10 ms·

THESE DOCUMENTS CONTAIN EVIDENCE OF ATTACKS ON VPN, SSL, TLS, SSH, TOR. What do we do now? No seriously, what do we do? The full list of documents: http://www.

• aurelius 12y ago
  Stop doing illegal things, and then be glad that NSA are working hard to catch the real bad guys?
  • akiselev 12y ago
    You mean cease all opposition to those in power, forget about the security of our information systems, and be glad that the NSA is working hard to catch the real dissidents? Silly me, should have stayed in Russia.
    • pasta_2 12y ago
      Is there any evidence that the NSA has targeted dissidents?
      • nsmartt 12y ago
        Some will say that it’s necessary to balance privacy against security, and that it’s important to find the right compromise between the two. Even if you believe that, a good negotiator doesn’t begin a conversation with someone whose position is at the exact opposite extreme by leading with concessions. And that’s exactly what we’re dealing with. Not a balance of forces which are looking for the perfect compromise between security and privacy, but an enormous steam roller built out of careers and billions in revenue from surveillance contracts and technology. To negotiate with that, we can’t lead with concessions, but rather with all the opposition we can muster. http://thoughtcrime.org/blog/we-should-all-have-something-to-hide/ http://thoughtcrime.org/blog/we-should-all-have-something-to...
      • sandstrom 12y ago
        Although I haven't gone through and fact checked all these articles, here are a few prospects: - http://rt.com/usa/evidence-nsa-illegally-monitored-senators-361/ http://rt.com/usa/evidence-nsa-illegally-monitored-senators-... - http://www.huffingtonpost.com/2014/07/09/nsa-glenn-greenwald_n_5545686.html http://www.huffingtonpost.com/2014/07/09/nsa-glenn-greenwald... - http://www.theguardian.com/world/2013/oct/04/nsa-gchq-attack-tor-network-encryption http://www.theguardian.com/world/2013/oct/04/nsa-gchq-attack... - http://www.theguardian.com/uk-news/2014/jul/14/gchq-tools-manipulate-online-information-leak http://www.theguardian.com/uk-news/2014/jul/14/gchq-tools-ma... - https://www.aclu.org/human-rights-national-security/report-finds-nsa-surveillance-harming-journalism-and-law https://www.aclu.org/human-rights-national-security/report-f... - http://www.theguardian.com/world/2013/aug/18/glenn-greenwald-guardian-partner-detained-heathrow http://www.theguardian.com/world/2013/aug/18/glenn-greenwald...
        • csandreasen 12y ago
          None of those links answers his question... 1 - Is describing activity that happened half a century ago before a whole number of legislative actions to change the way the NSA does business 2 - Is essentially a summary of an Intercept article where Glenn Greenwald shows FBI surveillance of 5 US citizens, not NSA 3 - Talks about trying to break Tor; doesn't describe who is being targeted 4 - Talks about journalists scared about surveillance; no evidence of NSA targeting them 5 - Talks about Glenn Greenwald's husband being held up and searched by UK border control for ferrying classified information To respond to the GP's question: I've seen a lot of claims that it's obvious that every one of us is being monitored. I've yet to see any evidence backing it up.
          • declan 12y ago
            > I've seen a lot of claims that it's obvious that every one of us is being monitored. I've yet to see any evidence backing it up. Huh? That was the first Snowden leak. I summarized it in this article for CNET at the time: http://www.cnet.com/news/nsa-secretly-vacuumed-up-verizon-phone-records/ http://www.cnet.com/news/nsa-secretly-vacuumed-up-verizon-ph... TLDR: The leak was a copy of the secret FISA court order allowing the NSA to vacuum up pretty much every American's phone records, including local phone calls, "on an ongoing daily basis." I suspect that most people would view that as monitoring. That's not counting the separate questions of bulk fiber taps (collect it all) and the Obama administration's secret AG opinion blessing warrantless bulk collection of encrypted communications (decrypt it later), which I wrote about here: http://www.cnet.com/news/nsa-can-eavesdrop-on-americans-phone-calls-documents-show/ http://www.cnet.com/news/nsa-can-eavesdrop-on-americans-phon... "Another loophole is... "enciphered" data. Communications that contain "enciphered" data, which would likely include PGP but also could mean encrypted Web connections using SSL, may be kept indefinitely."
