Hacker News Reader

Comment by MangoToupe | Hacker News Reader

> At least one Jira support ticket shows evidence of plaintext capture of email

I would be surprised if western governments didn't do the same, and folks should act accordingly.

The NSA was storing bulk plaintext emails from (at least) Microsoft, as of the time of the Snowden leaks. Microsoft actively assisted them.

https://www.theguardian.com/world/2013/jul/11/microsoft-nsa-... ("Microsoft handed the NSA access to encrypted messages")

> "Microsoft helped the NSA to circumvent its encryption to address concerns that the agency would be unable to intercept web chats on the new Outlook.com portal;"

> "The agency already had pre-encryption stage access to email on Outlook.com, including Hotmail;"

In general none of the disclosures of what GFW is doing g should be seen as evidence that western governments do not do the same thing. Hope nobody is drawing that conclusion.

Western governments do not routinely block VPNs.

Different phylosophy: why block VPNs when you can monitor them. Most Root CAs are in US.

Certificate transparency is mandatory in browsers; interception certificates appear in certificate logs to be accepted. Have you found one?

Edit: OCSP has been ended.

He might be referring to OCSP. Browsers ping CAs by default, revealing to them the sites that are visited.

OCSP is very much on the way out, this is hardly true anymore; although some things still check OCSP, many things do not.

Western governments effectively control 99% of consumer technology, and hack whatever else they can't have. VPNs are a false sense of security going up against a nation-sized adversary like the US.

They also can correlate packet streams in and out of the tor network.

We don't need to guess, we know they do. That was one of Snowden's big reveals.

The US has been doing this for a long time (1997), on a targeted basis.

https://en.wikipedia.org/wiki/Carnivore_(software)

Reply on news.ycombinator.com