Gmail security warnings for suspected state-sponsored attacks
googleonlinesecurity.blogspot.com
googleonlinesecurity.blogspot.com
http://en.wikipedia.org/wiki/National_security_letter
China reading your mail: Big red flag.
USA reading your mail: Business as usual.
Unfortunately the US is trying to deny that, with less and less success, but that's where we're at today.
I just think it's shitty of them to make such a noise about non-US state-sponsored surveillance, but remain relatively silent on the thousands and thousands unconstitutional USA PATRIOT wiretaps they get every single month.
(I can't recall if the ToS refer to US or EU)
Gmail has state mandated backdoors. No combination of increased password complexity or multi-factor authentication will prevent these backdoors from being used (or abused) to access your account. Have a nice day.
Anonymous mails accepted at sneak@datavibe.net. Include bitcoin address for payment. Don't bother with fakes - I've seen quite a few 'shops in my time, and can tell from some of the pixels.
I think Julian Assange, Bradley Manning, and Dmitry Sklyarov may disagree with you.
I'm not sure you understand the implications of "charges dropped". Sometimes that can consume 5+ years of one's life, sometimes part or all of that imprisoned. It always costs a fortune, too.
If you aren't aware of what the US is planning for Assange, you're not paying attention. This is the same government that thinks that people at the New York Times should be indicted for espionage.
http://articles.businessinsider.com/2011-01-05/entertainment...
... at the same time as they feed the New York Times the leaks and favored access it needs to adequately serve its propaganda function, http://www.nytimes.com/2012/06/01/world/middleeast/obama-ord... being one recent example.
Chomsky likens the NYT to a court stenographer, which I think is such a delicious phrase. Fun documentary version of one of his most famous books: http://www.hulu.com/watch/118171/manufacturing-consent
Try and keep your head out of the main stream media's asshole.
Playing fast and loose with facts continues to hurt your case.
If you think that "dissent in the USA == downvotes", then you've never pissed off anyone powerful before.
For example, after Angela Davis (Black Panther activist) was acquitted, she became a tenured professor at the University of California, where she has, for several decades, continued to unapologetically oppose the United States government. And she's hardly the only one; there are many dissidents who are professors at American universities, some of which are even state-run universities. Noam Chomsky, of course, has not been removed from his professorship at MIT, despite his political views.
Are there any prominent Chinese dissidents who are now tenured professors at Chinese universities, without recanting? If we compare to Davis's role as a minority-group activist--- can you imagine a Tibetan or Xinjiang activist, who opposes the Chinese government's rule over those regions, becoming a tenured professor in China? Being able to teach courses openly about those disputes? Being able to publish critical books through the university press, which any ordinary person can order online with a few clicks? All of that happens in the United States, but doesn't happen in China.
I'm not hugely into political theory, but I read some of it, mostly tending towards the leftist side. And I am able to buy any of this in the United States, completely openly, even stuff much more radical than what I typically buy. Not even in backrooms or dark alleys, but from Amazon, delivered to my home address with my real name on the label! I can buy manifestos openly urging the overthrow of the United States government (under Brandenburg v. Ohio, these can't be prosecuted as treason). Can Chinese citizens openly buy manifestos urging the overthrow of the Chinese government?
Of course the official rates ignore people in "administrative detention" which is what China does to a lot of its political dissenters. But even if you add those back in, the USA has 4x the detention rate of China. (We are also ahead of every other country in the world.)
It would seem that if you're afraid of landing in prison, the USA is a much worse country to be in than China. Not slightly, much. (And a brief glance at the jail statistics will convince you that our justice system is not color-blind. For instance I've seen no data indicating that drug use rates are significantly different among whites and blacks. But incarceration rates for drugs are very, very different...)
However, what is not disingenuous is characterizing American behavior vis-a-vis the propaganda it espouses. That is a good test for any institution or country. Don't even need China here. Compare what happens in US and what US does internationally vs. what US govt and many of its citizens believe or tell others about America. "We are a beacon of democracy " that's a common idea. So now let's see how is the power distributed in US? Does the average citizen have the power to make decision and is that comparable to what the propaganda fantasy is promoting. How about another one "US Constitution protects us from unreasonable searches and severely restricts the power of the government from invading our privacy". A lot of people believe that (doesn't matter if they are Americans or not). Is that true compared to the number of people believing in that? I say it is not. A lot of people are living a lie, believing in a fantasy about the government that is not based in reality. I say that is unhealthy.