      • akiselev 12y ago
        (thanks for the links sandstrom) There wasn't much public evidence of what J. Edgar Hoover was doing until well after the fact. Personally, I feel the burden of proof falls on the near-omniscient spy agency that brazenly lies and reinterprets basic diction to sterilize all methods of oversight. Again, silly me.
      • deleted 12y ago
        [deleted]
        • jacquesm 12y ago
          There's a couple of graveyards full of them. How much evidence do you want?
          • xnull2guest 12y ago
            If you are speaking about insurgent groups in the Middle East, it's sort of confusing. I would suggest that even ISIL isn't a terrorist group, at least in the same sense that the word terrorism has been used throughout the past 100 years. ISIL represents 30k mobilized personel, are made up of a huge number of disparate factions (some fighting for a three state solution - which would actually be a great improvement in the organization of the middle east, whose lines right now were drawn by the British and have nothing to do with historical or cultural boundaries), are fighting with traditional armies with traditional warfare weaponry and because they are fighting for political change in a state where authoritarian governments with financial and political ties to outside nations has limited how much they can represent their people. ISIL to me, if I use textbook comparisons, looks more like an grassroots insurgent army fighting for political representation. How could an army of 30k people be 'terrorists'? 'Terrorist' is the new 'communist'. It's a label you put on someone you want your people to fear and hate.
      • deleted 12y ago
        [deleted]
      • TheCondor 12y ago
        Is there any evidence that they actually target terrorists? Collectively, we all need to keep beating this drum. Fundamentally, there are very very few terrorists. Very very few, if any, are in America. What's the bulk collection failure rate? 99.999999% ? And at what cost? It's astronomically expensive and out of all the leaks, what evidence is there that we've stopped a terrorist in America or any of her close allies' teritory where they are effectively spying on innocent tax paying civilians? It's just making some contractors wealthy
        • xnull2guest 12y ago
          Reprising a comment. It's not about terrorism. Never was. That's just how the deep state sells it to voters. If you look at the Snowden documents (and leaks by others) you'll see essentially nothing other than the international nature of the programs. For example, you'll remember from the Snowden leaks that the NSA hacked the Brazilian oil company PETROBRAS to help American oil companies win offshore oil drilling locations. The hacking of Merkle's cell phone was a big deal because it revealed that the US had information from Germany _during the Eurozone crisis_! Stuxnet was used to destroy Iran's nuclear program. The US also faces the same sort of pressure from other countries. This year alone the DoD was hacked, Wall Street, NASDAQ and JP Morgan were hacked and hundreds of defense contractors were hacked - all with foreign attribution. Israel's Iron Dome designs were hacked by China. Take a look at the NSA program HACIENTA, which "is used to port scan entire countries" and which uses other compromised (civilian) computers to disguise attribution. Look at The Intercept reporting (where Glenn Greenwald is right now). He speaks at length about how the US uses NSA operations to benefit the global bargaining posture and competitiveness of US companies. https://firstlook.org/theintercept/2014/09/05/us-governments-plans-use-economic-espionage-benefit-american-corporations/ https://firstlook.org/theintercept/2014/09/05/us-governments... And take the Inspector General's report from the Boston Bombings - a great example of how and when the NSA domestic programs would be used if they were about terrorism. The NSA is hardly mentioned. The Inspector General investigates the failings of the FBI. (http://info.publicintelligence.net/IC-IG-BostonBombingReport.pdf http://info.publicintelligence.net/IC-IG-BostonBombingReport...) "We focused our review on the entities that were the most likely to have had information about Tamerlan Tsarnaev prior to the bombings – the FBI, the CIA, DHS, and NCTC, which maintains the U.S. government’s database of classified identifying and substantive derogatory information on known or suspected terrorists. We also requested other federal agencies to identify relevant information they may have had prior to the bombings. These agencies included the Department of Defense (including the National Security Agency (NSA)), Department of State, Department of the Treasury, Department of Energy, and the Drug Enforcement Administration." The report on the failures to anticipate/stop the Boston Bombers barely mention the NSA. This is because the Federal Bureau of Investigation and the National Counterterrorism Center are in charge of counterterrorism, not the National Security Agency. Or go to the NSA's own mission statement. (https://www.nsa.gov/about/mission/index.shtml https://www.nsa.gov/about/mission/index.shtml) "The National Security Agency/Central Security Service (NSA/CSS) leads the U.S. Government in cryptology that encompasses both Signals Intelligence (SIGINT) and Information Assurance (IA) products and services, and enables Computer Network Operations (CNO) in order to gain a decision advantage for the Nation and our allies under all circumstances." (Nothing to do with terrorism.) Lots of news recently has called out Executive Order 12333's role in defining the goal and the means of intelligence capabilities. EO 12333 was passed in 1981. The Five Eyes, the key partnership of the NSA, has its origins in the 40's and ECHELON and other leaked programs (eg CARNIVORE/PREDATOR) predate 9/11 by decades. The Snowden leaks disclose a list with over thirty countries with competing digital intelligence programs. The NSA is not about terrorism. Never was. Never will be. The NSA and CSS are the intelligence arm of the United States. New Zealand's programs are similarly not about terrorism (what terrorists are attacking New Zealand?). Digital communications play a huge role in global communications and corporate and international power. Reprised comment from here: https://news.ycombinator.com/item?id=8370973 https://news.ycombinator.com/item?id=8370973
      • xnull2guest 12y ago
        So-called Fusion Centers have, and they get help from way on up high.
