5 ms·

Many interesting "nuggets" buried in this report. For example: ...A more sophisticated effort, though, relied on intercepting Google Maps queries made on smart

Many interesting "nuggets" buried in this report. For example: ...A more sophisticated effort, though, relied on intercepting Google Maps queries made on smartphones, and using them to collect large volumes of location information. So successful was this effort that one 2008 document noted that "[i]t effectively means that anyone using Google Maps on a smartphone is working in support of a GCHQ system." At this point it is perhaps not wrong to conclude that the whole internet is bjorked by these agencies. Open to snooping and manipulation at any and every level for any user. It is time for a reboot, this time with much more focus on security.

seanr 13y ago
Maps and other apps on the iPhone weren't using HTTPS in 08 (underpowered device, need to squeeze every last drop from battery). They do now however. It's not just a spy agency issue, anyone could have sniffed the unencrypted traffic.
- streetnigga 13y ago
  (underpowered device, need to squeeze every last drop from battery) Really now? Is that the official reasoning for not using HTTPS?
  - TeMPOraL 13y ago
    Well, this is the most common argument before Snowdengate I heard against using HTTPS anywhere, not only on mobile devices.
  - seanr 13y ago
    Back then it was.
    - streetnigga 13y ago
      I just don't recall anything official regarding that line of thought. Direct PR or otherwise. Is there any examples off the top of your head?
      - judk 13y ago
        "HTTPS is expensive" has been a widespread (stupid) meme since the invention of HTTPS. How old are you?
        streetnigga 13y ago
        Old enough to know a non-answer when I see one. Again I ask: Any specific examples from companies or organizations that implement HTTP(S) in their products stating device power as reason for non-implementation?
        themartorana 13y ago
        I imagine it to be a horrible miscarriage of trust to not use HTTPS. We made the decision early on that handling any personal data not over HTTPS was massively irresponsible - and this is pre-Snowden. That said, if they have kernel-level hacks or can intercept and decode HTTPS (or sit and listen on say, any AWS server they want), what does HTTPS really matter against the NSA? Still, totally irresponsible - battery life is a constant struggle, but not enough to even make us consider changing our API client code.
        7952 13y ago
        The problem is that HTTPS is very difficult to audit, we just have to trust that it is being done correctly. How do you know that the apparently random stream of bits is actually properly encrypted and does not leak private data? It would be better to let the OS add the SSL layer and only let apps talk HTTP. This would give the user much more control.
cryoshon 13y ago
That was in 2008. Imagine what else they've been able to jimmy in 6 years! I'm still waiting on the reveal that they've stored geolocational data at regular timepoints of every X minutes.
- jonknee 13y ago
  > I'm still waiting on the reveal that they've stored geolocational data at regular timepoints of every X minutes. Considering Apple did that on your behalf I would be surprised if this was not the case. http://bits.blogs.nytimes.com/2011/04/20/3g-apple-ios-devices-secretly-storing-users-location/ http://bits.blogs.nytimes.com/2011/04/20/3g-apple-ios-device...
  - gress 13y ago
    Apple didn't store users location data. Cell tower positrons were cached on iOS devices, and this was turned into a false controversy because sensationalism sells. Citing this piece as if it asserts that Apple collects user location data in the way the parent poster fears the NSA might do is dishonest.
    - jonknee 13y ago
      Apple programmed a feature that cached all location data on a file on the iPhone. GCHQ's linked PowerPoint says "If it's on the phone, we can get it". Ergo, GCHQ and the NSA certainly had access to your cached location data if they wanted it. Maybe Apple intended this to be the case, maybe Apple did not, but the mere fact that the file existed is enough that it most certainly could have been scooped up by spooks.
      - gress 13y ago
        No. "All the location data" was not cached. Only cell tower locations. "Maybe apple intended this to be the case" is baseless innuendo and has no place here. "If it's on the phone, we can get it" has separately been shown only to apply when the agencies have physical access to the device to extract data or implant malware. You seem to want to spread the idea that spies can access the real-time location of your iPhone remotely - which is what the parent post was fearing, but for which there is no evidence. What is your motive here?
Spearchucker 13y ago
I find the two green slides (Capability - iPhone and Capability - Android) the scariest. Hot mic? Kernel stealth? And self protection? How many networks - knowingly or unknowingly - are delivering these things?
thisiswrong 13y ago
> It is time for a reboot, this time with much more focus on security. Here's a helping hand for those that don't know where to start: http://prism-break.org/ http://prism-break.org/
ChuckMcM 13y ago
The sad thing is that if I watched these sort of pronouncements in an episode of "Person of Interest" or some other show I would normally laugh them off like I do the infinite zoom/sharpen capability of security video.
- grkvlt 13y ago
  Interestingly, things like the zooming and enhancement of video similar to the TV capabilities often portrayed are also now easily accessible. Read about 'super-resolution' [1,2] techniques for more details. [1] https://en.wikipedia.org/wiki/Superresolution https://en.wikipedia.org/wiki/Superresolution [2] http://research.microsoft.com/en-us/um/people/cmbishop/downloads/Bishop-AIStats03-SuperRes.pdf http://research.microsoft.com/en-us/um/people/cmbishop/downl...

