Hacker News Reader

Comment by greyface- | Hacker News Reader

> authorities [...] would force them to install [...] flow logging

This doesn't necessarily require Cloudflare's cooperation. Remember when the NSA tapped Google's internal network without their knowledge? SSL added and removed here :-)

View on HN

But it becomes significantly easier if Cloudflare performs this cooperation; most ISPs are required to maintain such data as well.

That Google incident sounds interesting, do you have links to the technical explanations? From a quick search all I could find are news reports.

It's from the OG PRISM slides. Previously Google's internal production network didn't use encryption, SSL/TLS was terminated at the perimeter. So the NSA simply tapped their dark fiber between data centers.

Not really internal. Long distance fiber lines between sites, mostly leased.

They were DC<->DC fiber links, carrying unencrypted Stubby RPC traffic. Internal is an accurate descriptor.

Suffice to say internal to Google's network architecture at the time, subsequently remediated with encryption, but physically external to Google DCs.

It did raise a fascinating question about where the physical tap was and how the take was routed back.

You do the tap at a hub, and you have the egress connectivity, but you're one unexpected employee away from discovery.

You do the tap in the middle of nowhere, and how do you get the data stream back?

I'd guess they went rural and just leased physically adjacent dark fiber to route out on.

The return routes are most likely in the same run but just a different strand. I think this is the way underwater cables are tapped - no need for a completely new run back.

Level 3 basically admitted they did it for them, so it would have been at a hub.

Reply on news.ycombinator.com