14 ms·

German minister: Stop using U.S. Web services to avoid NSA spying

236 points by Libertatea 13y ago

esolyt 13y ago
What are the alternatives? Why are they more trustworthy?
- kimlelly 13y ago
  Avoid web services as much as possible and use desktop software whenever possible. Then make sure your operating system is open source.
  - huhtenberg 13y ago
    Open source doesn't imply trustworthiness. (edit) That's unless you build every single piece of the OS from the source that you either proofread by hand or obtain from a trusted distributor. While you can be reasonably sure that Linux kernel you just built from kernel.org sources (after diligently verifying the .tgz sig, of course) is clean, any of the binary packages you install afterwards may be rooted all the same.
    - kimlelly 13y ago
      Sure, not 100%, but way more than closed source any day. (edit) Now, for comparison's sake, you'd have to try and apply that same rigour to MS Windows or MacOS/iOS...
      - MisterWebz 13y ago
        Would we be able to detect any suspicious activity on our closed source operating system, or would a backdoor implemented specifically for intelligence agencies allow undetectable communication between hosts?
        nathan_long 13y ago
        If you care, you can watch every packet being sent and received. If the OS is open, you can figure out where they came from.
        flyinRyan 13y ago
        So you've compiled your entire OS from source with a compiler you verified to be safe? Because if you use a prebuilt OS how do you know it isn't already "root kitted" to not show certain traffic?
        MisterWebz 13y ago
        > "root kitted" to not show certain traffic That's what's bothering me. How feasible would it be to implement something like that on a massive scale and people not finding out? And how about using your router to deny incoming and outgoing traffic unless it's whitelisted? Is there some way for the router to identify the service that sent out a packet and deny or allow it or at least "scan" the content and make sure nothing malicious is being received or sent?
        vidarh 13y ago
        We probably would be able to. But consider that the "backdoor" can be incredibly sneaky. Look up the claimed "Crypto AG" attack, which involved pre-internet crypto devices. The claimed way it worked was to include the key or enough data to allow decryption in the transmitted message in some form. NSA wouldn't need something to contact their data centres and leak the information, because presumably they can tap some fiber connection or other your data ends up travelling to. All they'd need would be a slow leak of your keys. Even, say, just a few of tweaked data per packet, or tacked on to a file format that is resistant to it, so that they can pick up key information together with the data stream, and they're good. Or even just intentionally introducing a specific way of generating keys, known to the with sufficient precision to allow them to reduce the key space enough that brute forcing the remaining bits is feasible. For a conceptual example, look up the old Netscape SSL vulnerability (Netscape's SSL used to rely on factors like the host time and pid, that especially on a typical Unix-y system also running services like mail servers that often would include the pid of of the delivery agent in headers etc., was extremely easy to narrow down) It's difficult to do this in a way that can't/won't sooner or later be discovered, but given the number of likely unintentional mistakes that have been made that still have taken in some cases years to be discovered (publicly at least), it's plausible that there are intentional flaws in at least some software to make it possible for specific parties to be intended to be able to break it.
      - huhtenberg 13y ago
        You are comparing apples to oranges. The OS being inherently untrustworthy forces you to operate under the assumption that it is tracking you and that it does have backdoors. So instead of focusing on weeding out any rootkits or backdoors, you'd be putting the OS under external scrutiny, including filtering all of its network traffic on a separate device. If, on the other hand, you let yourself get convinced that a stock Debian installation is more likely than not to be "clean", then you just lost your edge and any interested party can waltz in with a truckload of rootkits and you wouldn't even think to care. This whole "open source is more trustworthy" mindset is really quite dangerous.
        TheLegace 13y ago
        I don't understand how it's apples an oranges. So your telling me right now the choice between Windows, OSX and Linux and the choice for security is somehow ambiguous? Both Microsoft and Apple have been directly passing data to the NSA. Where are the data leaks from Linux or other open source software. Open source software is a lot harder to control, not only do you have people with principles in play, your gonna have a tough time gaining control over decentralized systems. Just remember if someone(like the NSA or any other skilled hacker) wants to get on to your computer they will, with enough time anything can be broken. So whats the solution let's pick Windows and never look back.
    - thex86 13y ago
      Where does a distribution like Debian stand? Can the people who upload packages do something fishy and not get caught? Not that I doubt their intention, but let's assume a developer is forced to do it by say his state or through some other coercion?
  - nikster 13y ago
    Avoid web services is hardly practical advice. The whole reason people use computers is the internet. And for that of course they don't need risky back doors (which some security researcher would find sooner or later). They just control a few central exchanges and done.
ekianjo 13y ago
It's not just the US Web services, the traffic anyway goes through the US and can be intercepted.
- toomuchtodo 13y ago
  HTTPS/SSL with perfect forward secrecy
- sneak 13y ago
  Germany-to-Germany traffic does not go through the US.
  - ekianjo 13y ago
    You might as well make a closed Internet for Germany only... The point of the Internet is to be global in the first place.
    - sneak 13y ago
      Every country already has a closed internet for their own domestic use. It's called the internet. This makes the article relevant: "Stop using US services."
    - deleted 13y ago
      [deleted]
kimlelly 13y ago
And some general advice to keep more of your privacy: 1. Use an open source operating system. 2. Communicate over RetroShare: https://news.ycombinator.com/item?id=5983913 https://news.ycombinator.com/item?id=5983913
zby 13y ago
The journalist forgets that tapping into the cables only works for unencrypted traffic - this is actually the reason that NSA bothered Google and others in the first place.
- voidlogic 13y ago
  And you know the NSA hasn't been given or stolen SSL private keys of major players? Most big sites don't use forward perfect secrecy making MITM achievable.
  - sneak 13y ago
    MITM always unambiguously refers to an active attack. That's not what they do or have ever done. It stands for man-in-the-middle. They aren't in the middle when they tap fibers. Lack of forward secrecy ciphersuites does allow for retroactive decryption upon server secret key compromise though, which is what I assume you meant.
whiskeychaser 13y ago