Something similar is happening in China or other repressive governments. People are lead to believe in things that are divorced from reality. "We are a paradise". "American Imperialists are out to destroy US" and so on.
There is actually one difference. In some countries (and I can speak for the former Soviet Union during its last days) people knew propaganda was lie and they laughed at it in private. We knew the image we were supposed to have about our country was false. Many Americans are not aware of it. The brainwashing is so effective, they actually believe we are exporting democracy in the Middle East. They believe we have the best health care system . Heck, many believe evolution is a big lie. There is a great amount of self delusion and self censorship. That is unhealthy.
So going back to the comparison. You are right, comparing US to China in absolute terms in certain areas, is like night and day. Say, when it comes to freedom of speech. You can grab a megaphone and go yell out crazy conspiracy stuff right by Obama's front gate. But if you look at the level of delusion, the situation, I think is not as great.
The philosopher Zizek has a great bit about the "unknown knowns" (the quadrant Rumsfeld wasn't smart enough to articulate). Meaning, of course, the unperceived fabric of Western ideology -- that works far better than explicit propaganda ever could.
Here is exactly when he starts talking about it in his Authors@Google talk: http://youtu.be/_x0eyNkNpL0?t=3m18s
According to the first paragraph of the article you linked:
"NSLs can only request non-content information, such as transactional records, phone numbers dialed or email addresses mailed to and from."
According to the sample NSL from the article you linked:
"We are not directing that you provide, and you should not provide, information pursuant to this letter that would disclose the content of any electronic communication. [...] Subject lines of emails and message content are content information and should not be provided pursuant to this letter."
So NSL is not the USA "reading your email."
I'm not defending the NSL, but I am opposed to misinformation, as well as the frequent attempts to paint the USA as being just as bad as China.
NSLs can't legally request ANYTHING. They are UNCONSTITUTIONAL. The government has NO AUTHORITY to issue them. The fact that they are presently limiting themselves to illegal request x instead of illegal request y is not relevant.
Let's skip the abuses of the FBI et al and talk about the government as a whole for a minute.
Are you aware that the NSA monitors _all_ traffic at major exchanges in the US?
http://en.wikipedia.org/wiki/NSA_warrantless_surveillance_co...
The USA reads your mail and messages at several different steps along the way.
See also: recent changes in Skype to allow for wiretapping at the request of the US government.
Moreover, your comment may actually be incorrect; a good chunk of all the mail Gmail handles is never on the wire in a format that can be decrypted with any known attack without access to Google's (often pinned) secret keys. The NSA's ability to snarf it off the wire, stipulated, does not connote their ability to read it.
The facts should be treated as such for all sides of a debate, even if you disagree with the outcome of the debate.
As far as I'm aware the majority of internet users are still using unencrypted plain text email.
you can check this too by looking at the SMTP headers on some mail in your inbox.
It helps against passive adversaries, but if someone's got access to the sending mailserver's network there are active MITM attacks that will probably defeat this.
Option 1: Try doing MITM and sending a self-signed cert for Google. The client smtpd may accept it anyway. (Cost: free)
Option 2: Spend resources to obtain a legitimate intermediate CA cert, and issue a valid cert for Google's mailserver, and MITM with that. (Cost: ca $25k-$100k, maybe less with proper connections.)
The only thing worse than self-censorship after assuming an insecure channel is a false sense of security.
DNSSEC is a debacle. Reprising an older comment:
* Amazingly, contrary to everything you'd expect about "secure DNS", DNSSEC does not in fact secure DNS queries from your machine. Instead, it delegates securing DNS to DNSSEC-enabled resolver servers. For securing the actual queries your computer makes, your browser is on its own. There's a whole different protocol, TSIG, intended to address that problem.
