9 ms·

NSA Revelations Cast Doubt on the Entire Tech Industry

161 points by Libertatea 13y ago

frank_boyd 13y ago
> NSA Revelations Cast Doubt on the Entire Tech Industry I'd say it's true for everything that's not open-source and doesn't allow for proper public key encryption. (Assuming that public key encryption is still holding up.)
- devx 13y ago
  Except now we also have to be much more vigilant about open source standards, too. For example, now I worry the security model of WebRTC has been compromised by NSA, because it has the potential to offer very secure P2P conversations to the masses (at least 1 billion users - and that's before IE even adopts it in IE12, hopefully).
  - frank_boyd 13y ago
    If your goal is to communicate securely, it's preferable to encrypt using a native (and obviously open-source) application (and OS) and to avoid the browser, for the time being.
    - pjmlp 13y ago
      Is to meet in person in a secure place. Whatever channel you use might be compromised, if you cannot control both ends.
      - Gravityloss 13y ago
        If you have an Android phone, Google tracks your location (GPS, cell towers and maps-wardriving-provided Wifi hotspots at least), so it's probably easy to see who met who. Maybe they also save seen bluetooth devices. Phones don't record conversations in the pocket by default yet, but it's not inconceivable when computing efficiency improves that recording is always on, and keyword data is saved by default. Handy if it can creates calendar markings from verbal agreements... And with Glass, video too. So meeting in person is getting less secure as well.
        frank_boyd 13y ago
        > And with Glass, video too. Glass adds the perversion that you don't have your say regarding surveillance of society, anymore. Your "friends" will do it for you. Only solution: Get vocal whenever you see somebody wearing Glass.
        Peaker 13y ago
        Most phones let you pull the battery out, still. Even when they don't, it's probably easy enough to disconnect the battery on your own.
  - infocollector 13y ago
    Does anyone know how to disable WebRTC in the browser ? (Apart from downgrading of course)
    - TsiCClawOfLight 13y ago
      I assume there is a chrome Flag for it, and a config option for firefox?
- nwh 13y ago
  It goes deeper than that. If I owned any server hardware, chances are it would be in a rack in a datacenter. What's to say somebody hasn't walked in, flipped a badge and taken my SSL private keys? In fact, that's quite probable.
  - frank_boyd 13y ago
    True. You should host in a non-US and non-EU country (i.e. Switzerland) to be able to sleep better.
    - iaskwhy 13y ago
      Any recommendation?
      - infocollector 13y ago
        Beware: If you do, it is going to be even more easier to crack.
      - frank_boyd 13y ago
        Haven't tested them yet, but they seem to be among the bigger (independent) ones: http://www.green.ch/en-us/home.aspx http://www.green.ch/en-us/home.aspx
  - jaggederest 13y ago
    You're thinking too small scale. Certificate Authorities are almost certainly compromised. Why bother with one at a time when you can just force the vendor to hand the keys to the castle over? Sign your own certs, MITM anyone you want.
    - nwh 13y ago
      MITM isn't the issue, we assume for the most part that the NSA is a passive eavesdropper. Easier in that situation to sniff and decode with a stolen secret, rather than rewriting traffic on the fly.
- Tyrannosaurs 13y ago
  I'm thinking there are questions about even open source projects. Who is to say they've not been covertly influencing them, or even running them altogether? I'd certainly agree that open source offers the potential for independent verification of its nature, how many of these applications and libraries have been examined in detail by those who have the deep expertise to spot a subtle flaw and how many are just taken at face value? The whole thing is frankly a cluster frak.
soora 13y ago
I will be interested to see how this plays out over the next few years. Will these predictions match reality?
- grandalf 13y ago
  It will indeed be interesting. One thing to consider is that we can assume the US Government has enough information about most individuals and businesses to cause significant harm, even if everyone (individuals and businesses) stopped trusting tech companies tomorrow, the damage is done and an enormous trove of intel has been captured. This looming threat will only get worse as the government shifts its focus from capturing data to utilizing it at scale.
devx 13y ago
Even if Microsoft is telling the truth (very skeptical about it), you could see how they can easily lie through their teeth with that statement "We aren't explicitly providing a backdoor for the NSA - but hey, if NSA knows of a vulnerability in Windows that is very hidden, and we know about it, too, then it's out of our hands, and NSA can do whatever". This is also interesting, something someone posted on HN from Steve Gibson back in 2006: https://www.grc.com/sn/sn-022.htm https://www.grc.com/sn/sn-022.htm At this point I would really start with the presumption that at least Windows and Intel's chips (possibly others, too) have backdoors in them, and that the chances of that happening at this point is higher than not happening. I'd also assume most routers have at least dormant backdoors in them. Jacob Appelbaum has been saying for years that it's easier for manufacturers to just build-in the backdoors in all routers that they're making, because so many countries demand them, and they just keep them "disabled" in the countries that don't ask for them. It might be a good idea to start installing OpenWRT firmware on your routers.