Like the NSA is limiting itself to just the US? C'mon, if they can do it here without anyone knowing why would they stop at our borders/servers?
- BrandonMarc 13y ago
  Exactly. The NSA's purpose for existence is to intercept communications of non USA citizens outside USA borders. Right or wrong, it's simply why they exist in the first place. The current scandal is due to how much they do it to USA citizens within USA borders ... without getting into the right or wrong of it, the latter is against the Constitution, while the former is not.
  - robin_reala 13y ago
    That might be the focus of the scandal in the US, but it certainly isn’t in the EU.
    - sneak 13y ago
      Yeah. If Google/AWS/AWS-hosted companies/Apple/Microsoft/Facebook know what's good for them, they'll quickly do literally everything they can to force the US government to stop this foolish bullshit. They have far more non-US-citizen customers than they do US-citizen customers.
    - dragonwriter 13y ago
      > That might be the focus of the scandal in the US, but it certainly isn’t in the EU. Its the focus of the leak which is at the heart of the scandal (and the leaker is not someone for whom the NSA spying on purely foreign traffic would be remotely problematic or noteworthy.) But it would be a mistake to content the focus of the leak with the overall scope and focus of the NSA's intelligence gathering efforts.
mhd 13y ago
Expect lots of new Samwer copy/paste startups if people actually care in the end.
ianstallings 13y ago
This is not going to help. But we now see how the fall out from this scandal will affect us. When I build my next API or service will people around the globe use it? Or will they be skeptical and decide to roll their own or go with an offshore competitor? Very irritating.
- blueprint 13y ago
  Much of your offshore traffic may well pass through US-Europe trunks anyway, so any web service will find it difficult or impossible to avoid this problem.
  - furyg3 13y ago
    Yes, but as someone who makes IT decisions for an organization outside the US, it's still a factor. When evaluating services, one factor is "Do they use sound security principles?" Does their API use SSL? How does authentication work? How is my information stored? Etc. Another factor is "Do I trust them with my data?" This has a lot to do with the company's track record, business model, and of course their location. Where are they? What are the privacy laws like there? What is the level of corruption? If government agencies (and their subcontractors) can go to my service provider and secretly demand sweeping access to any "foreigners data", without any sort of due process, why would I do business with that company? I think I'd rather go with a company in a country with strong privacy protections, even for non-citizens, and take my chances with best practices for securing data on the wire. Due process and strong privacy protections are a competitive advantage for a country... The US is royally screwing it's own tech sector with these policies.
    - ianstallings 13y ago
      Yes so true. People will still be spied and what is truly harmed by this spying revelation is US commerce itself. In a global economy you don't want to be known for being untrustworthy.
- BrandonMarc 13y ago
  I believe this may be very helpful. If enough Europeans stop / limit using Google services, then Google's stock price on Wall Street will see the consequences. Google has powerful lobbyists on Capitol Hill, and they will use their influence to change the playing field such that they either don't have to cooperate as much, or can be more transparent about the cooperation. Either option, or both, would help polish the tarnish on Google's reputation due to this. Perhaps this is wishful thinking ... kinda like believing Europeans, Asians, etc will build their own Google-replacement ... but it's small a reason for hope, all the same.
lazyjones 13y ago
Such short-sighted outcries do not help. He should first consider asking people to stop using US-made, closed source operating systems. Then he should ask Germany's secret service (BND) what they are doing with the data from DE-CIX (e.g. sharing with the NSA ...).
- flyinRyan 13y ago
  Of course it fucking helps. Every step helps. Your suggestion is so useless to be irritating. "Oh, we can't say anything because there might be some asshole on the internet who could make it sound hypocritical. We best just keep doing fuck all because that's worked so well thus far".
  - lazyjones 13y ago
    It does not expletive help to make the problem sound smaller than it actually is, which is precisely what he did with his dumb advice.
Fuxy 13y ago
I say block all US services in EU. It will be inconvenient as hell and incredibly annoying but it will give European companies a chance to fill the void. And yes I know it can be bypassed but jumping through hoops is always annoying and if European alternatives show up people would be less likely to bother. I would do it just to see what happens :)
- gst 13y ago
  Censorship is always the solution. Because the user does not know what he wants. Is this what you want to say?
  - Fuxy 13y ago
    Face it there is already censorship and people pretending its for a noble cause like to prevent piracy or child porn or whatever I'm just taking it to its logical next step. Protecting your countries users from foreign spying. Edit: I'm not saying its right but if we're already doing the wrong thing why not make it entertaining and beneficial to local business.
    - mc32 13y ago
      So you're saying if other countries' data traffic did not pass through the US the US would be unable to set-up some shop over there to syphon data? And A US company could not be allowed to buy an EU company? It's all shortsighted and all these 'measures' could be overcome, if there's incentive for it.
      - Fuxy 13y ago
        I would love to see the US try to set up shop in the EU in order to spy on its citizens. Now that would be an entertaining international incident. A US company not being able to buy a EU company is an interesting side effect that may promote diversity and innovation. Have you heard of speciation? Also everything can be overcome however it would make it considerably more difficult for the US to conduct mass surveillance on EU citizens.
deleted 13y ago
[deleted]
alan_cx 13y ago
Since the UK is acting as the USA's slurp gateway, I reckon the Germans should be having a word with us. Also, if the EU wants to block the US in what ever way, its going to need to block the UK too, since it will side with the US.
- claudius 13y ago
  Hopefully you’re going to take care of that yourself after the next election.
  - muyuu 13y ago
    If you're talking about the EU in/out in the UK I'm looking forward to it, but the EU will resist to it even happening. Nothing scares the EU more than the threat of a popular consultation.
  - Nursie 13y ago
    If you think the rather bovine electorate of any of our great western nations will either remember or figure out why they should give a crap... well you have a lot more faith in humanity than I have left.
    - claudius 13y ago