    • aurelius 12y ago
      I never said anything about leaving our systems insecure. It's in the best interests of America to use security technologies to protect our national infrastructure. We should always be trying to make our country more secure. We should also be glad that NSA is able to find ways to catch people who abuse these security technologies to hurt our country. If you're using cryptographic and anonymizing technologies for legitimate and legal purposes, then you should rest easy knowing that NSA is putting the smack down on the abusers. If you're using those technologies for illegal, subversive, or anti-American things, then you should be worried. I hear Federal prison isn't fun. Look, you're still free to disagree with what the government does and work to change it in legitimate and legal ways. That's what makes America great. That's what NSA is working to protect. IMHO, it sounds like you should've stayed in Russia.
      • sarciszewski 12y ago
        > If you're using cryptographic and anonymizing technologies for legitimate and legal purposes, then you should rest easy knowing that NSA is putting the smack down on the abusers. I would rest easy if I knew the attacks they leverage against legitimate and legal users were not effective, so that people with criminal intentions would have a lower success rate.
      • dang 12y ago
        > it sounds like you should've stayed in Russia. Personal attacks are not allowed on Hacker News.
        • asdfasdfag 12y ago
          Fuck You!
        • twoodfin 12y ago
          C'mon. If the condescension of "Silly me, should have stayed in Russia" is kosher, so should be "Yeah, sounds like you should have." I'd prefer neither, but you made a point of calling out the latter.
          • deleted 12y ago
  • code_duck 12y ago
    That would be reassuring if we could be confident that truly the activities of the NSA and government agencies were only used as intended to thwart serious crime, in ways that were not harmful or invasive for innocent citizens.
  • sarciszewski 12y ago
    The JTRIG is strong in this one.
• Zirro 12y ago
  "What do we do now? No seriously, what do we do?" In addition to encouraging the NSA (and equivalent agencies in other countries) to change its approach, developers will do what we always do and build new secure protocols and tools with the lessons from previous attempts in mind. It is a cat-and-mouse game that will never cease.
  • jmnicolas 12y ago
    Sure but their job is infinitely easier than ours : they have the resources, unity and will to breach us. We are a bunch of disorganized folks with no budget and with no agreed goal on what is the best way to achieve this. Also in defense you have to protect all the walls, in attack you just have to breach one. I'm not saying we should do nothing, but that they will almost always be several steps ahead of us.
    • razster 12y ago
      Little do you know about some of these "disorganized" folks. All in due time. Seems your doubts are what helps the NSA.
• spacefight 12y ago
  One goodie is how they break VPN, inclusive some targets: http://www.spiegel.de/media/media-35515.pdf http://www.spiegel.de/media/media-35515.pdf Airlines: - Iran Air - Royal Jordanian - Transaero Airlines Govs: - Mexico - Pakistan - Turkey - Afghanistan Slides 41/42.
  • yuhong 12y ago
    I wonder what exactly do they use to brute force DES, especially in the PPTP attacks.
    • deleted 12y ago
      [deleted]
    • zaroth 12y ago
      Something like this: https://www.cloudcracker.com/blog/2012/07/29/cracking-ms-chap-v2/ https://www.cloudcracker.com/blog/2012/07/29/cracking-ms-cha...
  • selimthegrim 12y ago
    I like how slides 24/25 are basically "No means Yes! Yes means Anal!"
• nodata 12y ago
  Let's adopt a new protocol that is less tested! Oh wait, we can't do that. Let's fix what is broken!
