5 ms·

https://blog.encrypt.me/2013/11/05/ssl-added-and-removed-here-nsa-smiley/ https://blog.encrypt.me/2013/11/05/ssl-added-and-removed-her... https://en.wikipedia.

https://blog.encrypt.me/2013/11/05/ssl-added-and-removed-here-nsa-smiley/ https://blog.encrypt.me/2013/11/05/ssl-added-and-removed-her... https://en.wikipedia.org/wiki/Room_641A https://en.wikipedia.org/wiki/Room_641A Yeah, they did (and probably do).

parineum 4mo ago
How are they going to MITM communications with certs that never left my machine? Are you suggesting they broke TLS or that they've somehow acquired every private cert generated?
- aleqs 4mo ago
  You just intercept the traffic after its decrypted on the server side, or are you suggesting you somehow send encrypted traffic that never gets decrypted?
  - gaadd33 4mo ago
    So the NSA streams the memory contents of every virtual machine and bare metal server on the internet to get the decrypted traffic? How would that even work at the scale of the internet?
    - aleqs 4mo ago
      How it works is they build a huge virtual strawman which decrypts and reads all of the data for them then posts online about how NSA spying on people is literally impossible.
- deleted 4mo ago
  [deleted]
- ceejayoz 4mo ago
  How closely have you reviewed your browser's list of default trusted CAs?
  - distill17801 4mo ago
    I second this: HTTPS (as most consumers use it) is probably a front (who are these CA's really anyway?) Plot twist: _Perhaps_ Mythos / Fable keeps explaining ways (that we can't comprehend or don't always work) to break HTTPS due to the three letter agencies making sure they had input on their creation (and thus backdoors, I mean "bugs"), so the real catastrophe they are hiding is that HTTPS is broken (for most people, most of the time.) Remember when Quantum computing was the threat to HTTPS? Turns out it was the humans own inability to think outside of the box!
    - ceejayoz 4mo ago
      I wouldn't go that far. I remember https://en.wikipedia.org/wiki/Firesheep https://en.wikipedia.org/wiki/Firesheep - HTTPS-everywhere was unambiguously an improvement over the status quo. It just doesn't protect you all that well from nation-scale adversaries.
  - parineum 4mo ago
    My trusted CA doesn't have my private key, they only attest that my public key belongs to me.
    - ceejayoz 4mo ago
      Your many, many default-trusted CAs can mint new certs for the sites you visit.
      - parineum 4mo ago
        Which would be easily detectable if the cert I'm using on my server didn't match the one that was being served publicly. There's really no way this conspiracy theory works if "they" have a copy of every single private cert generated. Which would be impressive because I can generate one myself and get it trusted without ever sending it and would be easily able to detect a MITM attack. Not to mention most sites are going to use pinned certs so any repeat visitors to a site will notice a cert change associated with a MITM. This whole idea relies on the assumption that everyone is trusting third parties with their private certs. That is not at all required.
- distill17801 4mo ago
  > How are they going to MITM communications with certs that never left my machine? The long game. They: - make sure you wouldn't be in a position to need to transmit data anywhere that would receive it without CA's in their hypothetical pocket - manage the evolution of the cloud industry to make sure portable VM's and Containers can have their data archived (both in-RAM, disk, hey just send us the running VM!) - backdoor'd encryption algorithms from the design and implementation phase to ensure a global unlocking mechanism for any data encrypted by anybody who used a large class of extremely commonly available software So, you run your own private bank in a cloud VM with tenant managed keys? They backdoor'd the encryption algorithm your cloud VM disk relies on, because they blackmailed one of the developers at the company who developed the hypervisor system used by your provider. Open source project? Perfect. (If you think this is nonsense, then remember the rapid discovery of ancient "bugs" causing all this drama to begin with.) Your TLS privately generated certs that are 100% foolproof aren't actually used anywhere encrypting the data they want, because it's either worthless, or, available elsewhere perhaps at a different (or same) time.
  - parineum 4mo ago
    And you're saying "they" (red flag) have done this with every cert generated?
    - ceejayoz 4mo ago
      They've most certainly tried. https://en.wikipedia.org/wiki/Dual_EC_DRBG https://en.wikipedia.org/wiki/Dual_EC_DRBG https://en.wikipedia.org/wiki/Bullrun_(decryption_program) https://en.wikipedia.org/wiki/Bullrun_(decryption_program) If you're a specific target of a nation-state level actor, things get worse; they just grab your hardware mid-shipment on its way to you. https://www.nbcnews.com/tech/tech-news/report-nsa-intercepts-computer-deliveries-flna2d11820931 https://www.nbcnews.com/tech/tech-news/report-nsa-intercepts...
      - parineum 4mo ago
        > They've most certainly tried. And failed. > If you're a specific target... If you're a specific target, they have to spend an incredibly number of man-hours and money to get into your private data. This proves my point. This shows the effort required to infiltrate _one_ target and you're suggesting they've infiltrated everything by default.
distill17801 4mo ago
I recall having a nuclear meltdown personally when I heard about all of this in the mid aughts. Nobody cared. Nobody understands this today. Everyone just complains about the Donald, but I point to this, and they don't realize the connection.
- wolvoleo 4mo ago
  Even after Snowden exposed everything, nobody really cared unfortunately

parineum 4mo ago

How are they going to MITM communications with certs that never left my machine? Are you suggesting they broke TLS or that they've somehow acquired every private cert generated?