      The rather bovine electorate of the UK prefers to leave the apparently over-regulating, wasteful and generally evil EU, which would then would make it far easier to impose restrictions on UK services. Given that the UK already contributes nearly nothing to the EU budget and economy (apart from an oversized banking sector in no small part responsible for the current financial crisis), the remaining countries will not seriously resist the UK leaving. De Gaulle really was right from the start :)
- mc32 13y ago
  It's either naivete or posturing. All major gov'ts intercept each other's traffic and do espionage (industrial or intelligence) on each other. It's a kind of gentleman's agreement. We know you spy on us, you know we spy on you, but let's pretend we don't, publicly, and if something becomes public (one of us is careless), act outraged and protest. (the Lady doeth protest too much)
blueprint 13y ago
Idealistic and hypocritical. That is advice aimed at diverting attention from the full scope of surveillance occurring on the people of Germany.
- flyinRyan 13y ago
  Actions have to be taken. Germany is spying on its citizens. The US is spying on everyone. It's pretty obvious where the priority should be here. Man I'm so sick of any fucking action anyone suggests getting met by a bunch of morons pointing out how it might be "hypocritical". Who gives a fuck?
  - blueprint 13y ago
    Because the US' problem originated in hypocrisy. This world will only change into one that is for the living people when everything that is in truth and falsehood is revealed. To engage in action that is connected to falsehood is to make a relationship with falsehood. To do so under the guise of acting to solve these problems makes oneself a hypocrite.
antr 13y ago
At work we've already had this discussion regarding the location of the web apps we use. Not because we manage "highly sensible" data, but because this entire situation bothers us at many levels. Although not 100% decided, the "biggest" change we are planning is to move all of our Google Apps email/server to a private mail server located here in Europe + encryption for all. This is a relatively easy transition. A tougher change is finding (if it exists) a Box alternative.
- kimlelly 13y ago
  > A tougher change is finding (if it exists) a Box alternative. Depending on your needs, RetroShare might be the one: http://retroshare.sourceforge.net/ http://retroshare.sourceforge.net/
- olegp 13y ago
  Have a look here: https://starthq.com/apps/?category=collaboration https://starthq.com/apps/?category=collaboration We just added the country where each SaaS app is hosted, so you should be able to find some EU based alternatives to Box quickly.
- davidw 13y ago
  Spam filtering is also something that Gmail does pretty well. If you've got a public email address that's 'out there', a serious spam solution is pretty important.
  - griffordson 13y ago
    Unless of course you consider multiple daily SEO spams, "spam". Because GMail doesn't filter those at all. Even emails that are worded exactly the same but sent from a different source GMail address.
  - mjn 13y ago
    I've been not very happy with Gmail's spam filtering, though I admit it's hard to do right. But its false positives were the main reason I moved away from it. The last straw was when they spam-filtered an email from my landlord because it contained some Danish text in it (I live in Denmark!). I eventually found it in my Spam folder (which I thereafter had to check regularly) with the explanation that it was filtered because "It's written in a different language than your messages typically use."
k-mcgrady 13y ago
I have started doing this with some services and there were good alternatives available. But for search I can't find one. I tried DuckDuckGo for a few weeks but the results were awful compared with Google. Can anyone recommend a good, more secure alternative to Google?
- kimlelly 13y ago
  > ...recommend a good, more secure alternative to Google? https://startpage.com https://startpage.com has currently the best results, IMO.
  - junto 13y ago
    ^^ This ^^ has just been added to my favourites bar. I'll give this a go, and if I like it, I'll be removing Google. Thanks for the tip!
- MikeCapone 13y ago
  While I dislike the design and am not entirely comfortable with the idea of making ad money off Google (well, Google takes its share) by just wrapping their products, this site gives you Google results but without giving Google much to identify or track you: https://startpage.com/ https://startpage.com/
- ytodo 13y ago
  plug your babelfish and try yandex.ru wink when you search for a flower maybe, there isn`t any porn, when you search for porn you will find anything you prefer lol let me (the troll) qoute What does some people have the rewards for, when spreading informations wich appeal to the "simple men"-iniquities-being ? one simple but conspiracy answer sounds like: when the rich and mighty want their life undisturbed and more feudal, and the "simple men" be in a block, the rich just needs a reason to deploy the long time up-builded-defense against the people so, dont let`em polarize you, dont give`em the possibility to get us that easy.
- reeses 13y ago
  Keep using DDG and give feedback. Make an investment of your time with a slightly worse solution with a longer range goal of having a better solution later.
xedarius 13y ago
Just out of interest, given the revelation that the UK is tapping underwater fibres, anyone know if they have a plan to stop doing it? Or they just going to carry on? If they do decide to stop, how do we check?
tyang 13y ago
Stop using Google, Microsoft, Yahoo, Facebook, Amazon and Apple? And how's that Baidu filter working for ya?
a3n 13y ago
No such action will have any direct effect on surveillance. I think it's clear by now that the NSA hoovers everything, regardless of citizenship or location. But if it has an economic effect, that might get someone's ear. So yeah, shun US data companies, it may compel the NSA to at least be a little more transparent.
- flyinRyan 13y ago
  Are you saying the NSA is spying even on traffic that never goes near the USA? That would be one of the biggest claims so far. EDIT: appears the claim isn't as big as I thought, though I'm surprised that's not the case!
  - pilsetnieks 13y ago
    A lot of Internet traffic is routed through the US, not because it's the closest geographically but because the fattest pipes and the lowest transfer prices may be there. One of the original leaked slides illustrates that pretty good.
  - dragonwriter 13y ago
    > Are you saying the NSA is spying even on traffic that never goes near the USA? That would be one of the biggest claims so far. Foreign signals intelligence is the whole point of the NSA [1]. The only reason their spying on domestic traffic is controversial is that, unlike purely foreign traffic, there is a history of abuse of surveillance for domestic political purpose which has produced both laws imposing limits on and public expectations of restraint with regard to domestic surveillance. So, no, the NSA spying on purely foreign traffic with no domestic nexus wouldn't be "one of the biggest claims so far", it would be exactly what the NSA exists to do and a non-issue. It would be news if the NSA wasn't spying on purely foreign traffic, not if it was. [1] From http://www.nsa.gov/ http://www.nsa.gov/ : "The NSA/CSS core missions are to protect U.S. national security systems and to produce foreign signals intelligence information."
    - flyinRyan 13y ago
