11 ms·
NSA: we can warrantlessly grab your data and keep it forever if encrypted
- doki_pen 13y agoThis is like getting a warrant to search your house because your blinds are drawn.
- grecy 13y agoWarrant? pfft, they just force their way in when they really want to http://www.storyleak.com/video-shows-home-searches-by-boston-police-were-not-voluntary/ http://www.storyleak.com/video-shows-home-searches-by-boston...
- LoganCale 13y agoAbsolutely sickening.
- aspensmonster 13y agoAnd your door is LOCKED. WHAT ARE YOU HIDING?
- alan_cx 13y agoLost the key.... Sir? OK, then we will take you house away and you cant have it back until you produce the key.
- rayiner 13y agoNo, it's like targeting your house for frequent drive-bys because your blinds are drawn. You're presupposing that capturing data you have flowing over the internet is something that requires a warrant, and the NSA's position is predicated on the idea that it generally does not.
- betterunix 13y agoWhen I encrypt, I have a reasonable expectation of privacy. Period. Stop trying to violate that privacy, unless you are accusing me a specific crime and you have probable cause.
- jessriedel 13y agoI could be wrong, but I don't think any of the recent PRISM brouhaha hinges on whether you have a reasonable expectation of privacy. Everyone agrees that you do. Telephone calls (made in non-public places) explicitly enjoy this expectation. http://itlaw.wikia.com/wiki/Reasonable_expectation_of_privacy http://itlaw.wikia.com/wiki/Reasonable_expectation_of_privac... Rather, the recent issue is a disagreement over what constitutes a violation of privacy, e.g. whether electronic collection of data (without a human listener) constitutes violation.
- genwin 13y agoIt would also be an obvious privacy violation for the NSA to install cameras in our bedrooms, even if they promised to never watch the video without a warrant.
- mpyne 13y agoYes, but that's because it would require access to your bedroom, not because it's evil to capture data per se. What if, instead, you had a bedroom camera (maybe for tracking frisky escapades) and it streamed wirelessly to a home server? The more relevant question then becomes whether it's OK for the NSA (or rather, FBI) to sit on the street and capture that WiFi stream from a public road. As you consider this question, also consider how many open WiFi hotspots you've ever used (or broke the WEP for) in your hacking career. :) The idea that it's OK to hack the stupid because their system was so open to attack might finally die due to PRISM, if people are intellectually honest with themselves.
- svachalek 13y agoI think there's a significant difference between using an open (or even poorly secured, although I've never done that) hotspot in order to get onto the internet, vs deliberately capturing personal data from that hotspot with the intention to analyze it and possibly use it to harm the subjects of that data.
- nodata 13y agoAnd it only takes one vulnerability once for them to get your passphrase. Sleep well!
- aspensmonster 13y agoRotate your passwords. Regularly.
- nodata 13y agoThat won't help at all. One vulnerability once and it's game over.
- aspensmonster 13y agoI should have also added that you keep software up to date. Any previously exploited vulnerabilities (ideally) get patched over time. Of course, if you've been pwned at ring 0 by a persistent and active attacker, you've got more problems to worry about than automated exploitation of out-of-date software.
- nodata 13y agoSo you get hit by a zero-day and then you are compromised. What then?
- aspensmonster 13y agoAssuming it's not ring0 or something equivalent, they will have, at most, whatever the time limit is between rotations. If you rotate every six months, they could conceivably have six months of data. And if the zero day is still not patched, they could have another six months, and another, and another. There's no guarantee of not being compromised. It's just a matter of not making it easy by using the same passwords and same software versions for years at a time.
- 13y ago
- justanother 13y agoHow generous of the NSA to admit to a DDOS attack surface. You may all commence emailing each other PGP-encrypted copies of the complete Star Trek: TNG (Blu-Ray, natch), now.
- phogster 13y agoGuilty until proven innocent. Sounds reasonable.
- alan_cx 13y agoWell, what have you got to hide........?
- finkin1 13y agoHave you seriously missed the dozens of articles on HN recently explaining why privacy is important even if you have nothing to hide? Or are you just trolling?
- gasull 13y agoIf I lose all my data due to a hard drive crash, can I submit a FOIA request to obtain a backup? :-)
- alan_cx 13y agoIn theory, why not?
- sigmar 13y agodid you transmit your entire hard drive contents over the internet at some point?
- jlgreco 13y agoYou can request a FOIA request for the brainscans of the alien found inside of FDR's skull. Of course you won't get anything back, but that is another matter...
- microb 13y agoAll encryption is temporary encryption. "In other words, if your messages are encrypted, the NSA is keeping them until they can decrypt them."