* DNSSEC has zero successful real-world deployments, and no existing integration with any TLS stack. DNSSEC obviously does nothing to secure your actual traffic; all it does is try to protect the name lookup. TLS protects both.
* DNSSEC does nothing to address all the other intercepts, from ARP to BGP4, that real traffic has to contend with. Once you go from name to IP address (or "cert" in the fairytale world where DNSSEC has replaced the CAs), you're on your own. TLS addresses all of these issues except for CA configuration.
* DNSSEC actually reduces the security of DNS in some ways: in order to authenticate "no such host", DNSSEC publishes a sort-of-encrypted list of all your hosts. There's a whole other standards group drama surrounding the proposals to resolve this problem (NSEC3, whitelies, etc).
* DNSSEC fails badly compared to TLS. When keys inevitably get screwed up in TLS, you get a browser click-through. There is no API support to recover from a "gethostbyname()" failure caused by DNSSEC. This sounds like a reliability problem, but it's actually a security problem, in the same sense as "the little blue key icon isn't big enough" is a security problem for SSL. We just don't know what the exploit is, because nobody has designed the "solution" for this problem.
* TLS has 15+ years of formal review (it is the most reviewed cryptosystem ever published). We still find things in it. DNSSEC has received nothing resembling the same scrutiny. It's ludicrous to believe we won't find horrible problems with it. You'd be asserting that a protocol co-designed by Paul Kocher will eventually fare worse than one designed by the IETF DNS working group. The IETF DNS working group would basically have to crush some of the smartest practical crypto people in the world.
* TLS is at least configurable (virtually all TLS problems are in fact user interface and configuration problems, not problems with the underlying system). You can nuke untrustworthy CAs. There is no clean way to opt in or out of different DNSSEC policies, as the drama surrounding DLV illustrates.
In the '90s, we designed web security to assume that DNS was insecure. That was a smart decision. "Security" means different things to different people. It's a policy decision. The end-to-end argument strongly suggests that it's something that can't be baked into the lower parts of the stack. DNSSEC is a step backwards. I think you can already see the indications of the problems it will cause just by looking at the places it already falls down. What we need is a concerted effort to solve the security UI and policy problems that browsers have.
If you're looking for protocol-level remediation for TLS's current CA policy problem, you want to pay attention to TACK:
http://tools.ietf.org/html/draft-perrin-tls-tack-00
This is Trevor Perrin and Moxie Marlinspike.
"Before yottabytes of data from the deep web and elsewhere can begin piling up inside the servers of the NSA’s new center, they must be collected. To better accomplish that, the agency has undergone the largest building boom in its history, including installing secret electronic monitoring rooms in major US telecom facilities. Controlled by the NSA, these highly secured spaces are where the agency taps into the US communications networks, a practice that came to light during the Bush years but was never acknowledged by the agency. The broad outlines of the so-called warrantless-wiretapping program have long been exposed—how the NSA secretly and illegally bypassed the Foreign Intelligence Surveillance Court, which was supposed to oversee and authorize highly targeted domestic eavesdropping; how the program allowed wholesale monitoring of millions of American phone calls and email. In the wake of the program’s exposure, Congress passed the FISA Amendments Act of 2008, which largely made the practices legal. Telecoms that had agreed to participate in the illegal activity were granted immunity from prosecution and lawsuits. What wasn’t revealed until now, however, was the enormity of this ongoing domestic spying program."
Its a recent article outlining what's ahead (and presently implemented) for the NSA. Given what is already known, the U.S. Govt already has access to your e-mail, and they have the capabilities to decrypt it should your e-mail become high priority.
I'm sorry, but the sky is falling.
But it's worth acknowledging such programs exist and don't appear to be going away.
Beyond the AT&T incident (and following legal ruling dismissing, retroactively, carriers from wrongdoing in wiretapping).... there's also the 'TrailBlazer Project'[1] with public accounts from William Binney (NSA , 'Director of World Geopolitical and Military Analysis Reporting Group')and Thomas Drake [2] (NSA) regarding the overreach of such projects....that it's kinda hard to exclude data and so forth.
