5 ms·
Has anyone coined 'crypto theater' yet? Telling us you use SSL between web requests is nice and all, but if various government agencies have PRISM-like access
by drzaiusapelord 13y ago
Has anyone coined 'crypto theater' yet? Telling us you use SSL between web requests is nice and all, but if various government agencies have PRISM-like access to unencrypted data then you're really not protecting anyone. I imagine all these recent "we're using stronger keys and ssl now" PR stunts are to keep foreign customers happy and to help kill the Snowden story.
- Zoomla 13y agoeven if the encryption used was really secure, the government could request the keys. Unless company executives are no longer afraid to go to jail, they would give them out.
- Datsundere 13y agowhat if the keys are OTPs?
- Zoomla 13y agoIt would depend how the OTPs are generated and delivered.
- csmuk 13y agoIn that case, we need to keep our keys on the client side.
- Zoomla 13y agosure, that would be part of the solution. But I don't think that they would implement something server-side to make this easy for most people to use.
- tptacek 13y ago"PRISM-like access to unencrypted data"? The notion that PRISM was literally a technological back door into servers and storage clusters at providers is a conspiracy theory. Here, it's being deployed in the service of a dismissal of one of those providers improving their encryption --- of them making it harder for the USG to monitor comms.
- qwerty_asdf 13y agoAccess is access. Regardless of whether it's enabled by real time interception, SSH, remote desktop, FTP, a rich web app UI, or snail-mail based optical disk exchanges. And besides, whatever PRISM may or may not be, it's pretty clear MUSCULAR would fill in any gaps, and dispel your claim of mere theories, in favor of reality. https://news.ycombinator.com/item?id=6641378 https://news.ycombinator.com/item?id=6641378 NSA infiltrates links to Yahoo, Google data centers worldwide (washingtonpost.com) http://www.washingtonpost.com/world/national-security/nsa-infiltrates-links-to-yahoo-google-data-centers-worldwide-snowden-documents-say/2013/10/30/e51d661e-4166-11e3-8b74-d89d714ca4dd_story.html http://www.washingtonpost.com/world/national-security/nsa-in... I mean, you gave the top comment on that thread, after all.
- tptacek 13y agoNow you're changing your story. PRISM was widely reported not to provide automated/unauthorized access to data; it is now believed to be a submission/management system for FISA requests, which are reviewed by providers before the providers own personnel locate the data. The Guardian silently (to their shame) retracted the claims that PRISM was anything more than that. Meanwhile, illegal direct access to intra-provider communications can be cured by improving operational security at providers, which is exactly what the story we're commenting on is an instance of. No, I don't think your argument is valid.
- MisterWebz 13y agoIIRC, they were/are pulling tons of data with just a single FISA request. While the system you described is certainly much better than having a backdoor installed, I'm not sure whether that'll protect your data from being "accidentally" collected.
- tedunangst 13y agoDropbox. They use stronger than usual language to assure you that nobody can ever read your data. Unless there's a "glitch" that lets anyone login with no password at all.
- iwwr 13y agoBug-based backdoors offer full deniability as part of an ass-covering strategy. All software has bugs, all software therefore has backdoors.
- BrainInAJar 13y agoNot to mention the data is just sitting right on Amazon's platters. If I were the NSA & Dropbox wouldn't comply, I'd just pop over to Amazon