5 ms·
Thought my connection to Google was almost always under the HTTPS protocol... can someone explain to me how the NSA has broken SSL encryption to possibly THE la
by salman89 14y ago
Thought my connection to Google was almost always under the HTTPS protocol... can someone explain to me how the NSA has broken SSL encryption to possibly THE largest internet company in the world?
- batgaijin 14y agoever heard of _NSAKEY or 'stellar wind'?
- lostlogin 14y agoThanks. For those like me who had not. http://en.m.wikipedia.org/wiki/NSAKEY#section_2 http://en.m.wikipedia.org/wiki/NSAKEY#section_2
- meaty 14y agoI'll probably get shot for this but in the shared source license there are a number of huge holes around the signing key code. NSAKEY doesn't exist any more but its more suspicious when there is just no code there. I wouldn't trust Microsoft - the world's largest Trojan.
- salman89 14y agoNot sure how this relates. Article/interviewee is stipulating that the NSA intercepts all communications at the telecom level (as far as I understand). It doesn't say how this device also magically breaks encryption on encrypted data. I guess you are saying that Google willingly allows the NSA to decrypt the data? What would Google have to gain there? Because they certainly have a lot to lose.
- antidoh 14y agoThey don't need to break encryption for telecom interception to be worthwhile. Most email is not encrypted. Knowing what web sites you go to, if you are otherwise interesting, is worth knowing even if they can't read the bits. Pen registers do that with phones, and that's valuable enough that there are legal protocols about it. https://en.wikipedia.org/wiki/Pen_register https://en.wikipedia.org/wiki/Pen_register Just because you can't eat the whole enchilada doesn't mean the beans aren't worthwhile.
- salman89 14y agoThe email may not be encrypted, but as long as the data transfer was made under a secure protocol, there's not much of a difference. Only difference is that Google themselves can view your email in plaintext. But in terms of a man in the middle attack, I'm failing to see the difference.
- antidoh 14y agoFrom your house to Google is encrypted, but is it transmitted encrypted to the recipient's email provider?
- salman89 14y agoAh, I see. Thanks, I can buy that argument. A good argument can then also be that you should never trust emails outside your own provider? If you are sending to an @gmail to @gmail, you should be covered a bit better?
- mylittlepony 14y agoHow? By hiring all the mathematicians in the world. I don't see how the size of the company would matter. Also, they are US-based, and have to comply with US cryptography laws. But even if their SSL was unbreakable, the NSA/FBI/etc must have a free pass to Google/Facebook/etc data.
- salman89 14y agoMust? Why? What evidence do we have to prove this, or even substantiate it?
- clobber 14y agoHere ya go: http://www.wired.com/threatlevel/2012/05/google-nsa-secrecy-upheld/ http://www.wired.com/threatlevel/2012/05/google-nsa-secrecy-...
- salman89 14y agoWhere does it say that the NSA has open access to Google's data? It says that the NSA most likely collaborated with Google as part of an investigation of the hacking of their Chinese servers. The burden of proof being so low here on HN on matters like this is alarming.
- clobber 14y agoYou don't think this stuff is actually happening? That's cute.
- magicalist 14y agoso, no, you have no evidence, just a gut instinct. why did you even link to an article?
- clobber 14y agoBecause its actually relevant? http://www.youtube.com/watch?v=TuET0kpHoyM http://www.youtube.com/watch?v=TuET0kpHoyM
- neilk 14y agoNo one says they have.
- jacquesm 14y agoThey don't have to break any encryption at all: http://epic.org/foia/epic_v_nsa_google.html http://epic.org/foia/epic_v_nsa_google.html