7 ms·

I'm still leaning toward the idea that if this is happening at all, it's happening at the ISP/Backbone level. Which would mean none of these companies are lying

I'm still leaning toward the idea that if this is happening at all, it's happening at the ISP/Backbone level. Which would mean none of these companies are lying- but still that the Government is way overstepping, by leaps and bounds. There's also the distinct possibility this is all bullshit. There have been a lot of holes and misinformation on Snowden's side("They can watch your thoughts form as you type", when none of the services except for GMail send textual data at real-time, etc), and the Q&A either doubled down some of them or was trying to be misleading. I'm still waiting for the Guardian to stop milking this and just give us the rest of the slides, the rest of their evidence. At this point, my confidence in the story is shaken enough that I want more if I'm gonna go Pitchfork in hand at the NSA with all of this.

captn3m0 13y ago
This is what I've been wondering about. PRISM was revealed in a 41 slide doc, and we are yet to see any but the 4 slides guarding and WP shared. Now that NSA knows about the leak, I don't think releasing them would have any further repercussions, other than better a better understanding of the PRISM program.
indrax 13y ago
Gmail uses https by default now.
- smegel 13y ago
  SMTP doesn't though (although gmail-to-gmail is probably OK).
  - lazyjones 13y ago
    Google still sends and accepts SMTP over TLS (using RC4) if your server is configured to handle it and has a snakeoil-CA-signed certificate. I just looked at our mail.log to confirm this.
- signed0 13y ago
  Would it be crazy to think that Google may have given the NSA a copy of their SSL certificate?
  - proksoup 13y ago
    We've known about the AT&T closets for years right? My understanding of SSL is weak, but if the NSA theoretically acquired the right private keys / SSL certificates / whatever through hook or by crook, they couldn't just watch everything then could they? Are the PRISM slide dates when they acquired said certificates/keys for said providers? Were non-legal means of acquiring used? My real question is - Does it matter that the collection of data is outside of Google's control? Should Google care that in the process of Google collecting data the NSA is intercepting it. Should Google want to stop that, if it were theoretically happening "in the middle". Google's attitude scares me.
  - pvnick 13y ago
    I was thinking the same thing. I wonder how many (if any) FISA orders were for SSL keys. If I were Keith Alexander those would be high on my list.
  - keysize 13y ago
    Would it be crazy to think that Google still uses 1024-bit SSL certificates at a time when even Godaddy recommends a bigger size? Because they do.
    - packetslave 13y ago
      Here's an interview question for you: "You're currently using 1024-bit SSL certificates. You want to start using 2048-bit certificates instead. What do you need to worry about if you're the size of Google?"
    - Matt_Cutts 13y ago
      We're in the process of upgrading to 2048 bits: http://thenextweb.com/google/2013/05/23/google-to-upgrade-its-ssl-certificates-to-2048-bit-keys-by-end-of-2013-will-start-the-process-on-august-1/ http://thenextweb.com/google/2013/05/23/google-to-upgrade-it...
ianhawes 13y ago
If this were happening at the packet level, PRISM would need constant maintenance for each service, and a MUCH higher budget than $20mil a year. Think about it, to be effective, you'd need to parse the format at which the data is sent. Formats and protocols change daily for all these services. And I highly doubt analysts are expected to look at pcap dumps to put together intelligence. I think reality is that PRISM is nothing more than a parsing software for data dumps after NSA has legally obtained the data from the provider. And I'm willing to bet the other 37 slides show that.
- duaneb 13y ago
  They might not be parsed, they could just be indexed and stored (think a time-aware google search for this data).
  - ianhawes 13y ago
    But still, NSA would need to know the entire IP range of all public facing servers, their purpose in relation to the service (for example, which IP range handles Gmail vs Search). Plus, if this were a store-it-and-forget-it situation, PRISM wouldn't be limited to the services it could support. Things just aren't adding up, here.
    - duaneb 13y ago
      Yea, it strikes me as ridiculously inefficient compared to forcing them via law.
      - res0nat0r 13y ago
        Much of this ISP / Tier 1 Network sniffing by Narus and other private tech companies is documented in James Bamfords' book about the NSA dating back to 2008. http://www.amazon.com/The-Shadow-Factory-Eavesdropping-America/dp/0307279391 http://www.amazon.com/The-Shadow-Factory-Eavesdropping-Ameri... It has been going on for a long time.
      - VladRussian2 13y ago
ChrisAntaki 13y ago
Yep, there is a constant upstream wiretap in the USA. This includes phone calls, texts and emails. http://www.wired.com/threatlevel/2007/05/mark_klein_docu/ http://www.wired.com/threatlevel/2007/05/mark_klein_docu/ This has been public knowledge since 2007. ;) PRISM helps the NSA in 2 ways: 1 - Collecting unencrypted versions of secured (https) communication. Note: They already have the encrypted copy. 2 - Collecting metadata, as in the case of Verizon. This allows them to make targeted database retrievals, from their massive data set.
duaneb 13y ago
> I'm still leaning toward the idea that if this is happening at all, it's happening at the ISP/Backbone level. It's entirely possible that this is happening, especially if it's plausible that the government forcibly acquired Google's root certs.