Jacob Applebaum (Tor, etc) recently dragged William Binney around NYC to gather publicity [3] - but few outlets paid much attention.
[1] - http://en.wikipedia.org/wiki/Trailblazer_Project
The idea that they can create collisions for hashes or crack ciphers believed to be relatively secure in the near to mid future is paranoid speculation.
However, if you're going to be paranoid, direct your attention to RSA and DH (plain, not ECDH). In Suite B, which the NSA recommends for use by government, RSA and DH are absent. If the NSA knows of a weakness in anything currently believed to be secure (I think that's unlikely), I would bet that it's RSA and DH, because the NSA no longer recommends them. I think RSA and DH are superseded by ECDSA/ECDH simply because of speed at comparable key strengths, not because the NSA knows something the public doesn't. As an aside, it indicates that the NSA has a fair amount of confidence in ECDSA/ECDH.
I do not think the NSA is stupid enough to play chicken with the public crypto community by recommending encrypting classified information with ciphers NSA knows to be weak. The public could discover those weaknesses tomorrow. The most sensitive information inside the U.S. government and military is presumably protected by the NSA's Suite A algorithms, but other important information is not, notably military communications between U.S. allies, for which Suite B is recommended.
[1] https://www.schneier.com/blog/archives/2012/03/can_the_nsa_b...
I use Skype mostly for IM, but also the occasional voice/video call, what's a better, more secure alternative?
For example, "sneak" replied to my comment with lots of CAPITAL LETTERS and links to other information. But I'm already less inclined to trust sneak, since he/she is already known to play fast and loose with the facts.
The fact is, message metadata is enough. I have friends and acquaintances that have been harassed and detained by officials based on their names appearing in contact lists of other suspected-but-not-charged-with-anything individuals. We're not even talking about evidence of actual communications such as message headers or metadata.
The fact that they can (and do) pull thousands of people's message headers and have access to the communications graph and traffic frequency without ANY JUDICIAL OVERSIGHT WHATSOEVER means that their ability to conduct state-sponsored extrajudicial harassment is way out of control.
It truly doesn't matter if NSLs allow them to get the body of the messages or not. If you're on the radar, you and everyone you communicate with regularly is a target. There are no legal remedies for this sort of stuff anymore.
If you do anything of import non-anonymously, you can expect to have your hardware stolen and never returned (under the guise of a search), your travel impeded, your accounts inaccessible (google "civil asset forfeiture"), your social network harassed and detained similarly, and your access to legal remedies hindered in every conceivable way.
A half-dozen examples known to me personally come to mind immediately. I'm sure there are more that I don't know about.
The threat is very real, and trying to split hairs about whether or not "reading your email" means message bodies or just headers is not productive.
The strategy you advocate is what many environmentalists, notably Al Gore, have been employing.
It turns out that most people aren't as dumb as you think. They pick up on the fact that they're being misled. And that tends to turn them against your mission.
Thus, many people are now desensitized to warning of climate change. They've seen the scientists lying and conspiring to gag dissenting views, and cherry-picking studies to highlight the worst possible outcomes. And if those scientists (rogues that they might be) need to gag the dissenters, they must not have very strong arguments.
Please note: I don't mean to take a side here in the climate debate, only to illustrate how one strategy used in that debate is having an effect opposite to what was intended.
I don't have the speaking skills to convince the world of this, but coming of age after 9/11, I have seen first-hand the awesome power of fear.
[edit] So, and correct me if I'm wrong here, you are saying that after seeing the damage that fear has done to your culture (which I would say is far, far greater than the damage done to New York on 911), you then think that you should stir more fear and use it to achieve your political desires. In a just cause, of course. Everyone has a just cause. And your justification is that you don't think you are eloquent enough to convince people by other means? That is a fucking repulsive attitude.
Remind me where the surgeon metaphor fits into all of this horseshit.
i.e. exactly what you're (ostensibly) trying to oppose.
Replacing one form of control with another is not progress :)
Google, your employer, will not confirm, on the record, what they will or will not disclose when they get an NSL. The NSL statute does not authorize the disclosure of transactional records.
