4 ms·

I'm curious as to the technical specifications of the supposed Naris device. I don't doubt that the US government can obtain the email logs of most citizens, bu

by jkimmel 14y ago

I'm curious as to the technical specifications of the supposed Naris device. I don't doubt that the US government can obtain the email logs of most citizens, but would it truly occur in this manner? Binney seems to describe a single unit connected directly into the backbone networks of major ISPs, logging all data on certain ports I assume (ie, the common POP3, IMAP, SMTP ports)? Depending on the level of distribution, this device would be tapping into potentially enormous amounts of data. The processing and storage infrastructure would have to be incredibly robust. I'm not very knowledgable as to the feasibility of such a device, and quite frankly don't know where to begin, but I would love to hear from someone who might know more. As a back of the napkin, rougher-than-order-of-magnitude calculation, it seems more feasible for the government to tap into existing email providers' databases than to try and administer their own. Would it not simply be easier to file requests (perhaps in a quasi-legitimate manner) for data from Google/Yahoo/MS/Apple than to try and catalog the entire email history of the Internet?

deleted 14y ago
[deleted]
gojomo 14y ago
Filing requests with endpoints leaves a trail, and an agency would have a hard time requesting everyone's total traffic without proper cause. On the other hand, recording everything through a key bottleneck leaks no information about what is specifically of interest. It also allows retrospective looks at things that might not have seemed interesting enough to request up front. And 'certain ports'? Bah! Get it all. Maybe future breakthroughs (or current undisclosed innovations) can render it all transparent. This may not be the 'easiest' approach, but it's definitely the 'best', for maximum knowledge, if you can afford/manage it. The proper spelling is 'Narus', which is also the name of the supplier company, based in Sunnyvale and since 2010 a subsidiary of Boeing. You can read about them and their capabilities at: http://en.wikipedia.org/wiki/Narus_%28company%29 http://en.wikipedia.org/wiki/Narus_%28company%29 http://www.narus.com/ http://www.narus.com/
- jkimmel 14y ago
  Ah, thank you very much. A google for "Naris" (as it is spelled in the RT article) isn't very helpful. Your logic is definitely sound. It's just mind boggling to me that anyone could possibly be logging everything thrown through every port. Every single day. Just, wow.
yajoe 14y ago
I think the government is sniffing packets directly. It's much easier to feed through whatever content analysis engines they have today than try to access remote systems routinely. SSL? When the government has access to most of the internet's root keys, decrypting 128-bit SSL is 'annoying' and definitely solved. There was a controversy a few years ago about secret closets with direct access to raw fiber traffic: * http://yro.slashdot.org/story/05/12/25/0029204/nsa-data-mining-much-larger-than-reported http://yro.slashdot.org/story/05/12/25/0029204/nsa-data-mini... * http://slashdot.org/story/06/04/07/1246259/att-forwarding-all-internet-traffic-to-nsa http://slashdot.org/story/06/04/07/1246259/att-forwarding-al... * http://yro.slashdot.org/story/07/11/09/2040206/ex-att-tech-says-nsa-monitors-all-web-traffic http://yro.slashdot.org/story/07/11/09/2040206/ex-att-tech-s... Mirroring traffic at the ISP would be much harder to detect, more thorough, and reduces the number of pesky admins who would come across surprises in their logs. My vote is on that approach -- it's similar to how spy satellites are operated now ("record everything and playback like it's a DVR when we need it"). As an aside, this is the third time in as many days that I've seen 'repeated' content from old Slashdot on HN. Not sure what I make of that trend.
- wondring 14y ago
  So if I have my own server, with my own self-signed certificate, the government can still decrypt my traffic easily?
  - yk 14y ago
    That depends. SSL (https) as it is currently implemented in browsers has the vulnerability, that you trust all certificates signed with any root certificate which are installed in the browser. So if you have a dedicated browser, where you have deinstalled all default certificates and installed only your private self-signed certificate, then SSL is (to the best of my knowledge) secure. Unfortunately your server has no way to check, which certificate the client sees ( and vice versa). Therefore it can not enforce the use of this specific browser. ( And this obviously does not work for a public website.) By contrast in the case of ssh the server and client each store a key for the specific connection. In this case your connection is essentially as secure as the key exchange. And if a mitm (Man in the middle) attack was already in place when you established a connection for the first time, then ssh will warn you if the mitm attack ends. ( Since in this case the server sends you a different public key than the stored one, which was corrupted by the mitm attack. )

