4 ms·

>Not to mention, encrypted to the PSTN solves what, exactly? I presume, if one calls Germany, and the line is encrypted from the handset to Germany, then that

by cowbell 12y ago

>Not to mention, encrypted to the PSTN solves what, exactly? I presume, if one calls Germany, and the line is encrypted from the handset to Germany, then that person would be out of NSA's reach. I suspect that would make wiretaps more difficult as well, since police would need to tap who is called, instead of the caller. That's a lot more warrants and they need them in advance of a call... or they need every call recorded from the end points for later search.

dlgeek 12y ago
> I presume, if one calls Germany, and the line is encrypted from the handset to Germany, then that person would be out of NSA's reach. I would not make that assumption. While I have no evidence, there are plenty of ways the NSA could collect data along these paths - exploiting bugs in the switches, installing a beam splitter in fiber as it traverses a remote area, etc. etc.
mpyne 12y ago
Seems like a bad assumption to make. When Germany caught the U.S. spy recently, it was based on that German worker using a personal GMail account to email the Russian consulate. That email was magically intercepted by Germany's BND somehow, in what I'm sure has nothing at all to do with any sort of network surveillance measures in Germany targeting foreign intelligence. But just to be safe we should probably assume that BND is actually listening within Germany, just like the U.S. spy should have assumed BND could read his email.
xorcist 12y ago
But the PSTN is the easy part to wiretap. Especially the TDM part of it. Data is nicely partitioned in channels and there is only one single metadata format to worry about. And you can not compare the NSA with the police. The latter needs a warrant (sort of, depending on locale) but the former doesn't.
- cowbell 12y ago
  According to everything I've read on the subject, including today's revelation that NSA is recording 80% of all phone calls, is that NSA grabs from the backbone. They do not have monitoring installed at endpoints. That would be expensive, and in foreign countries, infeasible. It's hardly perfect, but I think everyone can agree it's better than unencrypted all the way. Everyone except the Friends of NSA trying to convince everyone to stay away, because "it isn't truly secure"... You've got to start somewhere.
  - xorcist 12y ago
    That's what I'm saying. The "backbone", by which I take it you mean the big PSTN providers, is by far the easiest point to wiretap. Internet exchange points are by design far more heterogenous, plus that wirespeed protocol parsers that has the ability to parse the plurality of protocols used is at least an order of magnitude more difficult/expensive. The five eyes do that as well, no doubt about it. But if you encrypt your traffic on IP and then switch out to unencrypted PSTN then that's completely useless as you'd risk drawing unnecessary attention to your plaintext.
    - cowbell 12y ago
      >But if you encrypt your traffic on IP and then switch out to unencrypted PSTN then that's completely useless as you'd risk drawing unnecessary attention to your plaintext. So the solution you suggest is to try to hide in plain sight? Good luck with that.
      - xorcist 12y ago
        Why would you think that? Am I really that unclear? If I had to venture a suggestion it would be to encrypt your data end-to-end.
        cowbell 12y ago
        lol. Right, because my mom's rotary phone will work like that. That's the "comprehensive reform" argument weaselly politicians use. Ex. Chuck Schumer works for the banking industry. The banking industry needs reform after financial crisis. Chuck blocks banking reform by demanding "comprehensive reform" and refuses to implement partial measures that would help/start the reform process. He claims he's strongly in favor of reform. So much he's unwilling to compromise for partial measures. As such, he votes against all measures of reform. Sure Chuck, we all believe you really want to reform the banks that paid for your elections. If end to PSTN can make it more expensive for the NSA to collect, then it's good, even if it isn't foolproof. If the default config for apache were to generate self signed certificates, you would say, that's useless, because MITM. I would say, that's great, because now NSA is forced to MITM if they want to snoop. It increases the expense for the attacker, making their ability to snoop more limited.

by cowbell 12y ago

dlgeek 12y ago

> I presume, if one calls Germany, and the line is encrypted from the handset to Germany, then that person would be out of NSA's reach. I would not make that assumption. While I have no evidence, there are plenty of ways the NSA could collect data along these paths - exploiting bugs in the switches, installing a beam splitter in fiber as it traverses a remote area, etc. etc.

mpyne 12y ago

Seems like a bad assumption to make. When Germany caught the U.S. spy recently, it was based on that German worker using a personal GMail account to email the Russian consulate. That email was magically intercepted by Germany's BND somehow, in what I'm sure has nothing at all to do with any sort of network surveillance measures in Germany targeting foreign intelligence. But just to be safe we should probably assume that BND is actually listening within Germany, just like the U.S. spy should have assumed BND could read his email.

xorcist 12y ago

But the PSTN is the easy part to wiretap. Especially the TDM part of it. Data is nicely partitioned in channels and there is only one single metadata format to worry about. And you can not compare the NSA with the police. The latter needs a warrant (sort of, depending on locale) but the former doesn't.

cowbell 12y ago
According to everything I've read on the subject, including today's revelation that NSA is recording 80% of all phone calls, is that NSA grabs from the backbone. They do not have monitoring installed at endpoints. That would be expensive, and in foreign countries, infeasible. It's hardly perfect, but I think everyone can agree it's better than unencrypted all the way. Everyone except the Friends of NSA trying to convince everyone to stay away, because "it isn't truly secure"... You've got to start somewhere.
- xorcist 12y ago
  That's what I'm saying. The "backbone", by which I take it you mean the big PSTN providers, is by far the easiest point to wiretap. Internet exchange points are by design far more heterogenous, plus that wirespeed protocol parsers that has the ability to parse the plurality of protocols used is at least an order of magnitude more difficult/expensive. The five eyes do that as well, no doubt about it. But if you encrypt your traffic on IP and then switch out to unencrypted PSTN then that's completely useless as you'd risk drawing unnecessary attention to your plaintext.
  - cowbell 12y ago
    >But if you encrypt your traffic on IP and then switch out to unencrypted PSTN then that's completely useless as you'd risk drawing unnecessary attention to your plaintext. So the solution you suggest is to try to hide in plain sight? Good luck with that.
    - xorcist 12y ago
      Why would you think that? Am I really that unclear? If I had to venture a suggestion it would be to encrypt your data end-to-end.
      - cowbell 12y ago
        lol. Right, because my mom's rotary phone will work like that. That's the "comprehensive reform" argument weaselly politicians use. Ex. Chuck Schumer works for the banking industry. The banking industry needs reform after financial crisis. Chuck blocks banking reform by demanding "comprehensive reform" and refuses to implement partial measures that would help/start the reform process. He claims he's strongly in favor of reform. So much he's unwilling to compromise for partial measures. As such, he votes against all measures of reform. Sure Chuck, we all believe you really want to reform the banks that paid for your elections. If end to PSTN can make it more expensive for the NSA to collect, then it's good, even if it isn't foolproof. If the default config for apache were to generate self signed certificates, you would say, that's useless, because MITM. I would say, that's great, because now NSA is forced to MITM if they want to snoop. It increases the expense for the attacker, making their ability to snoop more limited.