BjoernKW 13y ago
Funny thing is, this is coming from a politician who usually shows no qualms when it comes to invading people's privacy. If anything, he's merely envies the NSA for its extensive surveillance capabilities. If German politicians really wanted to do something they could to do so easily by granting asylum to Edward Snowden.
HSO 13y ago
Stop using US services?! That's where I started but as of today, I'd go even further: * Americans no longer welcome in Europe; you think you can spy on us, torture people, kill innocents, trample over longstanding diplomatic conventions to ground a president of a country, put the full might of your police state to hunt down your own freedom fighters, and then come here and have a good time or do business? Think again. US citizens not welcome here anymore!!! You can do what you want in your country, but don't come here if you don't respect our way of life and our privacy. * Let's kick the Brits out of the EU (they don't seem to be too happy in there anyway); they are basically just a foothold for the American fascists in the EU and do their bidding * Let's not stop at moving our own email and social accounts to European providers. Refuse to accept emails coming from gmail, yahoo etc. domains! Send automatic replies that explain why and suggesting ways what is acceptable. The point is: The US electorate and businesses are either pro surveilling the whole world, even their own allies, or they are lethargic and indifferent. If the former, we should draw the consequence and stop having contact and exchanges with them. If the latter, we should increase the cost of doing nothing. Hurt them the only way we, as citizens of the world without a voice in the American police state, can hurt them: In their pocket and in their options to travel and have fun. America is always so happy lecturing the world about democracy. Well then, now you can show us which way the wind really blows in America and its relation with the world.
- chris_mahan 13y ago
  I am a US citizen, and I approve this message.
  - logical42 13y ago
    I am a US veteran, and I also approve of this message.
- glasz 13y ago
  i promise you one thing: eu soil isn't really better. they exchange (or at least want to and i don't see those fascists not doing it) air passenger data with foreign countries without your or my consent.
- 13y ago
sbmassey 13y ago
The only way to stop this kind of thing is to restrict the size of your sovereign nation to a size where the citizenry can actually have some idea what their state is doing ... maxing out at a million or so, say: you dont see governments like Iceland or the Swiss cantons acting in this kind of out-of-control manner.
elchief 13y ago
"Can you think of a single European search engine?" Yandex.
malandrew 13y ago
They should go one step farther. I would love to see Germany set up a program to woo American tech talent to Germany to work on anti-surveillance systems. Make it a no strings attached program. All you need to do is move to Germany and work with software/hardware that ensures secrecy. You would be given assistance to either join an existing company or set a new one up. Your choice. Financing would also be made available to build anti-surveillance startups.
- weland 13y ago
  If they start it, count me in.
  - malandrew 13y ago
    If someone is in Germany and has access to the right ears in government, you should pitch this idea. I would love to see some country champion any and all startups and open-source technologies that promote decentralization. We need more projects out there that are consumer friendly and use DHT based solutions like Kademlia for mutually shared data.
- mbillie1 13y ago
  I would _strongly_ consider doing this, if there were offers on the table.
- ippisl 13y ago
  I wonder if a kickstarter funding would work in this case, especially since open-source is considered a requirement for good privacy software.
DanielBMarkham 13y ago
This might be a good time to remind the angry mob that other nations spy just as much, or more so, than the US. The US just got caught. This is like the secret of the atom bomb. Once it's out, it's out. No pretending that it doesn't exist any more. Guess what? What you put on the wire is fair game for any of scores of different intelligence agencies. No, not usually the criminal law enforcement folks, but the spy guys. And most of the politicians in these countries don't know. In fact, for a program like this to be effective, very few people should know. You can't put that genie back in the bottle by getting mad at the US and pulling your data out. (Not that I blame you. Might make a fine protest. It just does nothing to ensure your privacy and anonymity) In fact, you could actually be opening your data up to even more abuse. Who knows? The world needs to decide once and for all whether to make this data completely transparent and accessible to all, or an international crime to collect. Pretending this is a USA-only problem is just another way of sticking your head in the sand.
- dragonwriter 13y ago
  > This might be a good time to remind the angry mob that other nations spy just as much, or more so, than the US. Probably not "as much"; quantity of spying is limited by quantity of resources available for spying, and the US probably outspends most other nations (quite likely, as with military spending more generally, at or near the amount of all other nations combined) on spying.
  - moheeb 13y ago
    It is so cheap to collect and store nowadays that your argument won't be true for long, if it even still is.
    - dragonwriter 13y ago
      This is true, perhaps, of voluntary collection of data from cooperative partners, which is, to be sure, one of the controversial aspects of the NSAs domestic surveillances that has come out, but hardly the limit of the NSA's spying. It will continue to require resources to collect information from people who are trying to prevent you from having it.
anigbrowl 13y ago
I'm somewhat amused by the grammatical error in this headline.
lars 13y ago
I work in a European branch of one of the very large tech consultancies, and I know that decisions to this effect have been made in several of the countries we operate in. There's a lot of money that isn't being funneled to Amazon and the like because of this.
- pekk 13y ago
  Also avoiding the UK and France? Probably not. Why not? Because this isn't really about surveillance, it is about an excuse to boycott the US.
embolism 13y ago
This is the same Germany that issues mandatory RFID based national ID cards, and requires all citizens to register with the police when they change residences?
seanmcdirmid 13y ago
Why doesn't Europe just block US services for "national security reasons?" Like say...china does. I have to admit, this puts china's blocking in a completely new light...they might have a real argument if I didn't already know they just want to spy on us themselves.
noiv 13y ago
German here. All these after Snowden proposals from German government or opposition are fake. Either they call it a Hollywood fantasy, want to escalate it to the EU or now ignore snooping happens at the cable. The day anybody proposes encryption to the public I'll consider to start voting again. And regarding some other comments here, I think it's a stretch calling a country democracy, if the voter turnout is below 50%.

