4 ms·

In the current state of affairs, lawful intercept/ PRISM devices on Google's network can potentially see everything behind the SSL layer. The global passive att

by zmanian 12y ago

In the current state of affairs, lawful intercept/ PRISM devices on Google's network can potentially see everything behind the SSL layer. The global passive attacker can see all incoming and outgoing emails between providers that don't use StartTLS. Google needs to provide the email history < 6 months of US person in response to a administrative subpoena and >6 months with a warrant. Let say Google made a key directory and end 2 end encryption possible in Gmail but Google held the keys. This would frustrate blanket lawful intercept and the global passive attacker. Google might be able to legally argue that turning over keys requires a proper warrant. They might be able to defend against falsifying the key directory because of external audits.This is roughly where Apple is with iMessage. If Google goes a step further and only stores an encrypted key or keeps the key client side, now we have the legal terrain of the Government asking a software provider to maliciously modify their software to obtain keys or a passphrase. I think this legal battle is coming. We might be able to preempt it with software verification techniques but definitely coming down the pipe.

Zigurd 12y ago
IANAL but I did write a "lawful intercept" (LI) spec for a type of infrastructure router. As far as I know, most places in what we'd call "the free world" don't compel carriers to do anything to thwart users from protecting their payloads, nor do they compel carriers to actively deny service to encrypted payloads or even discourage use of encryption. Even if individuals can be compelled to hand over keys, it isn't the carriers' problem. Empirically, we know that, for about a year, Google, Yahoo, etc. have been bitching about PRISM, but not doing anything to make it more convenient for their customers to encrypt their payloads. Is there some secret law? Heavy-handed pressure? Or did they just spend a lot of time wishing the privacy thing would just go away? This will be an interesting test to see just how much freedom Our Benevolent Overlords think we can handle.
panarky 12y ago
> PRISM devices on Google's network can potentially see everything behind the SSL layer Is there evidence of this, or is this your assumption? I'm aware that NSA monitored unencrypted data transfers between data centers on Google's dedicated fiber circuits, but as far as I know that was accomplished through telcos and not Google. Google said they've now encrypted the circuits between data centers, and they've strenuously denied allowing monitoring devices to reside on their network. Is there another exploit I'm not aware of?
- contingencies 12y ago
  they've strenuously denied allowing monitoring devices to reside on their network This is potentially a legal requirement for them, issued by the government, that they have no control over.
  - panarky 12y ago
    > potentially a legal requirement for them We've learned more than enough real facts from Snowden's disclosures that we don't need to make up hypotheticals. There is plenty of evidence that security services are out of control, and that corporations are collaborating with them. There is no evidence that Google allowed any government agency to embed monitoring devices in their network.
    - contingencies 12y ago
      It's not hypothetical. Such restrictions are routine in other arms of government investigation, eg. money laundering.
lern_too_spel 12y ago
There is no "blanket lawful intercept" in the US or any "PRISM devices on Google's network." You seem to be confusing several different NSA leaks. GCHQ's MUSCULAR program apparently tapped Google's leased lines into the UK, giving them access to Google's unencrypted internal traffic entering that country. That's the closest report to any security agency having devices on Google's network. Google says they no longer have unencrypted traffic on those connections. PRISM is an NSA system that accesses FBI DITU electronic wiretap data, which contains data the companies send to the FBI for specific users the government presented a court order for.
- zmanian 12y ago
  So the PRISM consist of FBI electronic wiretap portals/devices within a company's infrastructure. Now we know the FBI will generally require a court order or an NSL before accessing the portal to request user information. No one has been clear about what the role of the NSA is in these devices are. 1. They could just be administering the system for the FBI. 2. They could be copying all the data that goes to the FBI into their corporate store. 3. They could be applying 51% probability foreign standard to any data they can see with theses devices. I've seen this question asked of numerous tech executives and no one is able to give a good answer so I'm suspicious. What Bruce Schneier keeps telling us is that the NSA's email interception is robust, they wrap a program in multiple overlapping legal justifications.
  - lern_too_spel 12y ago
    The FBI doesn't have devices in the companies' infrastructure either. The companies configure their own servers to forward specific users' data to the FBI's servers off-premises. http://www.wired.co.uk/news/archive/2013-06/12/google-prism-ftp http://www.wired.co.uk/news/archive/2013-06/12/google-prism-...
    - zmanian 12y ago
      Google is the only company to deny having FBI/NSA devices on their network. When Spylockout asked Apple's general counsel about devices on their network, we could not get a denial. Apple also made iMessage e2e encrypted for a reason... I'm really supportive of Google's efforts to genuinely protect user privacy. I think they are correct if they believe the only ultimate guarantee of user privacy is end to end encryption in the current legal environment in the US.