- jgrahamc 13y ago
  I debunked that claim: http://blog.jgc.org/2006/01/wmf-setabortproc-problem-is-not.html http://blog.jgc.org/2006/01/wmf-setabortproc-problem-is-not.... Of course, it was still exploitable.
frio 13y ago
Speaking as a foreigner, I now have very little trust for basically any major US tech corporation. The NSA claims it deals responsibly with data relating to US citizens: I'm not a US citizen. I plan on spending the next few months moving most of my accounts back to self-hosted, or at least hosted nationally.
- nwh 13y ago
  That's the part that's always amused me. They claim they only spy on foreigners, which is well, me. Reassuring stuff.
  - hepek 13y ago
    "...The state then is the most flagrant negation, the most cynical and complete negation of humanity. It rends apart the universal solidarity of all men upon earth, and it unites some of them only in order to destroy, conquer, and enslave all the rest. It takes under its protection only its own citizens, and it recognizes human right, humanity, and civilization only within the confines of its own boundaries." Mihail Bakunin
- pjmlp 13y ago
  How well do you trust secret services in you own country? This is overblown out of proportions, anyone that ever had any contact with secret services knows, the only rules they follow is their own, regardless of the country.
  - frio 13y ago
    I don't :). For what it's worth, our government very recently passed laws granting our GCSB much further reaching powers. It's been a media circus; one particularly hypocritical politician's currently up in arms because a bunch of his data was compromised -- but in a staggering display of cognitive dissonance, Mr. Dunne voted for the law anyway. Basically, I've always accepted that whatever I do online is public anyway. That doesn't mean I endorse that, and I'd rather give my money to local companies than endorse the US at this time.
  - 13y ago
jgreen10 13y ago
Strange policy to build an organization that could destroy the only industry that is keeping your economy going.
- ihsw 13y ago
  Not at all, they've made it quite clear that there are only two options: have the capability to decrypt everything or create America's Great Firewall. They couldn't give a rats ass about the economy. Now that the cat's out of the bag I'm sure they will refocus their efforts on shoring up the defence of every government communications network.
alan_cx 13y ago
For me, all the revelations and confirmations of foil hat theories have destroyed the joy the internet used to be. To me its now a dirty high tech voyeur spy's dream. As for the US part of this, yes, my country the UK, is up to its neck in it, but, the part that is driving me away from the internet is the fact that Americans think their laws apply to non-Americans, and if necessary, Americans will force those laws on people who had no vote in it what so ever. Government will be leaned on and pressured to hand their people over to a US legal system I have zero faith in, and a penal system that borders a barbaric reinvention of slavery. If that fails, the US will "render" people, or as the rest of us call it, kidnap. To get my encryption keys, as a foreigner I genuinely fear American torture. Now, I suspect the likes of China also do or aspire to spy on us all in the same way, but I don't feel the same risk of state kidnap, their laws, legals system, etc. The spying is one thing, to a point I can live with that and alter behavior to compensate, but the idea I could break laws I don't agree with and have no influence over, while getting no support from my government, or be kidnapped, is frankly too much to accept. Even in typing this post I am self censoring. As such, the internet has now become something I'm now very wary of. I almost feel like the using the internet is the same as traveling to the US, which is something I would never ever do. Its simply not worth the risk to my liberty and freedom. Sad, very sad.
- devx 13y ago
  I feel the same way. Besides the fact that I think the Patriot Act and the FISA Amendments Act are disgusting, unconstitutional laws, at least let that be Americans' problem. If they are fine with it, so be it (they really shouldn't be, though). But in no way do I find acceptable that just because I'm using an American service, the US has access at will to all my data. I think it's common sense that there should be international treaties that state that "if you want my citizen's data, then you have to ask me first (the local government)". Stuff like that is what (maybe) will restore some trust in US companies in the future, but it's only one small step of the many steps needed to be taken to ensure the protection of both Americans and foreigners' privacy. The way I see it, foreigners with data on American corporations' servers should be more protected than American citizens, not less, because I'm not their damn citizen, so they have no business scooping up all my data when they want to! At least that's how they should approach this if they still care about the "economy" and their corporations' welfare. EU and UN also need to speak up more and say that this whole NSA spying thing is infringing on everyone's human rights for privacy. I feel this argument is being used very little right now, because I do think having private communications goes well beyond just one country's Constitution.
