within their own (private network) infrastructure.
    - aleqs 4mo ago
      You have no control about where TLS is terminated when you're talking to a 3p cloud service (with services you don't control/run like cloud LLM APIs). You also have no control about what spyware is installed on/around VMs you rent (and there's a lot). Also when talking about encryption between servers within datacenters you seem to be missing that in order for such multi -stage/path encryption (separate certs/keys) to be possible the data first has to be decrypted at each point, not to mention every major US tech company generally cooperates with the NSA and gives them access to anything they request (including allowing the installation of dedicated hardware to intercept decrypted traffic as has been publicly exposed documented many times already). Yours and others' claims that it's impossible and nonsensical is based on lack of understanding. Yours and others' claims that things somehow got better after Snowden is just a completely baseless statement - if you actually looked into what happened post-Snowden - absolutely nothing was done to prevent NSA spying on any communications they want, in fact it got significantly worse.
      - strictnein 4mo ago
        > Yours and others' claims that it's impossible and nonsensical is based on lack of understanding. lol, no, it's really not. > Also when talking about encryption between servers within datacenters you seem to be missing that in order for such multi -stage/path encryption (separate certs/keys) to be possible the data first has to be decrypted at each point Why would I want the data to be decrypted at each point and why would datacenters do that? Encrypting and decrypting data is expensive computationally, so that's not how things work at all. There's no need to decrypt data to know where it needs to go. That's why we have TCP/IP and other similar stadards. The datacenters can maybe add another layer of encryption on top of my data as its moving around their networks, but there's absolutely no way for them to strip off my encryption. > Yours and others' claims that things somehow got better after Snowden is just a completely baseless statement Things didn't magically get better. A lot of people worked hard to improve the overall security posture of the industry.
        drdexebtjl 4mo ago
        > Why would I want the data to be decrypted at each point and why would datacenters do that? I think they mean the data must have existed in plain text before it was encrypted, and will exist in plain text after it is decrypted. At some point “your” server in a datacenter somewhere needs to decrypt the data to do something useful with it, after all you’re paying for compute, and homeomorphic encryption is too slow, so the work is done in unencrypted data. There it is. Your data in plain text in RAM. TLS will protect your data in transit, but it can’t protect you against a compromised recipient.
        gaadd33 4mo ago
        So the NSA streams the ram of every virtual machine and bare metal server on the internet to themselves so they can analyze the plain text that's being processed in ram and no one has noticed this network traffic? How could that even be possible? If I buy a 100Mbps network connection from someone, they just provision a bit more so that the NSA streaming doesn't impact or show up?
- drdexebtjl 4mo ago
  That "box" is a virtual machine, no? Do you know what hypervisor is managing it? :)
  - chews 4mo ago
    ... not your machines, not your crypto...
  - strictnein 4mo ago
    So now this magical NSA decryption system is inside every hypervisor? You realize how ridiculous that is, right?

ai_critic 4mo ago

https://blog.encrypt.me/2013/11/05/ssl-added-and-removed-here-nsa-smiley/ https://blog.encrypt.me/2013/11/05/ssl-added-and-removed-her... https://en.wikipedia.org/wiki/Room_641A https://en.wikipedia.org/wiki/Room_641A Yeah, they did (and probably do).

parineum 4mo ago
How are they going to MITM communications with certs that never left my machine? Are you suggesting they broke TLS or that they've somehow acquired every private cert generated?
- aleqs 4mo ago
  You just intercept the traffic after its decrypted on the server side, or are you suggesting you somehow send encrypted traffic that never gets decrypted?
  - gaadd33 4mo ago
    So the NSA streams the memory contents of every virtual machine and bare metal server on the internet to get the decrypted traffic? How would that even work at the scale of the internet?
    - aleqs 4mo ago
      How it works is they build a huge virtual strawman which decrypts and reads all of the data for them then posts online about how NSA spying on people is literally impossible.
- deleted 4mo ago
  [deleted]
- ceejayoz 4mo ago
  How closely have you reviewed your browser's list of default trusted CAs?

chews 4mo ago

[flagged]

strictnein 4mo ago
Yes, you have collected a lot of random bits of information from over a decade ago. I'm sure everything you say is still relevant today, especially the conspiracy nonsense. Some of us actually work in security, while others think the NSA and CIA are some magically powerful orgs. Explain how, even with the mystical Room 641A, the NSA can't break a TLS1.3 protected communication channel without either party knowing about it. Assume you have generated a cert with Let's Encrypt. How, exactly, does that work?
- sailfast 4mo ago
  Thank you.
- aleqs 4mo ago
  Explain to me how you are going to encrypt your LLM API calls with your let's encrypt cert. There are also multiple ways/places traffic you send to typical cloud/tech company is decrypted and can be intercepted. (Surprised I have to point this out to someone who 'actually works in security ' lol) Not to mention US tech companies fully cooperate with the NSA in many cases and are aware of this going on.
  - chews 4mo ago
    why is europe going to such great lengths to build datacenters and ensure they have no connection to US jurisdiction... GDPR means nothing if there is a persistent threat installed on every instance.
  - strictnein 4mo ago
    > Explain to me how you are going to encrypt your LLM API calls with your let's encrypt cert. I mean, there's goal post moving and there's just building a whole new stadium across the country.

distill17801 4mo ago

It's generally accepted fact that the NSA broke HTTPS, for some of the time, for some of the services. It's unclear what they do have, but you'd be naive to assume consumer HTTPS is keeping them out. It's too complicated. Do you know everything about CA, SSL, HTTPS, and so on? You make $250k a year working on it? Do you _really_, _really_, know everything? Then you're fired because you're lying to yourself, so you're probably unbearable to work with. We were all freaking out about this with AT&T Thing nearly twenty years ago: and when nobody cared (Bush ran two terms! it helped to pretend AT&T was the only one affected), it gave "them" implicit permission to do it again with Google / Yahoo thing (it helped to pretend those were the only two cloud providers affected) ten years ago. Now, we're all pretending that capitalism is real, and that the three letter agencies are just sittin' on the sidelines, while the world's largest data archiving opportunity is happening voluntarily (some are even PAYING for it!), at some wild-growth companies (with leaders who have too much to lose), who also have existed for just a few years? A 5 year old could probably blackmail Sam Altman, what about all the other middle management? The individual contributors (if they still exist) are of no concern: work is a commodity, it's easy to silo a worker's knowledge. Surveillance opportunity is 10x social media from last decade, because they still have social media, and now, they've began thinking for people. How easy when it is an app on your smartphone. Those mind control experiments back in the 60's with Acid are looking silly by now. Besides, how do you know that the response you're getting wasn't manipulated (and define 'manipulated' across a spectrum of training to nefarious actors impersonating models, by power of court order.) If you think all of that is unfounded ridiculous blasphemy, let me distract you with this instead: if the AI bubble bursts, the compute will be repurposed for mass AI / ML driven CCTV surveillance. Hell, maybe they'll find a way to give you a tax break if you sell your CCTV footage. "NSA literally has MITM proxies/interception of any traffic they want inside every major US tech company" even if this statement is an exaggeration, by playing the long game, they get themselves setup to access what they want in the future. I'm not for or against, but I do live in a safe place thanks to such surveillance (generally in the USA), and I want you to know that this AI Thing is only the latest chapter in the intelligence story.

strictnein 4mo ago
What does it mean to "break HTTPS"? Also, there's no such thing as "consumer HTTPS". As for the rest of this... how many conspiracy theories are you trying to pack into a statement? > "even if this statement is an exaggeration" It's not an exaggeration, it is simply false.