5 ms·
This is exactly the conclusion I came to. My guess is they have the SSL/TLS keys. That being said, tptacek thinks we are wrong, and he is a subject matter exp
by jcampbell1 13y ago
This is exactly the conclusion I came to. My guess is they have the SSL/TLS keys.
That being said, tptacek thinks we are wrong, and he is a subject matter expert, so I am not sure.
- kalmi10 13y agoThe linked quora answer (from the co-author of Firesheep) says that even in that case one can't launch a passive man in the middle attack if perfect forward secrecy is used. Google.com uses Diffie–Hellman key exchange which provides perfect forward secrecy. So... If I understand everything correctly, it should be impossible to decrypt passively captured HTTPS traffic to/from google.com. http://www.quora.com/SSL-Secure-Sockets-Layer/Is-it-ever-possible-to-decrypt-passively-sniffed-SSL-TLS-traffic/answer/Ian-Gallagher-2 http://www.quora.com/SSL-Secure-Sockets-Layer/Is-it-ever-pos... Could someone more knowledgeable confirm this?
- herf 13y agoactually everyone seems to have switched to the "fast" SSL ciphers instead - only dropbox defaults to DHE: > openssl s_client -connect google.com:443 RC4-SHA > openssl s_client -connect dropbox.com:443 DHE-RSA-AES256-SHA Again, this is usually done for speed, but all of the companies on the list are using "fast" SSL/TLS ciphers rather than more secure ones.
- zaroth 13y agoThanks for this. "Dropbox coming soon" indeed.
- kalmi10 13y agoI not really an expert in this at all, but we were not discussing ciphers, but key exchange methods. I open google.com in Chrome, click on lockpad icon, go to the second tab, and it says: Key exchange method: ECDHE_ECDSA Some googling turns up that: "ECDHE-ECDSA provide perfect forward secrecy" http://nmav.gnutls.org/2011/12/price-to-pay-for-perfect-forward.html http://nmav.gnutls.org/2011/12/price-to-pay-for-perfect-forw...
- herf 13y agoyes it appears Google has PFS for Chrome/Firefox: http://www.imperialviolet.org/2011/11/22/forwardsecret.html http://www.imperialviolet.org/2011/11/22/forwardsecret.html
- jcampbell1 13y agoWe are not disagreeing with anything he says. We are saying the NSA has the private key. Ian Gallager: > so if you have the private key, you can decrypt that key, and then use it to decrypt the bulk-encrypted data. Like he says, if you have the key, wireshark can decrypt the data trivially. If you have the CA master keys, then the only thing you can do is perform a MITM attack, but not silently decrypt the raw data. A MITM attack would eventually get detected.
- Dylan16807 13y agoEphemeral Diffie-Hellman creates a new key per connection in a public-safe manner. You cannot eavesdrop on such a connection, even if you have the signing key. The question then becomes, are the SSL sessions actually using that mode.
- jcampbell1 13y ago> Ephemeral Diffie-Hellman creates a new key per connection in a public-safe manner. How does that make a difference when you have the Diffie-Hellman key? We are saying they have the Diffie-Hellman keys, not the signing keys, nor the block cipher key that is exchanged. They have the only key that matters.
- bdonlan 13y agoHow are they getting the DH keys without cooperation from at least one of the SSL endpoints involved? They're newly generated at every SSL handshake, you can't just get a mole to hand you the keys once and be done with it. If you had the certificate private key, you could do a MITM, but this requires a LOT more resources and would be much more easily detectable.
- jcampbell1 13y agoI was clearly wrong. But I am still lost on how it would be detectable? From Google's end, some client just disconnected. From the client's end, the internet just got a tiny bit more latency.
- andreyf 13y agoEven without keys, the metadata from the packet headers and traffic analysis can be quite useful. Could you link to tptacek's comments you're referring to?
- kalmi10 13y agoIt's gone.
- jcampbell1 13y ago> Could you link to tptacek's comments you're referring to? https://news.ycombinator.com/item?id=5842915 https://news.ycombinator.com/item?id=5842915 I was being a bit devious. I am just so tired of tptacek dismissing stuff I say with asinine arguments and then watching my comment get downvoted to hell.
- lifeguard 13y agoSSL broken by design: http://cryptome.org/0005/ssl-broken.htm http://cryptome.org/0005/ssl-broken.htm
- nullc 13y agoIf you hold the theory that the traffic is being intercepted and the parties have compromised the TLS keys: The test for complicity is obvious: failing to rotate out the TLS keys, failure to HSTS, and failure to switch to EDH ciphersuites everywhere. These are all moderately 'cheap' steps if you believe you're being compromised in this manner.
- JunkDNA 13y agoIndeed, I'm highly inclined to defer to tptacek's experience here.