236 points by Libertatea 13y ago

esolyt 13y ago

What are the alternatives? Why are they more trustworthy?

kimlelly 13y ago
Avoid web services as much as possible and use desktop software whenever possible. Then make sure your operating system is open source.
- huhtenberg 13y ago
  Open source doesn't imply trustworthiness. (edit) That's unless you build every single piece of the OS from the source that you either proofread by hand or obtain from a trusted distributor. While you can be reasonably sure that Linux kernel you just built from kernel.org sources (after diligently verifying the .tgz sig, of course) is clean, any of the binary packages you install afterwards may be rooted all the same.
  - kimlelly 13y ago
    Sure, not 100%, but way more than closed source any day. (edit) Now, for comparison's sake, you'd have to try and apply that same rigour to MS Windows or MacOS/iOS...
    - MisterWebz 13y ago
      Would we be able to detect any suspicious activity on our closed source operating system, or would a backdoor implemented specifically for intelligence agencies allow undetectable communication between hosts?
      - nathan_long 13y ago
        If you care, you can watch every packet being sent and received. If the OS is open, you can figure out where they came from.
        flyinRyan 13y ago
        So you've compiled your entire OS from source with a compiler you verified to be safe? Because if you use a prebuilt OS how do you know it isn't already "root kitted" to not show certain traffic?
        MisterWebz 13y ago
        > "root kitted" to not show certain traffic That's what's bothering me. How feasible would it be to implement something like that on a massive scale and people not finding out? And how about using your router to deny incoming and outgoing traffic unless it's whitelisted? Is there some way for the router to identify the service that sent out a packet and deny or allow it or at least "scan" the content and make sure nothing malicious is being received or sent?
      - vidarh 13y ago
        We probably would be able to. But consider that the "backdoor" can be incredibly sneaky. Look up the claimed "Crypto AG" attack, which involved pre-internet crypto devices. The claimed way it worked was to include the key or enough data to allow decryption in the transmitted message in some form. NSA wouldn't need something to contact their data centres and leak the information, because presumably they can tap some fiber connection or other your data ends up travelling to. All they'd need would be a slow leak of your keys. Even, say, just a few of tweaked data per packet, or tacked on to a file format that is resistant to it, so that they can pick up key information together with the data stream, and they're good. Or even just intentionally introducing a specific way of generating keys, known to the with sufficient precision to allow them to reduce the key space enough that brute forcing the remaining bits is feasible. For a conceptual example, look up the old Netscape SSL vulnerability (Netscape's SSL used to rely on factors like the host time and pid, that especially on a typical Unix-y system also running services like mail servers that often would include the pid of of the delivery agent in headers etc., was extremely easy to narrow down) It's difficult to do this in a way that can't/won't sooner or later be discovered, but given the number of likely unintentional mistakes that have been made that still have taken in some cases years to be discovered (publicly at least), it's plausible that there are intentional flaws in at least some software to make it possible for specific parties to be intended to be able to break it.
    - huhtenberg 13y ago
      You are comparing apples to oranges. The OS being inherently untrustworthy forces you to operate under the assumption that it is tracking you and that it does have backdoors. So instead of focusing on weeding out any rootkits or backdoors, you'd be putting the OS under external scrutiny, including filtering all of its network traffic on a separate device. If, on the other hand, you let yourself get convinced that a stock Debian installation is more likely than not to be "clean", then you just lost your edge and any interested party can waltz in with a truckload of rootkits and you wouldn't even think to care. This whole "open source is more trustworthy" mindset is really quite dangerous.
      - TheLegace 13y ago
        I don't understand how it's apples an oranges. So your telling me right now the choice between Windows, OSX and Linux and the choice for security is somehow ambiguous? Both Microsoft and Apple have been directly passing data to the NSA. Where are the data leaks from Linux or other open source software. Open source software is a lot harder to control, not only do you have people with principles in play, your gonna have a tough time gaining control over decentralized systems. Just remember if someone(like the NSA or any other skilled hacker) wants to get on to your computer they will, with enough time anything can be broken. So whats the solution let's pick Windows and never look back.
  - thex86 13y ago
    Where does a distribution like Debian stand? Can the people who upload packages do something fishy and not get caught? Not that I doubt their intention, but let's assume a developer is forced to do it by say his state or through some other coercion?
- nikster 13y ago
  Avoid web services is hardly practical advice. The whole reason people use computers is the internet. And for that of course they don't need risky back doors (which some security researcher would find sooner or later). They just control a few central exchanges and done.

ekianjo 13y ago

It's not just the US Web services, the traffic anyway goes through the US and can be intercepted.

toomuchtodo 13y ago
HTTPS/SSL with perfect forward secrecy
sneak 13y ago
Germany-to-Germany traffic does not go through the US.
- ekianjo 13y ago
  You might as well make a closed Internet for Germany only... The point of the Internet is to be global in the first place.
  - sneak 13y ago
    Every country already has a closed internet for their own domestic use. It's called the internet. This makes the article relevant: "Stop using US services."
  - deleted 13y ago
    [deleted]

kimlelly 13y ago

And some general advice to keep more of your privacy: 1. Use an open source operating system. 2. Communicate over RetroShare: https://news.ycombinator.com/item?id=5983913 https://news.ycombinator.com/item?id=5983913

zby 13y ago

The journalist forgets that tapping into the cables only works for unencrypted traffic - this is actually the reason that NSA bothered Google and others in the first place.

voidlogic 13y ago
And you know the NSA hasn't been given or stolen SSL private keys of major players? Most big sites don't use forward perfect secrecy making MITM achievable.
- sneak 13y ago
  MITM always unambiguously refers to an active attack. That's not what they do or have ever done. It stands for man-in-the-middle. They aren't in the middle when they tap fibers. Lack of forward secrecy ciphersuites does allow for retroactive decryption upon server secret key compromise though, which is what I assume you meant.

whiskeychaser 13y ago

Like the NSA is limiting itself to just the US? C'mon, if they can do it here without anyone knowing why would they stop at our borders/servers?