- toddsiegel 13y agoThat was exactly my first thought. They can hold until they have the computing power to crack it.
- lazyjones 13y agoSo, tell me - did Google start encrypting so many services just to give the NSA a better excuse for siphoning all data, including SSL encrypted communication, E-Mails etc.?
- zhemao 13y agoGoogle stores an unencrypted copy on their servers, so the NSA would just get it from them. No need to store the encrypted copy for perpetuity.
- lazyjones 13y agoYes, but since the user encrypted it, he's suspicious and more likely to be snooped on, right? So by enforcing encryption, Google helped get the NSA an excuse to grab data (even the unencrypted copy) in more cases.
- fudged71 13y ago"Forever", meaning until they have the Quantum Computing technology to decrypt such 'suspicious' files.
- ferdo 13y agoGuvf vf trggvat evqvphybhf.
- DoubleCluster 13y agoIf your data isn't safe when someone has access to it "forever" then you haven't encrypted it good enough. I'd still prefer them not to keep it though.
- obstacle1 13y agoI think a big problem there is that "encrypted good enough" today might be "completely breakable" in 20, 40, or X number of years.
- donniezazen 13y agoAs a user of an online backup solution that encrypts everything client side, I am reluctant to use it anymore. Would knowing that encryption makes you more vulnerable for illegal online search and seizure change your online behavior?
- exit 13y agowe should all dedicate a percentage of our bandwidth to spewing random numbers at random listeners providing endless cover to actual chatter a crypto tithing
- darkarmani 13y agoYou mean create additional gmail accounts and fill them up with encrypted "messages." How many gigs are free these days, 10GB?
- sneak 13y agoI think it's still less than one utah datacenter divided by a billion or so.
- Fice 13y agoAnd even if they say they will not keep your data if not encrypted, how can you know for sure?
- ke7in 13y agoI'm curious to what options we have as citizens, short of organizing militias, can really do here. I think the government play is just "wait til this blows over" and they might get away with that.
- LoganCale 13y agoCall—actually call your members of Congress. It's a lot more effective than sending an email. Urge others to call too. If they get enough calls to understand a large number of people are actively angry about this, they might actually do something. http://callday.org http://callday.org Also encrypt everything possible, and encourage others to do that too. It might attract more attention to you, but it's also a strong assertion of your right to privacy. Everyone should use encryption for even the most mundane of things. The government says we have no right to privacy for emails older then 180 days because we are sharing them via someone else's server. If we encrypt them, that argument is invalid, because we are making it clear that only the recipients are intended to read it and it is private from everyone else.
- aclevernickname 13y ago"short of organizing militias". that's why I left your country. whole bunch of Short-of's.
- admig 13y agoi don't believe this joke. ;)
- cabalamat 13y agoIf the NSA is saying that all encrypted communication is automatically suspicious, then everyone should use encryption for all data they send over the internet. Starting today, I am writing email encryption software that, when you send an email to someone else with the software installed, will automatically encrypt it on the way out, and automatically decrypt any encrypted messages on the way in. (A "zero user interface" once installed). The intention is that this will allow people to encrypt their messages with zero effort on their part. Initially it will encrypt email and will run on unixlike machines (Linux and Mac). Later it will run on all major platforms (Windows, iOS, Android) and have functionality for VoIP and social networking (the intention is to replace Skype and Facebook with secure alternatives).
- pwnna 13y agoThis should be open source software as there needs to be security reviews and what not. Also, checkout OWS: https://whispersystems.org/ https://whispersystems.org/
- cabalamat 13y ago> This should be open source software as there needs to be security reviews and what not. It will be open source.
- gfodor 13y agoIf you really want this to work you should target the webmail use case for the big three webmail providers. Nobody wants to use a standalone client on a PC, if that's what you are suggesting. Next up is a mobile client for Android and iOS that works identically to the existing mail client on those platform so there is no learning curve. In other words, this will be a long slog where most of the work is product-oriented and feature Xerox'ing, and not whiz-bang cool encryption oriented. Good luck :)
- chacham15 13y agoIm unsure of what you are describing. Are you stating that hotmail should be able to display your decrypted emails? That would imply that they themselves would be able to read it and therefore remove any benefit. Any website you would build would have the same problem unless you resort to js crypto in which the js can be changed on you in a second (when the government forces your company to do so) and send the private key to the nsa. How exactly are you envisioning a solution?
- Raz0rblade 13y agoWell one thing they hate probaply is blowfish encryption. Dont use triple DES, as they where involved in it forcing it as a standard.