Hacker News Reader

What is the source on the SSL keys? Arguably a lot of metadata could be gleaned without even decrypting the data. If an IP is tied to an identity, timing of traffic alone would be very revealing.

View on HN

My guess? They worked with the CEO to discuss the issue. Then recommended hiring some consulting company that specializes in key management. The consultant says something like, you need to keep a copy of the keys in an offsite vault for disaster recover purposes. The NSA now has the keys.

It is also possible they just got the keys from spies. In my company, anyone with sudo access to front end machines can get the keys. I have no idea how to keep these keys secure from the NSA.

You should look into how perfect forward secrecy works in TLS before you make these kinds of claims.

[1] http://vincent.bernat.im/en/blog/2011-ssl-perfect-forward-se...

If someone has your private cert and keys, that is irrelevant - they can fully MITM you. Forward secrecy only ensures that a compromised key doesn't compromise data collected in the past.

Reply on news.ycombinator.com