by jkimmel 14y ago

deleted 14y ago

[deleted]

gojomo 14y ago

Filing requests with endpoints leaves a trail, and an agency would have a hard time requesting everyone's total traffic without proper cause. On the other hand, recording everything through a key bottleneck leaks no information about what is specifically of interest. It also allows retrospective looks at things that might not have seemed interesting enough to request up front. And 'certain ports'? Bah! Get it all. Maybe future breakthroughs (or current undisclosed innovations) can render it all transparent. This may not be the 'easiest' approach, but it's definitely the 'best', for maximum knowledge, if you can afford/manage it. The proper spelling is 'Narus', which is also the name of the supplier company, based in Sunnyvale and since 2010 a subsidiary of Boeing. You can read about them and their capabilities at: http://en.wikipedia.org/wiki/Narus_%28company%29 http://en.wikipedia.org/wiki/Narus_%28company%29 http://www.narus.com/ http://www.narus.com/

jkimmel 14y ago
Ah, thank you very much. A google for "Naris" (as it is spelled in the RT article) isn't very helpful. Your logic is definitely sound. It's just mind boggling to me that anyone could possibly be logging everything thrown through every port. Every single day. Just, wow.

yajoe 14y ago

I think the government is sniffing packets directly. It's much easier to feed through whatever content analysis engines they have today than try to access remote systems routinely. SSL? When the government has access to most of the internet's root keys, decrypting 128-bit SSL is 'annoying' and definitely solved. There was a controversy a few years ago about secret closets with direct access to raw fiber traffic: * http://yro.slashdot.org/story/05/12/25/0029204/nsa-data-mining-much-larger-than-reported http://yro.slashdot.org/story/05/12/25/0029204/nsa-data-mini... * http://slashdot.org/story/06/04/07/1246259/att-forwarding-all-internet-traffic-to-nsa http://slashdot.org/story/06/04/07/1246259/att-forwarding-al... * http://yro.slashdot.org/story/07/11/09/2040206/ex-att-tech-says-nsa-monitors-all-web-traffic http://yro.slashdot.org/story/07/11/09/2040206/ex-att-tech-s... Mirroring traffic at the ISP would be much harder to detect, more thorough, and reduces the number of pesky admins who would come across surprises in their logs. My vote is on that approach -- it's similar to how spy satellites are operated now ("record everything and playback like it's a DVR when we need it"). As an aside, this is the third time in as many days that I've seen 'repeated' content from old Slashdot on HN. Not sure what I make of that trend.

wondring 14y ago
So if I have my own server, with my own self-signed certificate, the government can still decrypt my traffic easily?
- yk 14y ago
  That depends. SSL (https) as it is currently implemented in browsers has the vulnerability, that you trust all certificates signed with any root certificate which are installed in the browser. So if you have a dedicated browser, where you have deinstalled all default certificates and installed only your private self-signed certificate, then SSL is (to the best of my knowledge) secure. Unfortunately your server has no way to check, which certificate the client sees ( and vice versa). Therefore it can not enforce the use of this specific browser. ( And this obviously does not work for a public website.) By contrast in the case of ssh the server and client each store a key for the specific connection. In this case your connection is essentially as secure as the key exchange. And if a mitm (Man in the middle) attack was already in place when you established a connection for the first time, then ssh will warn you if the mitm attack ends. ( Since in this case the server sends you a different public key than the stored one, which was corrupted by the mitm attack. )