18 USC 2709(b)(1) states that the government can only get "the name, address, length of service, and local and long distance toll billing records"
Furthermore, a 2008 opinion from the Office of Legal Counsel at DOJ specifically confirmed that the FBI cannot use NSLs to get email to/from data, even though the government has asked for it in the past. See: http://www.justice.gov/olc/2008/fbi-ecpa-opinion.pdf
NSLs are gagged, and so Google cannot confirm when it gets NSLs, or for which customers the government is seeking data. However, Google could very easily provide information to the public confirming what it will and will not deliver to the FBI when it receives an NSL. I have asked Google's legal and DC policy team for this info, repeatedly, and hit a brick wall.
Does reading your library records count... How do you know the same hasn't been done with your email? You don't. Because it's secret. Is this an open society? A free society?
(Of course China wouldn't be the only one, but they have a history hacking into people's Google accounts and I have to imagine are a major motivator in this feature.)
If someone has a keylogger on your computer it is game over anyways. (Since they can "read" the mail you send just by recording the keystrokes)
* @gesa, Obama campaign web developer says an infosec staff member got one: https://twitter.com/gesa/status/210184075149979649
* @dandrezner, international relations professor: https://twitter.com/dandrezner/status/210103984881549312
* @TomLasseter, Bejing Bureau Chief for McClatchy Newspapers: https://twitter.com/tomlasseter/status/210210259019640835
* @JeffreyCarr, CEO of Taia Global and author of Inside Cyber Warfare: https://twitter.com/jeffreycarr/status/210227611912257537
* @snowfl0w, malware analyst for Contagio Dump: https://twitter.com/snowfl0w/status/210207958376779776
* @w7voa, Voice of America Bureau Chief covering Korea and Japan: https://twitter.com/w7voa/status/210194791479250946
* @marcambinder, national security reporter for The Atlantic and GQ: https://twitter.com/marcambinder/status/210184141180911617
* @DDysart, web developer?: https://twitter.com/DDysart/status/210183540535590912
This is not looking good... some people on this list have gone and installed Google 2FA after realizing their computer might be compromised. Enabling two-factor auth WILL NOT resolve this issue if your computer has been compromised. If you get this warning, you need to bring your computer to someone with real security expertise and have it checked out. Strongly consider cleanly reinstalling your OS, then enable two-factor authentication.
EDIT: Here's the message that Google is giving to people that have been affected: http://support.google.com/mail/bin/answer.py?hl=en&ctx=m...
It looks like they're detecting exploit code sitting in people's accounts, mostly in the form of PDF and Office docs and inside RARs. This might explain why snowfl0w is on the list, since he handles a lot of this stuff daily and some of it likely goes through his e-mail (on purpose). It's unclear if this means that your account was successfully compromised. It's more likely that it means someone is attempting to get into your account.
In the state actor case, there's little or nothing they can do to make it stop happening, hence the special warning.
It's also a high-profile jab at the unnamed state actors, which is nice.
Gmail already warns users when Google suspect their accounts are compromised. All this is doing is changing a small subset of those warnings into a less-easily-ignorable warning for those users that may be targeted by state actors.
My girlfriend received the warning message today. She has already activated 2-factor auth, so I'm really not sure what she's supposed to do with this information.
I can't see how this can be differentiated from simple underhanded FUD-driven political activism.
The users may make their account more secure and take more care of their physical security?
I don't understand what makes you so upset. I find this nice. Are you saying that Google will be misusing this to make some states look bad?
If you were at Google, what would you propose? Do nothing with accounts that you know are being attacked by states?
How does any of this differ from regular user advice? And note the last sentence, they are explicitly admitting the warning relates to nothing in reality beyond the normal environment. Do we suppose that people in China aren't aware their government spies on them? Do you suppose your own government does not?
I don't understand why this banner isn't shown to all users - China or otherwise, or why show it at all. Do something actionable and meaningful - introduce password complexity requirements, mandatory 2 factor authentication, require use of a signed browser with pinned SSL certificates - anything but non-specific nonsense that does little but promote unactionable fear in the hearts of thousands of users.