6 ms·
1. Since the U.S. government has given itself both the power to compel U.S. corporations to spy for them and the power to prevent them from revealing this, we c
by beloch 13y ago
1. Since the U.S. government has given itself both the power to compel U.S. corporations to spy for them and the power to prevent them from revealing this, we can't take the claims of any U.S. corporation at face-value.
2. DuckDuckGo is a U.S. based company.
- nolok 13y agoAnd that's really all there is to it. That's why you don't build secret courts, secret orders, and gag orders.
- blumentopf 13y agoProblem is, even if DDG would be hosted in, say, Europe, the NSA would still be able to snoop on the traffic. As has been recently revealed, the German BND may siphon off up to 20% of the traffic at DE-CIX (Internet exchange in Frankfurt) and on average siphons off 5% [1]. The BND closely cooperates with the NSA. As we've seen in the last couple of weeks, Europe is basically a US colony and Germany in particular is not a true sovereign state. [2] What to do? Host in Russia, Latin America? (Disclosure: I am German and DDG is my default search engine.) [1] http://h-online.com/-1909989 http://h-online.com/-1909989 [2] http://sz.de/1.1717216 http://sz.de/1.1717216
- brown9-2 13y agoA foreign intelligence agency like the NSA actually needs less of a legal framework to spy on a foreign company as opposed to a domestic one. It's sort of the whole point of a foreign intelligence agency, not respecting the laws of other countries.
- jwr 13y agoWell, yes. But let's get back to the point of the original post in this thread. There are two problems: 1) we can't trust the networks that our data travels over and 2) we can't trust US-based companies with our data. The first problem is fairly easily dealt with (encrypt and authenticate), while the second one is much worse. A company based in a country that does not have laws enabling agencies to snoop on and prevent the disclosure of said snooping would automatically be more trustworthy than any US-based company.
- wslh 13y agoI do not think (1) is solved with cryptography because you can spy on the traffic flow and the route and timing of the connections give extra information. To overcome this we need extra measures.
- pekk 13y agoIf we are not being naive, you can't trust China-based or Russia-based companies with your data...
- gcb0 13y agoOr French, or German, or Australian, or... Pretty much everyone?
- criley2 13y ago> A company based in a country that does not have laws enabling agencies to snoop on and prevent the disclosure of said snooping would automatically be more trustworthy than any US-based company. The ultimate irony is that by using providers in a country that spies and is unwilling to admit, over a country that spies and is willing to admit, is that you're forgoing the "trustworthy" spying country in favor of the "untrustworthy" spying country. You know the US spies. How much do you really know about the ones that are staying nice and quiet right now? I didn't realize secrecy equated with trustworthiness.
- phreeza 13y agoHow about a country which doesn't spend trillions on spying and thys probably doesn't have capacities anywhere close to those of the US, secret or not.
- criley2 13y agoDon't fool yourself. Every tech-averse third world middle eastern country can control and tap into the fiber in their infrastructure. And if they can, anyone can. It's not egregiously expensive or difficult to do.
- wisty 13y ago> A foreign intelligence agency like the NSA actually needs less of a legal framework to spy on a foreign company as opposed to a domestic one. It's sort of the whole point of a foreign intelligence agency, not respecting the laws of other countries. That's why the NSA has links to UK and Australian intelligence agencies. They can "share" intelligence (as in, let the other guys spy on their people). I wouldn't be surprised if the NSA didn't have people on sequester to foreign agencies, but still based in the US, doing nothing but spying on US citizens and passing the information to the NSA (plus giving a few tidbits to the foreign agency, to justify the sequester); as a legal loophole.
- grhino 13y agoDDG searches are delivered over HTTPS. It doesn't matter if the NSA can siphon off DDG traffic.
- shawnz 13y agoHow unreasonable is it that DDG could have their private key taken by the NSA?
- cabalamat 13y agoI expect the NSA does this as a matter of course, at least for large enough companies.
- ville 13y agoIt does matter and the article has reasoning about why it does. "The NSA could get the DuckDuckGo master cert in one of three ways: 1. Be given the cert 2. Physical access to servers or load-balancers 3. Remote access to servers or load-balancers"
- grhino 13y agoIf they can get direct access to the DDG servers, then it doesn't matter if they can siphon off traffic at the ISP level. They can just access the data.
- ville 13y agoBut wouldn't that require constant access to the server, whereas the key they could steal once with short access to server and use until it expires without the victim noticing?
- WatchDog 13y agoWell the point raised by the article is that HTTPS doesn't matter much if the certificate is compromised.
- comrade1 13y agoWhy not Switzerland? http://m.washingtonpost.com/business/technology/after-prism-reports-swiss-data-bank-sees-boost/2013/07/08/cc8dfe14-e569-11e2-aef3-339619eab080_story.html http://m.washingtonpost.com/business/technology/after-prism-...
- eps 13y agocomrade1, you are hell-banned.
- EGreg 13y agoActually a company based out of US jurisdiction and using TLS certs should be "safe" to use assuming they don't voluntarily share your info with any governments. It is expo exponentially harder to compel a country to compel a company to give up info. Or you an use Off The Record Messaging which has perfect forward secrecy.
- hannibal5 13y agoIf, say NSA and BND co-operate, NSA listens all but Americans and BND listens all but Germans and both exchange information. Everything is covered.
- gizmo686 13y agoDo we have any evidence the US asked any corporations to spy? The only instances I am aware of of the US asking corporations for help was requesting/ordering access to data the the company was already collecting.
- mcantelon 13y agoAT&T, for one. http://news.cnet.com/8301-13578_3-57581161-38/u.s-gives-big-secret-push-to-internet-surveillance/ http://news.cnet.com/8301-13578_3-57581161-38/u.s-gives-big-...
- prostoalex 13y agohttps://www.eff.org/nsa-spying https://www.eff.org/nsa-spying
- api 13y ago3. It would be almost trivial for the U.S. government to snoop on DuckDuckGo's traffic at the switch or cloud provider level even without informing DuckDuckGo of this. I believe they host at EC2 East, which is in DC and a major U.S. government linked hosting provider (see Amazon FedRamp). The cloud is not private, period.
- mtgx 13y agoOh, I'm sure they can easily collect the traffic. I think any secure service needs to be made with that in mind now. But the question is if they can get the data unencrypted.
- api 13y agoEven if they're getting it encrypted, they can still learn a lot from correlations of addresses and times and such.