deleted 13y ago
[deleted]
Cort3z 13y ago
I can see Silicon Valley taking a big hit here. Being a foreigner I no longer trust US based services. I think I will move all my data and Web apps off Amazon, meaning no more Dropbox for me. Any website I have hosted on there now I will find a way to get off these US servers. I even see things like Facebook and Twitter taking hits with competitive services hosted in "more secure countries" popping up. At this point I feel Chinese based services is safer, and that is saying a lot.
Cort3z 13y ago
I can see Silicon Valley taking a big hit here. Being a foreigner I no longer trust US based services. I think I will move all my data and Web apps off Amazon, meaning no more Dropbox for me. Any website I have hosted on there now I will find a way to get off these US servers. I even see things like Facebook and Twitter taking hits with competitive services hosted in "more secure countries" popping up. At this point I feel Chinese based services is safer, and that is saying a lot.
Cort3z 13y ago
I can see Silicon Valley taking a big hit here. Being a foreigner I no longer trust US based services. I think I will move all my data and Web apps off Amazon, meaning no more Dropbox for me. Any website I have hosted on there now I will find a way to get off these US servers. I even see things like Facebook and Twitter taking hits with competitive services hosted in "more secure countries" popping up. At this point I feel Chinese based services is safer, and that is saying a lot.
Cort3z 13y ago
I can see Silicon Valley taking a big hit here. Being a foreigner I no longer trust US based services. I think I will move all my data and Web apps off Amazon, meaning no more Dropbox for me. Any website I have hosted on there now I will find a way to get off these US servers. I even see things like Facebook and Twitter taking hits with competitive services hosted in "more secure countries" popping up. At this point I feel Chinese based services is safer, and that is saying a lot.
kenjackson 13y ago
Many seem to be missing the worst part of this: Services are forever tainted. And services are the most interesting part of the puzzle. Open source software that runs on the client is nice, but frankly I'm not as concerned about the NSA having access to my desktop. Logging, parsing, and analyzing client data of this sort opportunistically probably doesn't scale. And it's easier for me to set up a system in my house where I can audit all incoming and outgoing traffic (not that I'm going to do it, but I'm confident that I could). The one exception to this is encryption software... more on this later. But it's hosted services where a lot of my interesting data lives, is structured in a way that makes opportunistic scanning much easier, and there is no way for me to audit it. There's no way for me to know that GMail's servers don't have a backdoor. Or likewise for Dropbox or Facebook or Citi or my Amazon, etc... This means I have to encrypt everything stored on any service (which is why my encryption software does need to be backdoor free). But most services store data about me where I don't control if its encrypted or not (it's not easy to encrypt voice calls from the end user perspective). The end result is I already have fatigue, and I haven't even done any work yet! I think most people are going to rely on an old story: "Two guys are walking through the woods when they run across a hungry bear. At this point one of the men quickly ties his shoes. The other man says, 'Why are you tying your shoes -- you can't outrun this bear!' To which the other man says, 'I don't need to outrun the bear, I just need to outrun you.'" Internet services are too valuable to not use. But it will be too much work for 99.9% of the population to preserve their privacy. The lack of privacy from the NSA will become the new normal. I have trouble seeing it playing out in any other way.
- Amadou 13y ago
  Services are forever tainted. And services are the most interesting part of the puzzle. I see it as a plus. But I've been against the very concept of such services in the first place. I think most centralization is unnecessary, that the reason it is so common today is because it is a straight-forward business plan for a company to insert itself as an intermediary between all of the users and thus extract money (and therefore efficiency) from their interactions. Facebook's the ultimate example. Their popularity is a result of people needing a place to easily host and share their photos. But the cheaper storage and bandwidth get, the less utility Facebook provides compared to a distributed system. I think we are at a point today where high-end phones could host all the content that the majority of people want to share. Combine that with a little smart caching between "friends" so that their phones on wifi can pick up the slack when the original host is cell-only and throw in a distributed hash table for finding new "friends" and the value that facebook provides users by centralization drops precipitously. If these NSA revelations help kickstart a new (but actually old) paradigm where each internet user is essentially self-hosting, then I believe that will be a great boon in the long run.
Cort3z 13y ago
