Hacker News Reader

Comment by tptacek | Hacker News Reader

Google could not provide the NSA with its TLS keys and then argue it hadn't given the government direct access to its servers. Nor could the government MITM TLS, which would be detectable, nor could they have compromised a TLS CA to accomplish the same thing, because Google's keys are pinned in Chrome and recent Firefox; you can examine the builds to see that.

View on HN

> Google could not provide the NSA with its TLS keys and then argue it hadn't given the government direct access to its servers.

Sure it could. First, it would be accurate: TLS keys give you the ability to decrypt communications, which is distinct from direct access to the servers (though, obviously, it can easily substitute for it.) Second, even if it wasn't an accurate distinction, people can (and do) argue positions on unsound bases, and Google doesn't seem to be especially incapacitated in that regard.

How do you resolve the the fact the presentation is real, and Larry Page's statements?

This is the only explanation that makes sense. Some secret court compels Google to provide their TLS keys, which is a a few kb of data. No one at Google has to know, and no one at Google can accidentally detect the leak.

Also, can you clarify for me why you think giving someone access to eavesdrop overlaps with "direct access to servers"?

If what I say is correct, Larry Page's statement is 100% defensible.

Could it be that the presentation describes targeted surveillance? PRISM may just be a program to standardize a process and the type and format of information returned.

Yes, I think the $20M figure makes it clear it is targeted. They have the ability and authorization to eavesdrop on foreign packets, but that is like drinking from a firehose. They need a way to syphon and interpret the data, and also a way read TLS streams. I think the dates and companies are a combination of getting access to the TLS keys, and actually implementing a sane way of sipping from the firehose. In facebook's case, I think they implemented a way to eavesdrop, and then later compelled Zuck to provide the keys.

The slide about how traffic is routed through the US is really telling. This program works because there is access to the packets.

Reply on news.ycombinator.com