BrandonMarc 13y ago
Exactly. The NSA's purpose for existence is to intercept communications of non USA citizens outside USA borders. Right or wrong, it's simply why they exist in the first place. The current scandal is due to how much they do it to USA citizens within USA borders ... without getting into the right or wrong of it, the latter is against the Constitution, while the former is not.
- robin_reala 13y ago
  That might be the focus of the scandal in the US, but it certainly isn’t in the EU.
  - sneak 13y ago
    Yeah. If Google/AWS/AWS-hosted companies/Apple/Microsoft/Facebook know what's good for them, they'll quickly do literally everything they can to force the US government to stop this foolish bullshit. They have far more non-US-citizen customers than they do US-citizen customers.
  - dragonwriter 13y ago
    > That might be the focus of the scandal in the US, but it certainly isn’t in the EU. Its the focus of the leak which is at the heart of the scandal (and the leaker is not someone for whom the NSA spying on purely foreign traffic would be remotely problematic or noteworthy.) But it would be a mistake to content the focus of the leak with the overall scope and focus of the NSA's intelligence gathering efforts.

mhd 13y ago

Expect lots of new Samwer copy/paste startups if people actually care in the end.

ianstallings 13y ago

This is not going to help. But we now see how the fall out from this scandal will affect us. When I build my next API or service will people around the globe use it? Or will they be skeptical and decide to roll their own or go with an offshore competitor? Very irritating.

blueprint 13y ago
Much of your offshore traffic may well pass through US-Europe trunks anyway, so any web service will find it difficult or impossible to avoid this problem.
- furyg3 13y ago
  Yes, but as someone who makes IT decisions for an organization outside the US, it's still a factor. When evaluating services, one factor is "Do they use sound security principles?" Does their API use SSL? How does authentication work? How is my information stored? Etc. Another factor is "Do I trust them with my data?" This has a lot to do with the company's track record, business model, and of course their location. Where are they? What are the privacy laws like there? What is the level of corruption? If government agencies (and their subcontractors) can go to my service provider and secretly demand sweeping access to any "foreigners data", without any sort of due process, why would I do business with that company? I think I'd rather go with a company in a country with strong privacy protections, even for non-citizens, and take my chances with best practices for securing data on the wire. Due process and strong privacy protections are a competitive advantage for a country... The US is royally screwing it's own tech sector with these policies.
  - ianstallings 13y ago
    Yes so true. People will still be spied and what is truly harmed by this spying revelation is US commerce itself. In a global economy you don't want to be known for being untrustworthy.
BrandonMarc 13y ago
I believe this may be very helpful. If enough Europeans stop / limit using Google services, then Google's stock price on Wall Street will see the consequences. Google has powerful lobbyists on Capitol Hill, and they will use their influence to change the playing field such that they either don't have to cooperate as much, or can be more transparent about the cooperation. Either option, or both, would help polish the tarnish on Google's reputation due to this. Perhaps this is wishful thinking ... kinda like believing Europeans, Asians, etc will build their own Google-replacement ... but it's small a reason for hope, all the same.

lazyjones 13y ago

Such short-sighted outcries do not help. He should first consider asking people to stop using US-made, closed source operating systems. Then he should ask Germany's secret service (BND) what they are doing with the data from DE-CIX (e.g. sharing with the NSA ...).

flyinRyan 13y ago
Of course it fucking helps. Every step helps. Your suggestion is so useless to be irritating. "Oh, we can't say anything because there might be some asshole on the internet who could make it sound hypocritical. We best just keep doing fuck all because that's worked so well thus far".
- lazyjones 13y ago
  It does not expletive help to make the problem sound smaller than it actually is, which is precisely what he did with his dumb advice.

Fuxy 13y ago

I say block all US services in EU. It will be inconvenient as hell and incredibly annoying but it will give European companies a chance to fill the void. And yes I know it can be bypassed but jumping through hoops is always annoying and if European alternatives show up people would be less likely to bother. I would do it just to see what happens :)

gst 13y ago
Censorship is always the solution. Because the user does not know what he wants. Is this what you want to say?
- Fuxy 13y ago
  Face it there is already censorship and people pretending its for a noble cause like to prevent piracy or child porn or whatever I'm just taking it to its logical next step. Protecting your countries users from foreign spying. Edit: I'm not saying its right but if we're already doing the wrong thing why not make it entertaining and beneficial to local business.
  - mc32 13y ago
    So you're saying if other countries' data traffic did not pass through the US the US would be unable to set-up some shop over there to syphon data? And A US company could not be allowed to buy an EU company? It's all shortsighted and all these 'measures' could be overcome, if there's incentive for it.
    - Fuxy 13y ago
      I would love to see the US try to set up shop in the EU in order to spy on its citizens. Now that would be an entertaining international incident. A US company not being able to buy a EU company is an interesting side effect that may promote diversity and innovation. Have you heard of speciation? Also everything can be overcome however it would make it considerably more difficult for the US to conduct mass surveillance on EU citizens.

deleted 13y ago

[deleted]

alan_cx 13y ago

Since the UK is acting as the USA's slurp gateway, I reckon the Germans should be having a word with us. Also, if the EU wants to block the US in what ever way, its going to need to block the UK too, since it will side with the US.