I can see Silicon Valley taking a big hit here. Being a foreigner I no longer trust US based services. I think I will move all my data and Web apps off Amazon, meaning no more Dropbox for me. Any website I have hosted on there now I will find a way to get off these US servers. I even see things like Facebook and Twitter taking hits with competitive services hosted in "more secure countries" popping up. At this point I feel Chinese based services is safer, and that is saying a lot.
Cort3z 13y ago
I can see Silicon Valley taking a big hit here. Being a foreigner I no longer trust US based services. I think I will move all my data and Web apps off Amazon, meaning no more Dropbox for me. Any website I have hosted on there now I will find a way to get off these US servers. I even see things like Facebook and Twitter taking hits with competitive services hosted in "more secure countries" popping up. At this point I feel Chinese based services is safer, and that is saying a lot.
wschorn 13y ago
I feel like anybody with their ear even moderately to the ground knew the NSA had encryption breaking techniques... Why else would higher-level encryption be illegal?
- seandhi 13y ago
  Which higher-level encryption is illegal?
  - taproot 13y ago
    None really anymore. http://en.wikipedia.org/wiki/Export_of_cryptography#Current_status http://en.wikipedia.org/wiki/Export_of_cryptography#Current_... http://www.xanthir.com/document/document.php?id=6e54a9d38b4ae29c9edf2f5e8bd8d9963e30c83a0b3706599b6598266067057cb8a862da0b804bc270490848a9e8b2473d7c8d5b5c9585004449a144f73b7664#section1.6.0 http://www.xanthir.com/document/document.php?id=6e54a9d38b4a...
DanielBMarkham 13y ago
I don't think there's any doubt to it. There are folks that made their fortunes and earn their livelihoods on the net. These folks are going to defend what we built to their dying day. There are governments and corporations, which believe they absolutely must have whatever data they view as honorable (and this definition is surprisingly flexible) in order to continue to privide their services. Then there's the general public, including most reporters, who suspects something is amiss but keeps hearing all kinds of contradictory opinions, including calling out the folks who warned about these as tinfoil hat types. Yeah sure, there's lots of noise and confusion, but doubt? I don't think so. Note: I'm not trying to weave a conspiracy theory here. My only point about existing players is that they're too emotionally wrapped up in things that took many years of hard work to see the situation objectively
theoh 13y ago
David Dampier's comment about cryptography in this article is a bit surprising: “I don’t care what company is selling you encryption software. Whatever they are going to sell you, it can be decrypted. There’s nothing that is infallible.” Leaving aside the fact that a significant fraction of cryptographic software that is free and open source (ssh, gpg, tls implementations in browsers, etc.) the idea that any cryptography available to an end user is breakable by an adversary like NSA is not supported by what we know about current and historical progress in the mathematics of cryptanalysis. Dampier's credentials on his academic home page are not that relevant or convincing when it comes to cryptography proper. I would be more likely to go with Bruce Schneier's opinion that cryptography is still secure with appropriate key sizes: "Still, I trust the mathematics" https://www.schneier.com/blog/archives/2013/09/the_nsas_crypto_1.html https://www.schneier.com/blog/archives/2013/09/the_nsas_cryp...
Sami_Lehtinen 13y ago
I've been wondering why WatchGuard firewalls require mandatory registration before working. There they ask questions like, is this firewall being used to secure important military site etc. Wtf, if I would use it to protect important military / nuclear research lab etc... Do they really think I would tell it? I'm sure that information is directly passed to "authorities" and then they can bypass that firewall/vpn/ipsec to steal secrets whenever they want to.
ig1 13y ago
From the documents published by the New York Times it seems that the NSA have introduced backdoors into VPN and SSL hardware crypto chips. There aren't that many major vendors who make such chips and undoubtedly people are going to be trying to find them now. The question is what's going to happen when the vendors are identified ? - I can't imagine it'll be good for their customer base or their share-price. Imagine you're a bank using vendor X's backdoored SSL acceleration. Say you're involved in a lawsuit where a customer claims they didn't authorise a transaction, now the customer can point to the fact that you're knowingly using hardware which has backdoor which would have allowed a third party to silently steal the users credentials. This is a huge deal.
rbc 13y ago
I think the NSA revelations may also hurt data mining initiatives in the private sector. At some point I think the privacy advocates that are criticizing NSA access to private sector data, will turn their attention to the services that hold the data. I believe there will be more pressure on service providers to purge archived data, whether it be phone call meta-data or other kinds of information.
mcgwiz 13y ago
Can Web of Trust/PGP be applied/adapted to client-server communication such as that handled by HTTP? Conceptually, HTTPS built on PGP? Would new products or services help the adoption of this (like a social network for PGP keys)? Although it wouldn't solve all of the NSA techniques (social engineering, acquiring pre-encrypted data) it would certainly be harder to track down (i.e. steal, crack, coerce, subpoena, etc) tens of millions of keys rather than tens of thousands.