seanr 13y ago

Maps and other apps on the iPhone weren't using HTTPS in 08 (underpowered device, need to squeeze every last drop from battery). They do now however. It's not just a spy agency issue, anyone could have sniffed the unencrypted traffic.

streetnigga 13y ago
(underpowered device, need to squeeze every last drop from battery) Really now? Is that the official reasoning for not using HTTPS?
- TeMPOraL 13y ago
  Well, this is the most common argument before Snowdengate I heard against using HTTPS anywhere, not only on mobile devices.
- seanr 13y ago
  Back then it was.
  - streetnigga 13y ago
    I just don't recall anything official regarding that line of thought. Direct PR or otherwise. Is there any examples off the top of your head?
    - judk 13y ago
      "HTTPS is expensive" has been a widespread (stupid) meme since the invention of HTTPS. How old are you?
      - streetnigga 13y ago
        Old enough to know a non-answer when I see one. Again I ask: Any specific examples from companies or organizations that implement HTTP(S) in their products stating device power as reason for non-implementation?
        themartorana 13y ago
        I imagine it to be a horrible miscarriage of trust to not use HTTPS. We made the decision early on that handling any personal data not over HTTPS was massively irresponsible - and this is pre-Snowden. That said, if they have kernel-level hacks or can intercept and decode HTTPS (or sit and listen on say, any AWS server they want), what does HTTPS really matter against the NSA? Still, totally irresponsible - battery life is a constant struggle, but not enough to even make us consider changing our API client code.
        7952 13y ago
        The problem is that HTTPS is very difficult to audit, we just have to trust that it is being done correctly. How do you know that the apparently random stream of bits is actually properly encrypted and does not leak private data? It would be better to let the OS add the SSL layer and only let apps talk HTTP. This would give the user much more control.

cryoshon 13y ago

That was in 2008. Imagine what else they've been able to jimmy in 6 years! I'm still waiting on the reveal that they've stored geolocational data at regular timepoints of every X minutes.

jonknee 13y ago
> I'm still waiting on the reveal that they've stored geolocational data at regular timepoints of every X minutes. Considering Apple did that on your behalf I would be surprised if this was not the case. http://bits.blogs.nytimes.com/2011/04/20/3g-apple-ios-devices-secretly-storing-users-location/ http://bits.blogs.nytimes.com/2011/04/20/3g-apple-ios-device...
- gress 13y ago
  Apple didn't store users location data. Cell tower positrons were cached on iOS devices, and this was turned into a false controversy because sensationalism sells. Citing this piece as if it asserts that Apple collects user location data in the way the parent poster fears the NSA might do is dishonest.
  - jonknee 13y ago
    Apple programmed a feature that cached all location data on a file on the iPhone. GCHQ's linked PowerPoint says "If it's on the phone, we can get it". Ergo, GCHQ and the NSA certainly had access to your cached location data if they wanted it. Maybe Apple intended this to be the case, maybe Apple did not, but the mere fact that the file existed is enough that it most certainly could have been scooped up by spooks.
    - gress 13y ago
      No. "All the location data" was not cached. Only cell tower locations. "Maybe apple intended this to be the case" is baseless innuendo and has no place here. "If it's on the phone, we can get it" has separately been shown only to apply when the agencies have physical access to the device to extract data or implant malware. You seem to want to spread the idea that spies can access the real-time location of your iPhone remotely - which is what the parent post was fearing, but for which there is no evidence. What is your motive here?

Spearchucker 13y ago

I find the two green slides (Capability - iPhone and Capability - Android) the scariest. Hot mic? Kernel stealth? And self protection? How many networks - knowingly or unknowingly - are delivering these things?

thisiswrong 13y ago

> It is time for a reboot, this time with much more focus on security. Here's a helping hand for those that don't know where to start: http://prism-break.org/ http://prism-break.org/

ChuckMcM 13y ago

The sad thing is that if I watched these sort of pronouncements in an episode of "Person of Interest" or some other show I would normally laugh them off like I do the infinite zoom/sharpen capability of security video.

grkvlt 13y ago
Interestingly, things like the zooming and enhancement of video similar to the TV capabilities often portrayed are also now easily accessible. Read about 'super-resolution' [1,2] techniques for more details. [1] https://en.wikipedia.org/wiki/Superresolution https://en.wikipedia.org/wiki/Superresolution [2] http://research.microsoft.com/en-us/um/people/cmbishop/downloads/Bishop-AIStats03-SuperRes.pdf http://research.microsoft.com/en-us/um/people/cmbishop/downl...