claudius 13y ago
Hopefully you’re going to take care of that yourself after the next election.
- muyuu 13y ago
  If you're talking about the EU in/out in the UK I'm looking forward to it, but the EU will resist to it even happening. Nothing scares the EU more than the threat of a popular consultation.
- Nursie 13y ago
  If you think the rather bovine electorate of any of our great western nations will either remember or figure out why they should give a crap... well you have a lot more faith in humanity than I have left.
  - claudius 13y ago
    The rather bovine electorate of the UK prefers to leave the apparently over-regulating, wasteful and generally evil EU, which would then would make it far easier to impose restrictions on UK services. Given that the UK already contributes nearly nothing to the EU budget and economy (apart from an oversized banking sector in no small part responsible for the current financial crisis), the remaining countries will not seriously resist the UK leaving. De Gaulle really was right from the start :)
mc32 13y ago
It's either naivete or posturing. All major gov'ts intercept each other's traffic and do espionage (industrial or intelligence) on each other. It's a kind of gentleman's agreement. We know you spy on us, you know we spy on you, but let's pretend we don't, publicly, and if something becomes public (one of us is careless), act outraged and protest. (the Lady doeth protest too much)

blueprint 13y ago

Idealistic and hypocritical. That is advice aimed at diverting attention from the full scope of surveillance occurring on the people of Germany.

flyinRyan 13y ago
Actions have to be taken. Germany is spying on its citizens. The US is spying on everyone. It's pretty obvious where the priority should be here. Man I'm so sick of any fucking action anyone suggests getting met by a bunch of morons pointing out how it might be "hypocritical". Who gives a fuck?
- blueprint 13y ago
  Because the US' problem originated in hypocrisy. This world will only change into one that is for the living people when everything that is in truth and falsehood is revealed. To engage in action that is connected to falsehood is to make a relationship with falsehood. To do so under the guise of acting to solve these problems makes oneself a hypocrite.

antr 13y ago

At work we've already had this discussion regarding the location of the web apps we use. Not because we manage "highly sensible" data, but because this entire situation bothers us at many levels. Although not 100% decided, the "biggest" change we are planning is to move all of our Google Apps email/server to a private mail server located here in Europe + encryption for all. This is a relatively easy transition. A tougher change is finding (if it exists) a Box alternative.

kimlelly 13y ago
> A tougher change is finding (if it exists) a Box alternative. Depending on your needs, RetroShare might be the one: http://retroshare.sourceforge.net/ http://retroshare.sourceforge.net/
olegp 13y ago
Have a look here: https://starthq.com/apps/?category=collaboration https://starthq.com/apps/?category=collaboration We just added the country where each SaaS app is hosted, so you should be able to find some EU based alternatives to Box quickly.
davidw 13y ago
Spam filtering is also something that Gmail does pretty well. If you've got a public email address that's 'out there', a serious spam solution is pretty important.
- griffordson 13y ago
  Unless of course you consider multiple daily SEO spams, "spam". Because GMail doesn't filter those at all. Even emails that are worded exactly the same but sent from a different source GMail address.
- mjn 13y ago
  I've been not very happy with Gmail's spam filtering, though I admit it's hard to do right. But its false positives were the main reason I moved away from it. The last straw was when they spam-filtered an email from my landlord because it contained some Danish text in it (I live in Denmark!). I eventually found it in my Spam folder (which I thereafter had to check regularly) with the explanation that it was filtered because "It's written in a different language than your messages typically use."

k-mcgrady 13y ago

I have started doing this with some services and there were good alternatives available. But for search I can't find one. I tried DuckDuckGo for a few weeks but the results were awful compared with Google. Can anyone recommend a good, more secure alternative to Google?

kimlelly 13y ago
> ...recommend a good, more secure alternative to Google? https://startpage.com https://startpage.com has currently the best results, IMO.
- junto 13y ago
  ^^ This ^^ has just been added to my favourites bar. I'll give this a go, and if I like it, I'll be removing Google. Thanks for the tip!
MikeCapone 13y ago
While I dislike the design and am not entirely comfortable with the idea of making ad money off Google (well, Google takes its share) by just wrapping their products, this site gives you Google results but without giving Google much to identify or track you: https://startpage.com/ https://startpage.com/
ytodo 13y ago
plug your babelfish and try yandex.ru wink when you search for a flower maybe, there isn`t any porn, when you search for porn you will find anything you prefer lol let me (the troll) qoute What does some people have the rewards for, when spreading informations wich appeal to the "simple men"-iniquities-being ? one simple but conspiracy answer sounds like: when the rich and mighty want their life undisturbed and more feudal, and the "simple men" be in a block, the rich just needs a reason to deploy the long time up-builded-defense against the people so, dont let`em polarize you, dont give`em the possibility to get us that easy.
reeses 13y ago
Keep using DDG and give feedback. Make an investment of your time with a slightly worse solution with a longer range goal of having a better solution later.

xedarius 13y ago

Just out of interest, given the revelation that the UK is tapping underwater fibres, anyone know if they have a plan to stop doing it? Or they just going to carry on? If they do decide to stop, how do we check?

tyang 13y ago

Stop using Google, Microsoft, Yahoo, Facebook, Amazon and Apple? And how's that Baidu filter working for ya?

a3n 13y ago

No such action will have any direct effect on surveillance. I think it's clear by now that the NSA hoovers everything, regardless of citizenship or location. But if it has an economic effect, that might get someone's ear. So yeah, shun US data companies, it may compel the NSA to at least be a little more transparent.

flyinRyan 13y ago
Are you saying the NSA is spying even on traffic that never goes near the USA? That would be one of the biggest claims so far. EDIT: appears the claim isn't as big as I thought, though I'm surprised that's not the case!
- pilsetnieks 13y ago
  A lot of Internet traffic is routed through the US, not because it's the closest geographically but because the fattest pipes and the lowest transfer prices may be there. One of the original leaked slides illustrates that pretty good.
- dragonwriter 13y ago
  > Are you saying the NSA is spying even on traffic that never goes near the USA? That would be one of the biggest claims so far. Foreign signals intelligence is the whole point of the NSA [1]. The only reason their spying on domestic traffic is controversial is that, unlike purely foreign traffic, there is a history of abuse of surveillance for domestic political purpose which has produced both laws imposing limits on and public expectations of restraint with regard to domestic surveillance. So, no, the NSA spying on purely foreign traffic with no domestic nexus wouldn't be "one of the biggest claims so far", it would be exactly what the NSA exists to do and a non-issue. It would be news if the NSA wasn't spying on purely foreign traffic, not if it was. [1] From http://www.nsa.gov/ http://www.nsa.gov/ : "The NSA/CSS core missions are to protect U.S. national security systems and to produce foreign signals intelligence information."
  - flyinRyan 13y ago

BjoernKW 13y ago

Funny thing is, this is coming from a politician who usually shows no qualms when it comes to invading people's privacy. If anything, he's merely envies the NSA for its extensive surveillance capabilities. If German politicians really wanted to do something they could to do so easily by granting asylum to Edward Snowden.