161 points by Libertatea 13y ago

> NSA Revelations Cast Doubt on the Entire Tech Industry I'd say it's true for everything that's not open-source and doesn't allow for proper public key encryption. (Assuming that public key encryption is still holding up.)

devx 13y ago
Except now we also have to be much more vigilant about open source standards, too. For example, now I worry the security model of WebRTC has been compromised by NSA, because it has the potential to offer very secure P2P conversations to the masses (at least 1 billion users - and that's before IE even adopts it in IE12, hopefully).
- frank_boyd 13y ago
  If your goal is to communicate securely, it's preferable to encrypt using a native (and obviously open-source) application (and OS) and to avoid the browser, for the time being.
  - pjmlp 13y ago
    Is to meet in person in a secure place. Whatever channel you use might be compromised, if you cannot control both ends.
    - Gravityloss 13y ago
      If you have an Android phone, Google tracks your location (GPS, cell towers and maps-wardriving-provided Wifi hotspots at least), so it's probably easy to see who met who. Maybe they also save seen bluetooth devices. Phones don't record conversations in the pocket by default yet, but it's not inconceivable when computing efficiency improves that recording is always on, and keyword data is saved by default. Handy if it can creates calendar markings from verbal agreements... And with Glass, video too. So meeting in person is getting less secure as well.
      - frank_boyd 13y ago
        > And with Glass, video too. Glass adds the perversion that you don't have your say regarding surveillance of society, anymore. Your "friends" will do it for you. Only solution: Get vocal whenever you see somebody wearing Glass.
      - Peaker 13y ago
        Most phones let you pull the battery out, still. Even when they don't, it's probably easy enough to disconnect the battery on your own.
- infocollector 13y ago
  Does anyone know how to disable WebRTC in the browser ? (Apart from downgrading of course)
  - TsiCClawOfLight 13y ago
    I assume there is a chrome Flag for it, and a config option for firefox?
nwh 13y ago
It goes deeper than that. If I owned any server hardware, chances are it would be in a rack in a datacenter. What's to say somebody hasn't walked in, flipped a badge and taken my SSL private keys? In fact, that's quite probable.
- frank_boyd 13y ago
  True. You should host in a non-US and non-EU country (i.e. Switzerland) to be able to sleep better.
  - iaskwhy 13y ago
    Any recommendation?
    - infocollector 13y ago
      Beware: If you do, it is going to be even more easier to crack.
    - frank_boyd 13y ago
      Haven't tested them yet, but they seem to be among the bigger (independent) ones: http://www.green.ch/en-us/home.aspx http://www.green.ch/en-us/home.aspx
- jaggederest 13y ago
  You're thinking too small scale. Certificate Authorities are almost certainly compromised. Why bother with one at a time when you can just force the vendor to hand the keys to the castle over? Sign your own certs, MITM anyone you want.
  - nwh 13y ago
    MITM isn't the issue, we assume for the most part that the NSA is a passive eavesdropper. Easier in that situation to sniff and decode with a stolen secret, rather than rewriting traffic on the fly.
Tyrannosaurs 13y ago
I'm thinking there are questions about even open source projects. Who is to say they've not been covertly influencing them, or even running them altogether? I'd certainly agree that open source offers the potential for independent verification of its nature, how many of these applications and libraries have been examined in detail by those who have the deep expertise to spot a subtle flaw and how many are just taken at face value? The whole thing is frankly a cluster frak.