captn3m0 13y ago

This is what I've been wondering about. PRISM was revealed in a 41 slide doc, and we are yet to see any but the 4 slides guarding and WP shared. Now that NSA knows about the leak, I don't think releasing them would have any further repercussions, other than better a better understanding of the PRISM program.

indrax 13y ago

Gmail uses https by default now.

smegel 13y ago
SMTP doesn't though (although gmail-to-gmail is probably OK).
- lazyjones 13y ago
  Google still sends and accepts SMTP over TLS (using RC4) if your server is configured to handle it and has a snakeoil-CA-signed certificate. I just looked at our mail.log to confirm this.
signed0 13y ago
Would it be crazy to think that Google may have given the NSA a copy of their SSL certificate?
- proksoup 13y ago
  We've known about the AT&T closets for years right? My understanding of SSL is weak, but if the NSA theoretically acquired the right private keys / SSL certificates / whatever through hook or by crook, they couldn't just watch everything then could they? Are the PRISM slide dates when they acquired said certificates/keys for said providers? Were non-legal means of acquiring used? My real question is - Does it matter that the collection of data is outside of Google's control? Should Google care that in the process of Google collecting data the NSA is intercepting it. Should Google want to stop that, if it were theoretically happening "in the middle". Google's attitude scares me.
- pvnick 13y ago
  I was thinking the same thing. I wonder how many (if any) FISA orders were for SSL keys. If I were Keith Alexander those would be high on my list.
- keysize 13y ago
  Would it be crazy to think that Google still uses 1024-bit SSL certificates at a time when even Godaddy recommends a bigger size? Because they do.
  - packetslave 13y ago
    Here's an interview question for you: "You're currently using 1024-bit SSL certificates. You want to start using 2048-bit certificates instead. What do you need to worry about if you're the size of Google?"
  - Matt_Cutts 13y ago
    We're in the process of upgrading to 2048 bits: http://thenextweb.com/google/2013/05/23/google-to-upgrade-its-ssl-certificates-to-2048-bit-keys-by-end-of-2013-will-start-the-process-on-august-1/ http://thenextweb.com/google/2013/05/23/google-to-upgrade-it...

ianhawes 13y ago

If this were happening at the packet level, PRISM would need constant maintenance for each service, and a MUCH higher budget than $20mil a year. Think about it, to be effective, you'd need to parse the format at which the data is sent. Formats and protocols change daily for all these services. And I highly doubt analysts are expected to look at pcap dumps to put together intelligence. I think reality is that PRISM is nothing more than a parsing software for data dumps after NSA has legally obtained the data from the provider. And I'm willing to bet the other 37 slides show that.

duaneb 13y ago
They might not be parsed, they could just be indexed and stored (think a time-aware google search for this data).
- ianhawes 13y ago
  But still, NSA would need to know the entire IP range of all public facing servers, their purpose in relation to the service (for example, which IP range handles Gmail vs Search). Plus, if this were a store-it-and-forget-it situation, PRISM wouldn't be limited to the services it could support. Things just aren't adding up, here.
  - duaneb 13y ago
    Yea, it strikes me as ridiculously inefficient compared to forcing them via law.
    - res0nat0r 13y ago
      Much of this ISP / Tier 1 Network sniffing by Narus and other private tech companies is documented in James Bamfords' book about the NSA dating back to 2008. http://www.amazon.com/The-Shadow-Factory-Eavesdropping-America/dp/0307279391 http://www.amazon.com/The-Shadow-Factory-Eavesdropping-Ameri... It has been going on for a long time.
    - VladRussian2 13y ago

ChrisAntaki 13y ago

Yep, there is a constant upstream wiretap in the USA. This includes phone calls, texts and emails. http://www.wired.com/threatlevel/2007/05/mark_klein_docu/ http://www.wired.com/threatlevel/2007/05/mark_klein_docu/ This has been public knowledge since 2007. ;) PRISM helps the NSA in 2 ways: 1 - Collecting unencrypted versions of secured (https) communication. Note: They already have the encrypted copy. 2 - Collecting metadata, as in the case of Verizon. This allows them to make targeted database retrievals, from their massive data set.

duaneb 13y ago

> I'm still leaning toward the idea that if this is happening at all, it's happening at the ISP/Backbone level. It's entirely possible that this is happening, especially if it's plausible that the government forcibly acquired Google's root certs.