Hacker News Reader

Comment by jcampbell1 | Hacker News Reader

The presentation makes it seem they are harvesting the data. That would resolve any apparent contradiction. The biggest question is how? Surely google has noticed these man in the middle attacks. I think the guardian misinterpreted the word "provider".

Edit: it appears the NSA has google's ssl keys. That would explain all the talk about "direct access".

View on HN

What is the source on the SSL keys? Arguably a lot of metadata could be gleaned without even decrypting the data. If an IP is tied to an identity, timing of traffic alone would be very revealing.

My guess? They worked with the CEO to discuss the issue. Then recommended hiring some consulting company that specializes in key management. The consultant says something like, you need to keep a copy of the keys in an offsite vault for disaster recover purposes. The NSA now has the keys.

It is also possible they just got the keys from spies. In my company, anyone with sudo access to front end machines can get the keys. I have no idea how to keep these keys secure from the NSA.

You should look into how perfect forward secrecy works in TLS before you make these kinds of claims.

[1] http://vincent.bernat.im/en/blog/2011-ssl-perfect-forward-se...

If someone has your private cert and keys, that is irrelevant - they can fully MITM you. Forward secrecy only ensures that a compromised key doesn't compromise data collected in the past.

Google could not provide the NSA with its TLS keys and then argue it hadn't given the government direct access to its servers. Nor could the government MITM TLS, which would be detectable, nor could they have compromised a TLS CA to accomplish the same thing, because Google's keys are pinned in Chrome and recent Firefox; you can examine the builds to see that.

> Google could not provide the NSA with its TLS keys and then argue it hadn't given the government direct access to its servers.

Sure it could. First, it would be accurate: TLS keys give you the ability to decrypt communications, which is distinct from direct access to the servers (though, obviously, it can easily substitute for it.) Second, even if it wasn't an accurate distinction, people can (and do) argue positions on unsound bases, and Google doesn't seem to be especially incapacitated in that regard.

How do you resolve the the fact the presentation is real, and Larry Page's statements?

This is the only explanation that makes sense. Some secret court compels Google to provide their TLS keys, which is a a few kb of data. No one at Google has to know, and no one at Google can accidentally detect the leak.

Also, can you clarify for me why you think giving someone access to eavesdrop overlaps with "direct access to servers"?

If what I say is correct, Larry Page's statement is 100% defensible.

Could it be that the presentation describes targeted surveillance? PRISM may just be a program to standardize a process and the type and format of information returned.

Yes, I think the $20M figure makes it clear it is targeted. They have the ability and authorization to eavesdrop on foreign packets, but that is like drinking from a firehose. They need a way to syphon and interpret the data, and also a way read TLS streams. I think the dates and companies are a combination of getting access to the TLS keys, and actually implementing a sane way of sipping from the firehose. In facebook's case, I think they implemented a way to eavesdrop, and then later compelled Zuck to provide the keys.

The slide about how traffic is routed through the US is really telling. This program works because there is access to the packets.

Why would the government choose to use this route to get data from Google/Facebook/etc?

This would require them to have to know, and be kept up-to-date, with how every one of their applications sends data across the wire.

two words: plausible deniability

> Why would the government choose to use this route to get data from Google/Facebook/etc?

It is the only way to get access to the data without requiring a vast conspiracy. If they had direct access, thousands of employees would know something was up. If they MITM, then lots of people would notice. If they had a way to actually break TLS, then there would be no slide about "providers".

Network dumps would seem unreasonably difficult to deal with considering that the provider has structured data and tools to deal with it.

> unreasonably difficult

All you have to do is read session cookies. Once you have that, you are done.

That doesn't give you the type of data (and tools) that the provider has. I don't see the government building tools on top of user-level access when the provider already has better data (like login records) and tools.

Reply on news.ycombinator.com