soora 13y ago

I will be interested to see how this plays out over the next few years. Will these predictions match reality?

grandalf 13y ago
It will indeed be interesting. One thing to consider is that we can assume the US Government has enough information about most individuals and businesses to cause significant harm, even if everyone (individuals and businesses) stopped trusting tech companies tomorrow, the damage is done and an enormous trove of intel has been captured. This looming threat will only get worse as the government shifts its focus from capturing data to utilizing it at scale.

devx 13y ago

Even if Microsoft is telling the truth (very skeptical about it), you could see how they can easily lie through their teeth with that statement "We aren't explicitly providing a backdoor for the NSA - but hey, if NSA knows of a vulnerability in Windows that is very hidden, and we know about it, too, then it's out of our hands, and NSA can do whatever". This is also interesting, something someone posted on HN from Steve Gibson back in 2006: https://www.grc.com/sn/sn-022.htm https://www.grc.com/sn/sn-022.htm At this point I would really start with the presumption that at least Windows and Intel's chips (possibly others, too) have backdoors in them, and that the chances of that happening at this point is higher than not happening. I'd also assume most routers have at least dormant backdoors in them. Jacob Appelbaum has been saying for years that it's easier for manufacturers to just build-in the backdoors in all routers that they're making, because so many countries demand them, and they just keep them "disabled" in the countries that don't ask for them. It might be a good idea to start installing OpenWRT firmware on your routers.

jgrahamc 13y ago
I debunked that claim: http://blog.jgc.org/2006/01/wmf-setabortproc-problem-is-not.html http://blog.jgc.org/2006/01/wmf-setabortproc-problem-is-not.... Of course, it was still exploitable.

frio 13y ago

Speaking as a foreigner, I now have very little trust for basically any major US tech corporation. The NSA claims it deals responsibly with data relating to US citizens: I'm not a US citizen. I plan on spending the next few months moving most of my accounts back to self-hosted, or at least hosted nationally.

nwh 13y ago
That's the part that's always amused me. They claim they only spy on foreigners, which is well, me. Reassuring stuff.
- hepek 13y ago
  "...The state then is the most flagrant negation, the most cynical and complete negation of humanity. It rends apart the universal solidarity of all men upon earth, and it unites some of them only in order to destroy, conquer, and enslave all the rest. It takes under its protection only its own citizens, and it recognizes human right, humanity, and civilization only within the confines of its own boundaries." Mihail Bakunin
pjmlp 13y ago
How well do you trust secret services in you own country? This is overblown out of proportions, anyone that ever had any contact with secret services knows, the only rules they follow is their own, regardless of the country.
- frio 13y ago
  I don't :). For what it's worth, our government very recently passed laws granting our GCSB much further reaching powers. It's been a media circus; one particularly hypocritical politician's currently up in arms because a bunch of his data was compromised -- but in a staggering display of cognitive dissonance, Mr. Dunne voted for the law anyway. Basically, I've always accepted that whatever I do online is public anyway. That doesn't mean I endorse that, and I'd rather give my money to local companies than endorse the US at this time.
- 13y ago

jgreen10 13y ago

Strange policy to build an organization that could destroy the only industry that is keeping your economy going.

ihsw 13y ago
Not at all, they've made it quite clear that there are only two options: have the capability to decrypt everything or create America's Great Firewall. They couldn't give a rats ass about the economy. Now that the cat's out of the bag I'm sure they will refocus their efforts on shoring up the defence of every government communications network.

alan_cx 13y ago

For me, all the revelations and confirmations of foil hat theories have destroyed the joy the internet used to be. To me its now a dirty high tech voyeur spy's dream. As for the US part of this, yes, my country the UK, is up to its neck in it, but, the part that is driving me away from the internet is the fact that Americans think their laws apply to non-Americans, and if necessary, Americans will force those laws on people who had no vote in it what so ever. Government will be leaned on and pressured to hand their people over to a US legal system I have zero faith in, and a penal system that borders a barbaric reinvention of slavery. If that fails, the US will "render" people, or as the rest of us call it, kidnap. To get my encryption keys, as a foreigner I genuinely fear American torture. Now, I suspect the likes of China also do or aspire to spy on us all in the same way, but I don't feel the same risk of state kidnap, their laws, legals system, etc. The spying is one thing, to a point I can live with that and alter behavior to compensate, but the idea I could break laws I don't agree with and have no influence over, while getting no support from my government, or be kidnapped, is frankly too much to accept. Even in typing this post I am self censoring. As such, the internet has now become something I'm now very wary of. I almost feel like the using the internet is the same as traveling to the US, which is something I would never ever do. Its simply not worth the risk to my liberty and freedom. Sad, very sad.