HSO 13y ago

Stop using US services?! That's where I started but as of today, I'd go even further: * Americans no longer welcome in Europe; you think you can spy on us, torture people, kill innocents, trample over longstanding diplomatic conventions to ground a president of a country, put the full might of your police state to hunt down your own freedom fighters, and then come here and have a good time or do business? Think again. US citizens not welcome here anymore!!! You can do what you want in your country, but don't come here if you don't respect our way of life and our privacy. * Let's kick the Brits out of the EU (they don't seem to be too happy in there anyway); they are basically just a foothold for the American fascists in the EU and do their bidding * Let's not stop at moving our own email and social accounts to European providers. Refuse to accept emails coming from gmail, yahoo etc. domains! Send automatic replies that explain why and suggesting ways what is acceptable. The point is: The US electorate and businesses are either pro surveilling the whole world, even their own allies, or they are lethargic and indifferent. If the former, we should draw the consequence and stop having contact and exchanges with them. If the latter, we should increase the cost of doing nothing. Hurt them the only way we, as citizens of the world without a voice in the American police state, can hurt them: In their pocket and in their options to travel and have fun. America is always so happy lecturing the world about democracy. Well then, now you can show us which way the wind really blows in America and its relation with the world.

chris_mahan 13y ago
I am a US citizen, and I approve this message.
- logical42 13y ago
  I am a US veteran, and I also approve of this message.
glasz 13y ago
i promise you one thing: eu soil isn't really better. they exchange (or at least want to and i don't see those fascists not doing it) air passenger data with foreign countries without your or my consent.
13y ago

sbmassey 13y ago

The only way to stop this kind of thing is to restrict the size of your sovereign nation to a size where the citizenry can actually have some idea what their state is doing ... maxing out at a million or so, say: you dont see governments like Iceland or the Swiss cantons acting in this kind of out-of-control manner.

elchief 13y ago

"Can you think of a single European search engine?" Yandex.

malandrew 13y ago

They should go one step farther. I would love to see Germany set up a program to woo American tech talent to Germany to work on anti-surveillance systems. Make it a no strings attached program. All you need to do is move to Germany and work with software/hardware that ensures secrecy. You would be given assistance to either join an existing company or set a new one up. Your choice. Financing would also be made available to build anti-surveillance startups.

weland 13y ago
If they start it, count me in.
- malandrew 13y ago
  If someone is in Germany and has access to the right ears in government, you should pitch this idea. I would love to see some country champion any and all startups and open-source technologies that promote decentralization. We need more projects out there that are consumer friendly and use DHT based solutions like Kademlia for mutually shared data.
mbillie1 13y ago
I would _strongly_ consider doing this, if there were offers on the table.
ippisl 13y ago
I wonder if a kickstarter funding would work in this case, especially since open-source is considered a requirement for good privacy software.

DanielBMarkham 13y ago

This might be a good time to remind the angry mob that other nations spy just as much, or more so, than the US. The US just got caught. This is like the secret of the atom bomb. Once it's out, it's out. No pretending that it doesn't exist any more. Guess what? What you put on the wire is fair game for any of scores of different intelligence agencies. No, not usually the criminal law enforcement folks, but the spy guys. And most of the politicians in these countries don't know. In fact, for a program like this to be effective, very few people should know. You can't put that genie back in the bottle by getting mad at the US and pulling your data out. (Not that I blame you. Might make a fine protest. It just does nothing to ensure your privacy and anonymity) In fact, you could actually be opening your data up to even more abuse. Who knows? The world needs to decide once and for all whether to make this data completely transparent and accessible to all, or an international crime to collect. Pretending this is a USA-only problem is just another way of sticking your head in the sand.

dragonwriter 13y ago
> This might be a good time to remind the angry mob that other nations spy just as much, or more so, than the US. Probably not "as much"; quantity of spying is limited by quantity of resources available for spying, and the US probably outspends most other nations (quite likely, as with military spending more generally, at or near the amount of all other nations combined) on spying.
- moheeb 13y ago
  It is so cheap to collect and store nowadays that your argument won't be true for long, if it even still is.
  - dragonwriter 13y ago
    This is true, perhaps, of voluntary collection of data from cooperative partners, which is, to be sure, one of the controversial aspects of the NSAs domestic surveillances that has come out, but hardly the limit of the NSA's spying. It will continue to require resources to collect information from people who are trying to prevent you from having it.

anigbrowl 13y ago

I'm somewhat amused by the grammatical error in this headline.

lars 13y ago

I work in a European branch of one of the very large tech consultancies, and I know that decisions to this effect have been made in several of the countries we operate in. There's a lot of money that isn't being funneled to Amazon and the like because of this.

pekk 13y ago
Also avoiding the UK and France? Probably not. Why not? Because this isn't really about surveillance, it is about an excuse to boycott the US.

embolism 13y ago

This is the same Germany that issues mandatory RFID based national ID cards, and requires all citizens to register with the police when they change residences?

seanmcdirmid 13y ago

Why doesn't Europe just block US services for "national security reasons?" Like say...china does. I have to admit, this puts china's blocking in a completely new light...they might have a real argument if I didn't already know they just want to spy on us themselves.

noiv 13y ago

German here. All these after Snowden proposals from German government or opposition are fake. Either they call it a Hollywood fantasy, want to escalate it to the EU or now ignore snooping happens at the cable. The day anybody proposes encryption to the public I'll consider to start voting again. And regarding some other comments here, I think it's a stretch calling a country democracy, if the voter turnout is below 50%.