aleqs 4mo ago
You just intercept the traffic after its decrypted on the server side, or are you suggesting you somehow send encrypted traffic that never gets decrypted?
- gaadd33 4mo ago
  So the NSA streams the memory contents of every virtual machine and bare metal server on the internet to get the decrypted traffic? How would that even work at the scale of the internet?
  - aleqs 4mo ago
    How it works is they build a huge virtual strawman which decrypts and reads all of the data for them then posts online about how NSA spying on people is literally impossible.
deleted 4mo ago
[deleted]
ceejayoz 4mo ago
How closely have you reviewed your browser's list of default trusted CAs?
- distill17801 4mo ago
  I second this: HTTPS (as most consumers use it) is probably a front (who are these CA's really anyway?) Plot twist: _Perhaps_ Mythos / Fable keeps explaining ways (that we can't comprehend or don't always work) to break HTTPS due to the three letter agencies making sure they had input on their creation (and thus backdoors, I mean "bugs"), so the real catastrophe they are hiding is that HTTPS is broken (for most people, most of the time.) Remember when Quantum computing was the threat to HTTPS? Turns out it was the humans own inability to think outside of the box!
  - ceejayoz 4mo ago
    I wouldn't go that far. I remember https://en.wikipedia.org/wiki/Firesheep https://en.wikipedia.org/wiki/Firesheep - HTTPS-everywhere was unambiguously an improvement over the status quo. It just doesn't protect you all that well from nation-scale adversaries.
- parineum 4mo ago
  My trusted CA doesn't have my private key, they only attest that my public key belongs to me.
  - ceejayoz 4mo ago
    Your many, many default-trusted CAs can mint new certs for the sites you visit.
    - parineum 4mo ago
      Which would be easily detectable if the cert I'm using on my server didn't match the one that was being served publicly. There's really no way this conspiracy theory works if "they" have a copy of every single private cert generated. Which would be impressive because I can generate one myself and get it trusted without ever sending it and would be easily able to detect a MITM attack. Not to mention most sites are going to use pinned certs so any repeat visitors to a site will notice a cert change associated with a MITM. This whole idea relies on the assumption that everyone is trusting third parties with their private certs. That is not at all required.
distill17801 4mo ago
> How are they going to MITM communications with certs that never left my machine? The long game. They: - make sure you wouldn't be in a position to need to transmit data anywhere that would receive it without CA's in their hypothetical pocket - manage the evolution of the cloud industry to make sure portable VM's and Containers can have their data archived (both in-RAM, disk, hey just send us the running VM!) - backdoor'd encryption algorithms from the design and implementation phase to ensure a global unlocking mechanism for any data encrypted by anybody who used a large class of extremely commonly available software So, you run your own private bank in a cloud VM with tenant managed keys? They backdoor'd the encryption algorithm your cloud VM disk relies on, because they blackmailed one of the developers at the company who developed the hypervisor system used by your provider. Open source project? Perfect. (If you think this is nonsense, then remember the rapid discovery of ancient "bugs" causing all this drama to begin with.) Your TLS privately generated certs that are 100% foolproof aren't actually used anywhere encrypting the data they want, because it's either worthless, or, available elsewhere perhaps at a different (or same) time.
- parineum 4mo ago
  And you're saying "they" (red flag) have done this with every cert generated?
  - ceejayoz 4mo ago
    They've most certainly tried. https://en.wikipedia.org/wiki/Dual_EC_DRBG https://en.wikipedia.org/wiki/Dual_EC_DRBG https://en.wikipedia.org/wiki/Bullrun_(decryption_program) https://en.wikipedia.org/wiki/Bullrun_(decryption_program) If you're a specific target of a nation-state level actor, things get worse; they just grab your hardware mid-shipment on its way to you. https://www.nbcnews.com/tech/tech-news/report-nsa-intercepts-computer-deliveries-flna2d11820931 https://www.nbcnews.com/tech/tech-news/report-nsa-intercepts...
    - parineum 4mo ago
      > They've most certainly tried. And failed. > If you're a specific target... If you're a specific target, they have to spend an incredibly number of man-hours and money to get into your private data. This proves my point. This shows the effort required to infiltrate _one_ target and you're suggesting they've infiltrated everything by default.

distill17801 4mo ago

I recall having a nuclear meltdown personally when I heard about all of this in the mid aughts. Nobody cared. Nobody understands this today. Everyone just complains about the Donald, but I point to this, and they don't realize the connection.

wolvoleo 4mo ago
Even after Snowden exposed everything, nobody really cared unfortunately