devx 13y ago
I feel the same way. Besides the fact that I think the Patriot Act and the FISA Amendments Act are disgusting, unconstitutional laws, at least let that be Americans' problem. If they are fine with it, so be it (they really shouldn't be, though). But in no way do I find acceptable that just because I'm using an American service, the US has access at will to all my data. I think it's common sense that there should be international treaties that state that "if you want my citizen's data, then you have to ask me first (the local government)". Stuff like that is what (maybe) will restore some trust in US companies in the future, but it's only one small step of the many steps needed to be taken to ensure the protection of both Americans and foreigners' privacy. The way I see it, foreigners with data on American corporations' servers should be more protected than American citizens, not less, because I'm not their damn citizen, so they have no business scooping up all my data when they want to! At least that's how they should approach this if they still care about the "economy" and their corporations' welfare. EU and UN also need to speak up more and say that this whole NSA spying thing is infringing on everyone's human rights for privacy. I feel this argument is being used very little right now, because I do think having private communications goes well beyond just one country's Constitution.

deleted 13y ago

[deleted]

Cort3z 13y ago

I can see Silicon Valley taking a big hit here. Being a foreigner I no longer trust US based services. I think I will move all my data and Web apps off Amazon, meaning no more Dropbox for me. Any website I have hosted on there now I will find a way to get off these US servers. I even see things like Facebook and Twitter taking hits with competitive services hosted in "more secure countries" popping up. At this point I feel Chinese based services is safer, and that is saying a lot.

Cort3z 13y ago

kenjackson 13y ago

Many seem to be missing the worst part of this: Services are forever tainted. And services are the most interesting part of the puzzle. Open source software that runs on the client is nice, but frankly I'm not as concerned about the NSA having access to my desktop. Logging, parsing, and analyzing client data of this sort opportunistically probably doesn't scale. And it's easier for me to set up a system in my house where I can audit all incoming and outgoing traffic (not that I'm going to do it, but I'm confident that I could). The one exception to this is encryption software... more on this later. But it's hosted services where a lot of my interesting data lives, is structured in a way that makes opportunistic scanning much easier, and there is no way for me to audit it. There's no way for me to know that GMail's servers don't have a backdoor. Or likewise for Dropbox or Facebook or Citi or my Amazon, etc... This means I have to encrypt everything stored on any service (which is why my encryption software does need to be backdoor free). But most services store data about me where I don't control if its encrypted or not (it's not easy to encrypt voice calls from the end user perspective). The end result is I already have fatigue, and I haven't even done any work yet! I think most people are going to rely on an old story: "Two guys are walking through the woods when they run across a hungry bear. At this point one of the men quickly ties his shoes. The other man says, 'Why are you tying your shoes -- you can't outrun this bear!' To which the other man says, 'I don't need to outrun the bear, I just need to outrun you.'" Internet services are too valuable to not use. But it will be too much work for 99.9% of the population to preserve their privacy. The lack of privacy from the NSA will become the new normal. I have trouble seeing it playing out in any other way.

Amadou 13y ago
Services are forever tainted. And services are the most interesting part of the puzzle. I see it as a plus. But I've been against the very concept of such services in the first place. I think most centralization is unnecessary, that the reason it is so common today is because it is a straight-forward business plan for a company to insert itself as an intermediary between all of the users and thus extract money (and therefore efficiency) from their interactions. Facebook's the ultimate example. Their popularity is a result of people needing a place to easily host and share their photos. But the cheaper storage and bandwidth get, the less utility Facebook provides compared to a distributed system. I think we are at a point today where high-end phones could host all the content that the majority of people want to share. Combine that with a little smart caching between "friends" so that their phones on wifi can pick up the slack when the original host is cell-only and throw in a distributed hash table for finding new "friends" and the value that facebook provides users by centralization drops precipitously. If these NSA revelations help kickstart a new (but actually old) paradigm where each internet user is essentially self-hosting, then I believe that will be a great boon in the long run.

