6 ms·

> edit: Gmail messages must only be captured when they leave the Google network. It seems easier for the NSA to tap datacenter <-> datacenter fiber links insid

by semenko 13y ago

> edit: Gmail messages must only be captured when they leave the Google network. It seems easier for the NSA to tap datacenter <-> datacenter fiber links inside Google's network. Why worry about decryption when you can have Google's frontend servers do it for you?

MrKurtz 13y ago
Why would Google (or anyone) link to them directly? with fiber no less! this stuff is alarming enough no need for FUD. This XKS business seems about intercepting non-encrypted traffic as the references to HTTP payload quoted in the article would suggest.
- semenko 13y ago
  (Keep in mind these slides are 5 years old, before Google Search over SSL) The NSA has clearly tapped trans-oceanic fiber -- why not also tap high-volume inter-datacenter links?
  - rjsw 13y ago
    I guess they could tap the fibre at a relay point, maybe somewhere like Hawaii.
- jonknee 13y ago
  > Why would Google (or anyone) link to them directly? with fiber no less! this stuff is alarming enough no need for FUD. Who says Google has a choice or is even complicit? The backbone providers have mostly stayed mum and it's known that the likes of AT&T split their fiber for the NSA. If we're willing to go to the bottom of the ocean to tap fiber lines it's pretty easy to believe that we'd tap terrestrial lines too.
  - MrKurtz 13y ago
    My understanding is that internet firms enjoy slightly more leverage, and that is why in contrast to telecos they are now petitioning the courts to reveal the scope of the orders.
    - minor_nitwit 13y ago
      That's all hand-waving. The courts won't allow it, the giants know that, so the internet giants use it as a chance to look good. Furthermore, it benefits the NSA for us all to think that Google, Yahoo, et. al., are not in their pocket.
- madaxe 13y ago
  > Why would Google (or anyone) link to them directly? with fiber no less! "They have no direct access to our servers" I wonder what a beam splitter consists of. Oh. A PRISM.
  - ISL 13y ago
    Beam splitters are, in general, not prisms. A prism, as traditionally referred-to (and in the NSA PRISM graphic) separates light of different wavelengths. In a signal tap, you want to split the intensity, not the wavelength. In simplest form, telecom signals are at a single wavelength; passing it through a 'Dark side of the moon' prism will only deflect the beam, not split it. When one refers to a beamsplitter, it's usually a partially silvered mirror. http://www.thorlabs.us/newgrouppage9.cfm?objectgroup_id=914 http://www.thorlabs.us/newgrouppage9.cfm?objectgroup_id=914 If it's fancy, it might use an evanescent wave to do the coupling, as in some cube beamsplitters. Beamsplitters for optical fiber are more generally referred to as 'couplers' and involve bringing two fiber cores close enough for a long enough distance that the probability of coupling light from one to the other is the desired amount. http://www.thorlabs.us/newgrouppage9.cfm?objectgroup_id=374 http://www.thorlabs.us/newgrouppage9.cfm?objectgroup_id=374 It is possible to split beams with a birefringent prism, but it is much less common. http://www.thorlabs.us/newgrouppage9.cfm?objectgroup_id=745 http://www.thorlabs.us/newgrouppage9.cfm?objectgroup_id=745 http://www.thorlabs.us/newgrouppage9.cfm?objectgroup_id=917 http://www.thorlabs.us/newgrouppage9.cfm?objectgroup_id=917 Disclaimer for the following: I only work with optical fiber couplers occasionally, and not for telecom. Someone who works on telecom fibers daily will be more informed. In summary, if someone wanted me to tap an optical fiber, I'd call up ThorLabs, get a matching coupler shipped overnight, cut the relevant fiber, slap APC ends on the fiber ends, and jack in. Splitting the beam in free space (outside of a fiber) with a prism is far more errorprone, unstable, and no more efficient. A fiber coupler has no moving parts, can't break, and won't take down a telecom's trunk line if someone breathes on it funny. If they're actually using a prism, it's because of some sort of impedance/reflection minimization scheme; I can't conjure one that would work better than using simpler techniques though.
    - madaxe 13y ago
      You can/do/might use actual prisms for a variety of reasons, however, such as if you're trying to get a frequency-multiplexed set of signals off a single fibre broken down as their constituent components - i.e. bulk data collection from a single tap on a mass fibre bridge. Anyway, you're probably right, it's probably just bog standard parts, and PRISM was a buzzword for management.
m8urn 13y ago
Or, the NSA could force Google to provide them with private keys to their certs for "national security" and then they can mitm all they want.
m8urn 13y ago
Or, the NSA could force Google to provide them with private keys to their certs for "national security" and then they can mitm all they want.
m8urn 13y ago
Or, the NSA could force Google to provide them with private keys to their certs for "national security" and then they can mitm all they want.
thrownaway2424 13y ago
Why assume that inter-datacenter links are not encypted?