• freeduck 12y ago
  Earlier this year at goto copenhagen I heard a good talk by Tim bray: http://gotocon.com/cph-2014/presentation/Privacy%20and%20Security,%20Policy%20and%20Technology http://gotocon.com/cph-2014/presentation/Privacy%20and%20Sec... Where he argues that even though we can not achieve complete security there is great value in raising the bar. If we continuously make it increasingly harder for NSA, MOSAD, GCHQ and the rest of them to spy on us, we can achieve good enough privacy. Where most communication will be secure. But he also argues that if one of these agencies really wants to target YOU specifically they will get to the information. By breaking into your house and installing cameras, if necessary.
  • username223 12y ago
    It's Michens' MOSSAD/not-MOSSAD question[1]. Any half-decent encryption will protect you from bulk collection and monitoring, but if you're targeted, you lose. [1] http://research.microsoft.com/en-us/people/mickens/thisworldofours.pdf http://research.microsoft.com/en-us/people/mickens/thisworld...
    • peterkelly 12y ago
      That has to be the best paper I've ever read
      • deleted 12y ago
        [deleted]
      • STRML 12y ago
        I thought you were joking, but I had to click anyway. You're right, this paper is fantastic. I thought Micken's stopped writing, I'm so glad he didn't.
    • merrua 12y ago
      That was fun. I'm going to read all the rest of his stuff now. Thats dangerous linking, username223.
    • Intermernet 12y ago
• onewaystreet 12y ago
  Why the need to do anything? Do you think the NSA, etc. cares about you? They don't.
  • ss03kkd 12y ago
    And when some group which fits your definition of "bad guys" finds the same flaws and uses that to attack "good guys"?
    • venomsnake 12y ago
      We have the Sony hack. Although this was like bad guys attacking unpleasant guys.
  • dombili 12y ago
    How do you explain the fact that they spend hundreds of millions of dollars just to break these protocols then? Enough with this "NSA doesn't care about you" argument already.
    • onewaystreet 12y ago
      That's literally their job. You should want the NSA looking into every protocol. What they do if they find weaknesses is a different question.
      • dombili 12y ago
        I didn't say that's not their job. I'm opposing to what you're saying. Their job is to spy on us, yet you claim they don't care about us. Can you see why I'm confused? >What they do if they find weaknesses is a different question. Is it? It's obvious what they're going to do when they find those weaknesses. If they let people know of those weaknesses, they wouldn't be doing their job. Their job is to expose those weaknesses, so they can spy on us and take away whatever we have left, in this case is strong encryption.
        • 12y ago
• deleted 12y ago
  [deleted]
• unclebucknasty 12y ago
  >EVIDENCE OF ATTACKS ON VPN, SSL, TLS, SSH, TOR. What do we do now? This is why advocating for technical defenses alone is doomed to fail. It's great to employ as much technology as we can, but playing cat-and-mouse with our own government is a losing proposition. They are determined and have unlimited resources (read our money plus the printing press). There needs to be much more pressing on the legal front, such that unwarranted breach of privacy is criminally punishable in very clear ways. If an individual is not the subject of an investigation, for which proper warrants have been obtained, then no records of any kind should be collected or maintained. Full-stop. And efforts to decrypt private communications, etc. should be considered criminal acts. All of this needs to be protected with very clear and robust whistle-blower laws. Otherwise, thinking that we will deploy some tech to permanently stymie our government is fantasy. And over-focus on that aim tacitly cedes that our government is entitled to whatever it can crack.
• logn 12y ago
  I do not have confidence in an engineering fix. Fixes will be broken. It's possible to use encryption to thwart marketers or cyber-crime rings, but we'll never have a sustainable edge on intel agencies without policy changes. That said, better encryption will raise the cost of NSA's surveillance which might eventually lead to policy reform (when budget hawks are forced to act). And it might mean their dragnets have to be more targeted which could slow the expanding the definition of "terrorist". I think the most effective actions would be to make the public outraged over cracked encryption and surveillance. And even with all these leaks, that hasn't happened IMO (debatable I know). Outrage would happen if people understood how this has real-life effects. Storytelling is what's needed, not white-papers and tech blogs. edit: wanted to add that Bruce Schneier gave an excellent talk on the topic of your question, https://www.youtube.com/watch?v=3v9t_IoOgyI https://www.youtube.com/watch?v=3v9t_IoOgyI
  • jmnicolas 12y ago
    "cracked encryption" is not the problem, after all it's their job to do it. The problem is that they use it to listen on non legitimate targets like random civilians.