3 ms·

Summary: The FBI admits they aren't capable of performing MITM SSL attacks, and that Google is currently providing them with private data. Because of this, they

Summary: The FBI admits they aren't capable of performing MITM SSL attacks, and that Google is currently providing them with private data. Because of this, they want some sort of real-time inspection powers that do not depend on Google's cooperation.

bigiain 14y ago
<hat type="tinfoil"> … or they've so thoroughly subverted the SSL certificate "industry" and the major internet backbones that they figure even people using SSL cert pinning aren't going to notice they're already MITMing every single piece of web traffic with self-issued browser-trusted certs. So it's a good PR time to pretend they need new powers.</hat>
- camus 14y ago
  if they can do that ,the backdoor will be found by others sooner or later.
  - bigiain 14y ago
    Where by "sooner or later", you mean "last year": http://www.computerworld.com/s/article/print/9235260/Rogue_Google_SSL_certificate_not_used_for_dishonest_purposes_Turktrust_says?taxonomyName=Data+Security&taxonomyId=203 http://www.computerworld.com/s/article/print/9235260/Rogue_G... and http://www.computerworld.com/s/article/9219606/Hackers_stole_Google_SSL_certificate_Dutch_firm_admits http://www.computerworld.com/s/article/9219606/Hackers_stole... Fortunately that attack is only possible if you're a despotic nation-state who controls your entire countries internet connection - or perhaps a three letter agency who'd only have to lean on half a dozen or so major internet backbone company CEOs - so you can MITM pretty much _all_ the traffic...
- pi18n 14y ago
  Why would they bother MITM? They can just send a national security letter demanding the private key of the CA and a gag order forbidding them from announcing the compromise.
A1kmm 14y ago
Secret and probably illegal monitoring techniques cannot be used in court, because defendants have a right to know how evidence was obtained so they can challenge it, and it then wouldn't stay a secret. Just because they don't currently have any methods they can base a court case on and put on public record doesn't mean they don't have other interception methodologies (whether through cryptographic weaknesses, CA attacks, compromising servers at Google / DropBox, cooperation from / insider double agents at Google / Dropbox / CAs, backdoors installed on clients, compromising user or employee login credentials and so on).

bigiain 14y ago

<hat type="tinfoil"> … or they've so thoroughly subverted the SSL certificate "industry" and the major internet backbones that they figure even people using SSL cert pinning aren't going to notice they're already MITMing every single piece of web traffic with self-issued browser-trusted certs. So it's a good PR time to pretend they need new powers.</hat>

camus 14y ago
if they can do that ,the backdoor will be found by others sooner or later.
- bigiain 14y ago
  Where by "sooner or later", you mean "last year": http://www.computerworld.com/s/article/print/9235260/Rogue_Google_SSL_certificate_not_used_for_dishonest_purposes_Turktrust_says?taxonomyName=Data+Security&taxonomyId=203 http://www.computerworld.com/s/article/print/9235260/Rogue_G... and http://www.computerworld.com/s/article/9219606/Hackers_stole_Google_SSL_certificate_Dutch_firm_admits http://www.computerworld.com/s/article/9219606/Hackers_stole... Fortunately that attack is only possible if you're a despotic nation-state who controls your entire countries internet connection - or perhaps a three letter agency who'd only have to lean on half a dozen or so major internet backbone company CEOs - so you can MITM pretty much _all_ the traffic...
pi18n 14y ago
Why would they bother MITM? They can just send a national security letter demanding the private key of the CA and a gag order forbidding them from announcing the compromise.

A1kmm 14y ago

Secret and probably illegal monitoring techniques cannot be used in court, because defendants have a right to know how evidence was obtained so they can challenge it, and it then wouldn't stay a secret. Just because they don't currently have any methods they can base a court case on and put on public record doesn't mean they don't have other interception methodologies (whether through cryptographic weaknesses, CA attacks, compromising servers at Google / DropBox, cooperation from / insider double agents at Google / Dropbox / CAs, backdoors installed on clients, compromising user or employee login credentials and so on).