by zmanian 12y ago

Zigurd 12y ago

IANAL but I did write a "lawful intercept" (LI) spec for a type of infrastructure router. As far as I know, most places in what we'd call "the free world" don't compel carriers to do anything to thwart users from protecting their payloads, nor do they compel carriers to actively deny service to encrypted payloads or even discourage use of encryption. Even if individuals can be compelled to hand over keys, it isn't the carriers' problem. Empirically, we know that, for about a year, Google, Yahoo, etc. have been bitching about PRISM, but not doing anything to make it more convenient for their customers to encrypt their payloads. Is there some secret law? Heavy-handed pressure? Or did they just spend a lot of time wishing the privacy thing would just go away? This will be an interesting test to see just how much freedom Our Benevolent Overlords think we can handle.

panarky 12y ago

> PRISM devices on Google's network can potentially see everything behind the SSL layer Is there evidence of this, or is this your assumption? I'm aware that NSA monitored unencrypted data transfers between data centers on Google's dedicated fiber circuits, but as far as I know that was accomplished through telcos and not Google. Google said they've now encrypted the circuits between data centers, and they've strenuously denied allowing monitoring devices to reside on their network. Is there another exploit I'm not aware of?

contingencies 12y ago
they've strenuously denied allowing monitoring devices to reside on their network This is potentially a legal requirement for them, issued by the government, that they have no control over.
- panarky 12y ago
  > potentially a legal requirement for them We've learned more than enough real facts from Snowden's disclosures that we don't need to make up hypotheticals. There is plenty of evidence that security services are out of control, and that corporations are collaborating with them. There is no evidence that Google allowed any government agency to embed monitoring devices in their network.
  - contingencies 12y ago
    It's not hypothetical. Such restrictions are routine in other arms of government investigation, eg. money laundering.

lern_too_spel 12y ago

There is no "blanket lawful intercept" in the US or any "PRISM devices on Google's network." You seem to be confusing several different NSA leaks. GCHQ's MUSCULAR program apparently tapped Google's leased lines into the UK, giving them access to Google's unencrypted internal traffic entering that country. That's the closest report to any security agency having devices on Google's network. Google says they no longer have unencrypted traffic on those connections. PRISM is an NSA system that accesses FBI DITU electronic wiretap data, which contains data the companies send to the FBI for specific users the government presented a court order for.

zmanian 12y ago
So the PRISM consist of FBI electronic wiretap portals/devices within a company's infrastructure. Now we know the FBI will generally require a court order or an NSL before accessing the portal to request user information. No one has been clear about what the role of the NSA is in these devices are. 1. They could just be administering the system for the FBI. 2. They could be copying all the data that goes to the FBI into their corporate store. 3. They could be applying 51% probability foreign standard to any data they can see with theses devices. I've seen this question asked of numerous tech executives and no one is able to give a good answer so I'm suspicious. What Bruce Schneier keeps telling us is that the NSA's email interception is robust, they wrap a program in multiple overlapping legal justifications.
- lern_too_spel 12y ago
  The FBI doesn't have devices in the companies' infrastructure either. The companies configure their own servers to forward specific users' data to the FBI's servers off-premises. http://www.wired.co.uk/news/archive/2013-06/12/google-prism-ftp http://www.wired.co.uk/news/archive/2013-06/12/google-prism-...
  - zmanian 12y ago
    Google is the only company to deny having FBI/NSA devices on their network. When Spylockout asked Apple's general counsel about devices on their network, we could not get a denial. Apple also made iMessage e2e encrypted for a reason... I'm really supportive of Google's efforts to genuinely protect user privacy. I think they are correct if they believe the only ultimate guarantee of user privacy is end to end encryption in the current legal environment in the US.