by semenko 13y ago

MrKurtz 13y ago

Why would Google (or anyone) link to them directly? with fiber no less! this stuff is alarming enough no need for FUD. This XKS business seems about intercepting non-encrypted traffic as the references to HTTP payload quoted in the article would suggest.

semenko 13y ago
(Keep in mind these slides are 5 years old, before Google Search over SSL) The NSA has clearly tapped trans-oceanic fiber -- why not also tap high-volume inter-datacenter links?
- rjsw 13y ago
  I guess they could tap the fibre at a relay point, maybe somewhere like Hawaii.
jonknee 13y ago
> Why would Google (or anyone) link to them directly? with fiber no less! this stuff is alarming enough no need for FUD. Who says Google has a choice or is even complicit? The backbone providers have mostly stayed mum and it's known that the likes of AT&T split their fiber for the NSA. If we're willing to go to the bottom of the ocean to tap fiber lines it's pretty easy to believe that we'd tap terrestrial lines too.
- MrKurtz 13y ago
  My understanding is that internet firms enjoy slightly more leverage, and that is why in contrast to telecos they are now petitioning the courts to reveal the scope of the orders.
  - minor_nitwit 13y ago
    That's all hand-waving. The courts won't allow it, the giants know that, so the internet giants use it as a chance to look good. Furthermore, it benefits the NSA for us all to think that Google, Yahoo, et. al., are not in their pocket.
madaxe 13y ago
> Why would Google (or anyone) link to them directly? with fiber no less! "They have no direct access to our servers" I wonder what a beam splitter consists of. Oh. A PRISM.
- ISL 13y ago
  Beam splitters are, in general, not prisms. A prism, as traditionally referred-to (and in the NSA PRISM graphic) separates light of different wavelengths. In a signal tap, you want to split the intensity, not the wavelength. In simplest form, telecom signals are at a single wavelength; passing it through a 'Dark side of the moon' prism will only deflect the beam, not split it. When one refers to a beamsplitter, it's usually a partially silvered mirror. http://www.thorlabs.us/newgrouppage9.cfm?objectgroup_id=914 http://www.thorlabs.us/newgrouppage9.cfm?objectgroup_id=914 If it's fancy, it might use an evanescent wave to do the coupling, as in some cube beamsplitters. Beamsplitters for optical fiber are more generally referred to as 'couplers' and involve bringing two fiber cores close enough for a long enough distance that the probability of coupling light from one to the other is the desired amount. http://www.thorlabs.us/newgrouppage9.cfm?objectgroup_id=374 http://www.thorlabs.us/newgrouppage9.cfm?objectgroup_id=374 It is possible to split beams with a birefringent prism, but it is much less common. http://www.thorlabs.us/newgrouppage9.cfm?objectgroup_id=745 http://www.thorlabs.us/newgrouppage9.cfm?objectgroup_id=745 http://www.thorlabs.us/newgrouppage9.cfm?objectgroup_id=917 http://www.thorlabs.us/newgrouppage9.cfm?objectgroup_id=917 Disclaimer for the following: I only work with optical fiber couplers occasionally, and not for telecom. Someone who works on telecom fibers daily will be more informed. In summary, if someone wanted me to tap an optical fiber, I'd call up ThorLabs, get a matching coupler shipped overnight, cut the relevant fiber, slap APC ends on the fiber ends, and jack in. Splitting the beam in free space (outside of a fiber) with a prism is far more errorprone, unstable, and no more efficient. A fiber coupler has no moving parts, can't break, and won't take down a telecom's trunk line if someone breathes on it funny. If they're actually using a prism, it's because of some sort of impedance/reflection minimization scheme; I can't conjure one that would work better than using simpler techniques though.
  - madaxe 13y ago
    You can/do/might use actual prisms for a variety of reasons, however, such as if you're trying to get a frequency-multiplexed set of signals off a single fibre broken down as their constituent components - i.e. bulk data collection from a single tap on a mass fibre bridge. Anyway, you're probably right, it's probably just bog standard parts, and PRISM was a buzzword for management.

m8urn 13y ago

Or, the NSA could force Google to provide them with private keys to their certs for "national security" and then they can mitm all they want.

m8urn 13y ago

Or, the NSA could force Google to provide them with private keys to their certs for "national security" and then they can mitm all they want.

m8urn 13y ago

Or, the NSA could force Google to provide them with private keys to their certs for "national security" and then they can mitm all they want.

thrownaway2424 13y ago

Why assume that inter-datacenter links are not encypted?