5 ms·
Problem is, even if DDG would be hosted in, say, Europe, the NSA would still be able to snoop on the traffic. As has been recently revealed, the German BND may
by blumentopf 13y ago
Problem is, even if DDG would be hosted in, say, Europe, the NSA would still be able to snoop on the traffic. As has been recently revealed, the German BND may siphon off up to 20% of the traffic at DE-CIX (Internet exchange in Frankfurt) and on average siphons off 5% [1]. The BND closely cooperates with the NSA. As we've seen in the last couple of weeks, Europe is basically a US colony and Germany in particular is not a true sovereign state. [2] What to do? Host in Russia, Latin America?
(Disclosure: I am German and DDG is my default search engine.)
[1] http://h-online.com/-1909989 http://h-online.com/-1909989
[2] http://sz.de/1.1717216 http://sz.de/1.1717216
- brown9-2 13y agoA foreign intelligence agency like the NSA actually needs less of a legal framework to spy on a foreign company as opposed to a domestic one. It's sort of the whole point of a foreign intelligence agency, not respecting the laws of other countries.
- jwr 13y agoWell, yes. But let's get back to the point of the original post in this thread. There are two problems: 1) we can't trust the networks that our data travels over and 2) we can't trust US-based companies with our data. The first problem is fairly easily dealt with (encrypt and authenticate), while the second one is much worse. A company based in a country that does not have laws enabling agencies to snoop on and prevent the disclosure of said snooping would automatically be more trustworthy than any US-based company.
- wslh 13y agoI do not think (1) is solved with cryptography because you can spy on the traffic flow and the route and timing of the connections give extra information. To overcome this we need extra measures.
- pekk 13y agoIf we are not being naive, you can't trust China-based or Russia-based companies with your data...
- gcb0 13y agoOr French, or German, or Australian, or... Pretty much everyone?
- criley2 13y ago> A company based in a country that does not have laws enabling agencies to snoop on and prevent the disclosure of said snooping would automatically be more trustworthy than any US-based company. The ultimate irony is that by using providers in a country that spies and is unwilling to admit, over a country that spies and is willing to admit, is that you're forgoing the "trustworthy" spying country in favor of the "untrustworthy" spying country. You know the US spies. How much do you really know about the ones that are staying nice and quiet right now? I didn't realize secrecy equated with trustworthiness.
- phreeza 13y agoHow about a country which doesn't spend trillions on spying and thys probably doesn't have capacities anywhere close to those of the US, secret or not.
- criley2 13y agoDon't fool yourself. Every tech-averse third world middle eastern country can control and tap into the fiber in their infrastructure. And if they can, anyone can. It's not egregiously expensive or difficult to do.
- rhizome 13y agowhile the second one is much worse It may be "worse" in a variety of senses, like political tenability, but the solution is simple: bring data given to third parties under the 4th Amendment, which is the entire underpinning of companies being able to give your packets to the government willy-nilly. Well, not willy-nilly, the government pays for the privilege. The problems with passing a privacy law that attaches to data given to third parties, like is done in many countries with higher standards of living than the US, are not the citizens' problems. Political tenability is a problem for politicians, but that is of zero consequence. If the populace wants (for some measurable quantity of want) this to happen, politicians will either make it happen or lose their careers or lose their heads to pikes (as has happened throughout history). However, politicians are counting on people having low self-esteem and taking "no" for an answer. It's not the citizen's duty to be cowed by their laziness and bad hearts, though.
- wisty 13y ago> A foreign intelligence agency like the NSA actually needs less of a legal framework to spy on a foreign company as opposed to a domestic one. It's sort of the whole point of a foreign intelligence agency, not respecting the laws of other countries. That's why the NSA has links to UK and Australian intelligence agencies. They can "share" intelligence (as in, let the other guys spy on their people). I wouldn't be surprised if the NSA didn't have people on sequester to foreign agencies, but still based in the US, doing nothing but spying on US citizens and passing the information to the NSA (plus giving a few tidbits to the foreign agency, to justify the sequester); as a legal loophole.
- grhino 13y agoDDG searches are delivered over HTTPS. It doesn't matter if the NSA can siphon off DDG traffic.
- shawnz 13y agoHow unreasonable is it that DDG could have their private key taken by the NSA?
- cabalamat 13y agoI expect the NSA does this as a matter of course, at least for large enough companies.
- ville 13y agoIt does matter and the article has reasoning about why it does. "The NSA could get the DuckDuckGo master cert in one of three ways: 1. Be given the cert 2. Physical access to servers or load-balancers 3. Remote access to servers or load-balancers"
- grhino 13y agoIf they can get direct access to the DDG servers, then it doesn't matter if they can siphon off traffic at the ISP level. They can just access the data.
- ville 13y agoBut wouldn't that require constant access to the server, whereas the key they could steal once with short access to server and use until it expires without the victim noticing?
- WatchDog 13y agoWell the point raised by the article is that HTTPS doesn't matter much if the certificate is compromised.
- comrade1 13y agoWhy not Switzerland? http://m.washingtonpost.com/business/technology/after-prism-reports-swiss-data-bank-sees-boost/2013/07/08/cc8dfe14-e569-11e2-aef3-339619eab080_story.html http://m.washingtonpost.com/business/technology/after-prism-...
- eps 13y agocomrade1, you are hell-banned.
- EGreg 13y agoActually a company based out of US jurisdiction and using TLS certs should be "safe" to use assuming they don't voluntarily share your info with any governments. It is expo exponentially harder to compel a country to compel a company to give up info. Or you an use Off The Record Messaging which has perfect forward secrecy.
- hannibal5 13y agoIf, say NSA and BND co-operate, NSA listens all but Americans and BND listens all but Germans and both exchange information. Everything is covered.