3 ms·

> how are they getting all Facebook private messages and Gmail? Perhaps you missed the news about PRISM? :)

by znowi 13y ago

jgrahamc 13y ago
This presentation is from 2008. According to the presentation on PRISM Facebook joined the program on 3 June 2009. That would indicate that the searches here are based, most likely, not on participation by Facebook but by passive sniffing of HTTP traffic and then session reconstruction.
- RyanZAG 13y ago
  In 2008 Facebook ran on HTTP, so back then it would have been easy to sniff this data. I believe Gmail also transferred in plain text back then. When those companies switched to HTTPS, the NSA likely 'leverage some pressure' to get them to join PRISM, which puts the data back in this system.
  - martin_k 13y ago
    You've got your timeline wrong. Facebook didn't support HTTPS for anything but user login until 2011. [0] https://www.facebook.com/blog/blog.php?post=486790652130 https://www.facebook.com/blog/blog.php?post=486790652130
- duaneb 13y ago
  > That would indicate that the searches here are based, most likely, not on participation by Facebook Gag warrants existed before PRISM. EDIT: "National Security Letters"
- madaxe 13y ago
  Around about the time when people started rolling out SSL as standard. That'd make sense, as they'd need to move their beam-splitters (prisms!) to behind the SSL endpoints. I think PRISM is just the public-private partnership aspect of this, where they have to go to service providers and install kit, as they can't tap SSL traffic.
- mpeg 13y ago
  From the screenshots it's obvious that the captured data is an HTTP form submission in facebook. So they didn't have access to private messages, they just intercepted internet traffic and relied on it being unencrypted. Facebook didn't always enforce https by default like it does now
minwcnt5 13y ago
PRISM allows them to retrieve individual users' messages via a FISA court order. It doesn't allow analysts to instantly obtain private data for any user they want. :)
jervisfm 13y ago
With regards to the data collection, the thing to realize (which I did so myself) is that email truly is the glue that ties together most internet services. Take facebook for example. By default, almost any and all activity on the site is catalogued for you by email -- for your convenience. Someone mentioned you in an update, you get a notification. A friend sent you a private FB message, you can an email notification with the content in line (even with the support of replying to message via email as well). Now, because email traffic on the internet is not encrypted by default, one is able to piece together the contents of communications just by looking at the email. Essentially anything that you receive via email (e.g. password reset links; credit card statement summaries etc) is subject to capture and analysis. Given this, it may make sense to perhaps disable (potentially sensitive) email notifications as a workaround around this particular collection method.

> how are they getting all Facebook private messages and Gmail? Perhaps you missed the news about PRISM? :)

by znowi 13y ago

> how are they getting all Facebook private messages and Gmail? Perhaps you missed the news about PRISM? :)

This presentation is from 2008. According to the presentation on PRISM Facebook joined the program on 3 June 2009. That would indicate that the searches here are based, most likely, not on participation by Facebook but by passive sniffing of HTTP traffic and then session reconstruction.

RyanZAG 13y ago
In 2008 Facebook ran on HTTP, so back then it would have been easy to sniff this data. I believe Gmail also transferred in plain text back then. When those companies switched to HTTPS, the NSA likely 'leverage some pressure' to get them to join PRISM, which puts the data back in this system.
- martin_k 13y ago
  You've got your timeline wrong. Facebook didn't support HTTPS for anything but user login until 2011. [0] https://www.facebook.com/blog/blog.php?post=486790652130 https://www.facebook.com/blog/blog.php?post=486790652130
duaneb 13y ago
> That would indicate that the searches here are based, most likely, not on participation by Facebook Gag warrants existed before PRISM. EDIT: "National Security Letters"
madaxe 13y ago
Around about the time when people started rolling out SSL as standard. That'd make sense, as they'd need to move their beam-splitters (prisms!) to behind the SSL endpoints. I think PRISM is just the public-private partnership aspect of this, where they have to go to service providers and install kit, as they can't tap SSL traffic.
mpeg 13y ago
From the screenshots it's obvious that the captured data is an HTTP form submission in facebook. So they didn't have access to private messages, they just intercepted internet traffic and relied on it being unencrypted. Facebook didn't always enforce https by default like it does now

minwcnt5 13y ago

PRISM allows them to retrieve individual users' messages via a FISA court order. It doesn't allow analysts to instantly obtain private data for any user they want. :)

jervisfm 13y ago

With regards to the data collection, the thing to realize (which I did so myself) is that email truly is the glue that ties together most internet services. Take facebook for example. By default, almost any and all activity on the site is catalogued for you by email -- for your convenience. Someone mentioned you in an update, you get a notification. A friend sent you a private FB message, you can an email notification with the content in line (even with the support of replying to message via email as well). Now, because email traffic on the internet is not encrypted by default, one is able to piece together the contents of communications just by looking at the email. Essentially anything that you receive via email (e.g. password reset links; credit card statement summaries etc) is subject to capture and analysis. Given this, it may make sense to perhaps disable (potentially sensitive) email notifications as a workaround around this particular collection method.