Hacker News Reader

Hacker News

Comment by riotingpscifis | Hacker News Reader

Parent Full thread

riotingpscifis

Consider the NSA having MITM capabilities before the data reaches google:

1) This is exactly what you would need to do, to consider it realtime

2) None of the denials cover this

View on HN

If it's MITM between user and Google, then Google would not be coordinating or even necessarily aware.

Would the NSA list Google as a "partner" that it needs to keep protected in these leaked slides if this were the case?

1) They didn't, and 2) Even if they had, unclear, inaccurate, or misleading information regarding Google's degree of cooperation or the mechanics of acquiring tha data in a document prepared for consumers of the data for which information on the details of collection was not essential actually makes quite a lot of sense in a highly classified program (whether its classified for appropriate, security related reasons, or for political reasons.)

Consumers of the data need to know where it comes from and its scope, they don't necessarily need to know whether its acquired through cooperation or coercion or infiltration of the providers.

This is false. The NSA did not list Google as a partner. Reporters may have, which is different from what the leaked slides actually say.

They'd have to MITM SSL traffic largely.

Also, that's what they were doing for more traditional wiretaps and you should be sure that they have access to siphon off live traffic for analysis if they want.

"They'd have to MITM SSL traffic largely."

To be fair, if anyone can do this it's precisely these people.

... still not likely, though, I agree.

Is that even possible if Google's SSL certs have Extended Validation? They'd have to have cooperation all the way down to the browser vendors and I can't see Mozilla caving that easily.

There are several governments (Spain, France, Netherlands, Japan) who publicly have Root CAs in the trusted browser list[1]. It seems pretty likely (cf say, Prism) that the NSA has a CA cert where they can generate whatever certificates they want in order to MITM browser SSL communications...

[1] http://www.mozilla.org/projects/security/certs/

Can we remove Root CAs from our browser?

Edit: Found the answer: https://wiki.mozilla.org/CA:UserCertDB

I was referring to cryptographic attacks. Unlikely that they have such, but if anyone does, it's pretty likely to be them.

Reply on news.ycombinator.com