Hacker News Reader

Comment by 5350-uiop-1130 | Hacker News Reader

i simply prefer not to believe anything that any government or any trillion dollar company says about encryption and privacy.

Apple:

> "We have never heard of PRISM", "We do not provide any government agency with direct access to our servers"

https://web.archive.org/web/20130609061546/https://www.culto...

..some things are just not discussed on public forums.

View on HN

As far as "We have never heard of PRISM", that could be true. When you receive a national security letter it isn't like they give you detailed info about the specific operation and why you are receiving it. It's more along the lines of "you're going to do this pursuant to US code section..."

What's more, a National Security Letter is not necessarily addressed to the company's executives and lawyers. A National Security Letter could be send to somebody lower in the organization, closer to the targeted data (for instance a sysadmin) with a clause threatening them with prison time if they tell anybody, even their boss or company lawyers about it.

They can essentially conscript anybody in the company to work as a spy using (probably bullshit but still intimidating) legal threats to keep them quiet.

I didn't consider that, but it aligns with my experience as well. From a C-Level perspective that is probably desirable as they don't want to get involved with that sort of thing in the first place.

Is there any evidence that low-level people have been targeted, or is this just speculation around what could happen?

Yes, "evidence for a secret program" is a bit tricky to produce, but the one I know of - Doe v. Ashcroft - the president of the company was compelled to produce data. I'd be very surprised if this wasn't the universal approach.

This sounds scary, but unlikely. Do you have a source that this tactic is used and effective?

My immediate reaction to such a letter would be to contact the company legal department regardless of whether the letter said not to, simply because I'd assume unless given very good evidence (and originating from a .gov domain isn't good enough) that it was a scam.

Edit: According to the EFF you can talk to an attorney about an NSL.

https://www.eff.org/issues/national-security-letters/faq#24

I would not suggest taking legal advice from the EFF. You might as well contact the sovereign citizen movement at that point.

Letters can be intercepted, letters have tracking, letters of this magnitude will require certification, and at the very least will require a courier. All of that assumes the letter can be delivered, and also assumes that the recipient believes that the letter is authentic. If I sent you an authentic looking NSA letter, would you just do what you're told? Fat chance...

An email/phone call to a legal department is much less work and provides all the same protections.

Even internally at Apple is it common to work on projects that you do not know the name or details of. I was disclosed and worked on multiple projects that my own team members were not aware of.

Why?

Why what?

Why would you not know the name or details of a project you are working on?

Testing voice recognition models in preps of the initial HomePod is one example, but quite a few software services built for unreleased hardware would do this.

Why?

It might not be cited on any given NSL, but saying they've never heard of it when it's received ample news coverage is disingenuous.

While it's correct that they had never heard of PRISM, PRISM has nothing to do with NSLs. It ingests data from FISA Section 702 requests.

We now know that PRISM was (is?) the NSA internal source designation for data acquired through FISA warrants executed by the FBI.

So actually Apple was being honest. They had not heard of PRISM, because that term was only used inside the NSA. And they were not allowing direct government access to their servers, they were responding to FISA warrants.

While technically true, it's also a complete BS. It's in the same vain as Torrent websites are not hosting copyrighted content - technically true but complete BS.

But they are actually not hosting it.

If we are being pedantic, one can claim that all data, can be very well anything because there is always a "one-time pad" transforming all communication into something malicious.

If the law is not precise, then it is on the government to improve it.

I agree. If we stated that torrent sites are hosting it then what other systems are implicated? eg: DNS itself provides a pointer to the torrent sites which then have a pointer to the data.

Prism also involved an NSA program that was done without the knowledge of the tech companies. They inserted a splitter on the fiber lines leaving data centers to copy all the traffic.

That could be true? IIRC, PRISM was less about direct access, and more about abusing every potential method of gaining information.

For example, imagine a Login page that said, "Password incorrect," versus "User does not exist." If you have "User does not exist," you could use that to figure out whether a given email address has an account with a service. That could be useful information to PRISM when looking for a target to subpoena or monitor. (This is also why it's now best practice to just say "Login incorrect" or something vague that doesn't say whether the username, or the password, was wrong.)

Though, I could be wrong, I'd love more info.

> That could be true? IIRC, PRISM was less about direct access, and more about abusing every potential method of gaining information.

Direct access to the data was mentioned in the Guardian and other newspapers

Newspapers often get details wrong.

And mega-corporations often lie.

They got that from the leaked documents though

It was not mentioned in the leaked documents that the Guardian published. Instead, it said that the data came "directly from" the tech companies (who responded to wiretap requests on specific accounts). Greenwald couldn't be bothered to understand what the documents said and hallucinated the phrase "direct access" like a low capacity language model, but we on HN are functionally literate.

More info?

It goes further than just the error message. I think the original exploit was based on how quickly Unix would fail to login. (Bad user failed faster than bad password) and that allowed you to enumerate the user names.

Does anybody remember one December where Apple shut down all the developer systems. It had the feel to me at the time that it was a hack by it's suddenness.

I have always associated that period with the discovery of Prism. I would love to hear if anybody knows what I'm talking about.

Apple has perfected their virtue signaling game and all the simps love it.

I don't really mind it either anymore, a lot of people have this hero worship fetish and they can't help painting everything in black and white, even though they're all just different shades of gray.

Apple is definitively brighter on that scale then Google or Meta, but they're all corrupt multinational corporations that will do everything they can get away with to increase their bottom line.

You knowing this, by the tone of your writing, what do YOU do about it? What computer are you working on right now? Are you sure every component on it is legit? I take it you're using some for of Linux because they're not "corrupt" (well, depending on what distro as even that is a big debate).

Or do you live and operate like RMS?

Can you please not post in the flamewar style? We're trying for something else here, and you can make your substantive points without any of that.

https://news.ycombinator.com/newsguidelines.html

Reply on news.ycombinator.com