Cort3z 13y ago

wschorn 13y ago

I feel like anybody with their ear even moderately to the ground knew the NSA had encryption breaking techniques... Why else would higher-level encryption be illegal?

seandhi 13y ago
Which higher-level encryption is illegal?
- taproot 13y ago
  None really anymore. http://en.wikipedia.org/wiki/Export_of_cryptography#Current_status http://en.wikipedia.org/wiki/Export_of_cryptography#Current_... http://www.xanthir.com/document/document.php?id=6e54a9d38b4ae29c9edf2f5e8bd8d9963e30c83a0b3706599b6598266067057cb8a862da0b804bc270490848a9e8b2473d7c8d5b5c9585004449a144f73b7664#section1.6.0 http://www.xanthir.com/document/document.php?id=6e54a9d38b4a...

DanielBMarkham 13y ago

I don't think there's any doubt to it. There are folks that made their fortunes and earn their livelihoods on the net. These folks are going to defend what we built to their dying day. There are governments and corporations, which believe they absolutely must have whatever data they view as honorable (and this definition is surprisingly flexible) in order to continue to privide their services. Then there's the general public, including most reporters, who suspects something is amiss but keeps hearing all kinds of contradictory opinions, including calling out the folks who warned about these as tinfoil hat types. Yeah sure, there's lots of noise and confusion, but doubt? I don't think so. Note: I'm not trying to weave a conspiracy theory here. My only point about existing players is that they're too emotionally wrapped up in things that took many years of hard work to see the situation objectively

theoh 13y ago

David Dampier's comment about cryptography in this article is a bit surprising: “I don’t care what company is selling you encryption software. Whatever they are going to sell you, it can be decrypted. There’s nothing that is infallible.” Leaving aside the fact that a significant fraction of cryptographic software that is free and open source (ssh, gpg, tls implementations in browsers, etc.) the idea that any cryptography available to an end user is breakable by an adversary like NSA is not supported by what we know about current and historical progress in the mathematics of cryptanalysis. Dampier's credentials on his academic home page are not that relevant or convincing when it comes to cryptography proper. I would be more likely to go with Bruce Schneier's opinion that cryptography is still secure with appropriate key sizes: "Still, I trust the mathematics" https://www.schneier.com/blog/archives/2013/09/the_nsas_crypto_1.html https://www.schneier.com/blog/archives/2013/09/the_nsas_cryp...

Sami_Lehtinen 13y ago

I've been wondering why WatchGuard firewalls require mandatory registration before working. There they ask questions like, is this firewall being used to secure important military site etc. Wtf, if I would use it to protect important military / nuclear research lab etc... Do they really think I would tell it? I'm sure that information is directly passed to "authorities" and then they can bypass that firewall/vpn/ipsec to steal secrets whenever they want to.

ig1 13y ago

From the documents published by the New York Times it seems that the NSA have introduced backdoors into VPN and SSL hardware crypto chips. There aren't that many major vendors who make such chips and undoubtedly people are going to be trying to find them now. The question is what's going to happen when the vendors are identified ? - I can't imagine it'll be good for their customer base or their share-price. Imagine you're a bank using vendor X's backdoored SSL acceleration. Say you're involved in a lawsuit where a customer claims they didn't authorise a transaction, now the customer can point to the fact that you're knowingly using hardware which has backdoor which would have allowed a third party to silently steal the users credentials. This is a huge deal.

rbc 13y ago

I think the NSA revelations may also hurt data mining initiatives in the private sector. At some point I think the privacy advocates that are criticizing NSA access to private sector data, will turn their attention to the services that hold the data. I believe there will be more pressure on service providers to purge archived data, whether it be phone call meta-data or other kinds of information.

mcgwiz 13y ago

Can Web of Trust/PGP be applied/adapted to client-server communication such as that handled by HTTP? Conceptually, HTTPS built on PGP? Would new products or services help the adoption of this (like a social network for PGP keys)? Although it wouldn't solve all of the NSA techniques (social engineering, acquiring pre-encrypted data) it would certainly be harder to track down (i.e. steal, crack, coerce, subpoena, etc) tens of millions of keys rather than tens of thousands.