Hacker News Reader

Comment by beloch | Hacker News Reader

1. Since the U.S. government has given itself both the power to compel U.S. corporations to spy for them and the power to prevent them from revealing this, we can't take the claims of any U.S. corporation at face-value.

2. DuckDuckGo is a U.S. based company.

View on HN

Problem is, even if DDG would be hosted in, say, Europe, the NSA would still be able to snoop on the traffic. As has been recently revealed, the German BND may siphon off up to 20% of the traffic at DE-CIX (Internet exchange in Frankfurt) and on average siphons off 5% [1]. The BND closely cooperates with the NSA. As we've seen in the last couple of weeks, Europe is basically a US colony and Germany in particular is not a true sovereign state. [2] What to do? Host in Russia, Latin America?

(Disclosure: I am German and DDG is my default search engine.)

[1] http://h-online.com/-1909989

[2] http://sz.de/1.1717216

A foreign intelligence agency like the NSA actually needs less of a legal framework to spy on a foreign company as opposed to a domestic one. It's sort of the whole point of a foreign intelligence agency, not respecting the laws of other countries.

Well, yes. But let's get back to the point of the original post in this thread.

There are two problems: 1) we can't trust the networks that our data travels over and 2) we can't trust US-based companies with our data. The first problem is fairly easily dealt with (encrypt and authenticate), while the second one is much worse. A company based in a country that does not have laws enabling agencies to snoop on and prevent the disclosure of said snooping would automatically be more trustworthy than any US-based company.

I do not think (1) is solved with cryptography because you can spy on the traffic flow and the route and timing of the connections give extra information. To overcome this we need extra measures.

If we are not being naive, you can't trust China-based or Russia-based companies with your data...

Or French, or German, or Australian, or... Pretty much everyone?

> A company based in a country that does not have laws enabling agencies to snoop on and prevent the disclosure of said snooping would automatically be more trustworthy than any US-based company.

The ultimate irony is that by using providers in a country that spies and is unwilling to admit, over a country that spies and is willing to admit, is that you're forgoing the "trustworthy" spying country in favor of the "untrustworthy" spying country.

You know the US spies. How much do you really know about the ones that are staying nice and quiet right now?

I didn't realize secrecy equated with trustworthiness.

How about a country which doesn't spend trillions on spying and thys probably doesn't have capacities anywhere close to those of the US, secret or not.

Don't fool yourself. Every tech-averse third world middle eastern country can control and tap into the fiber in their infrastructure.

And if they can, anyone can. It's not egregiously expensive or difficult to do.

while the second one is much worse

It may be "worse" in a variety of senses, like political tenability, but the solution is simple: bring data given to third parties under the 4th Amendment, which is the entire underpinning of companies being able to give your packets to the government willy-nilly. Well, not willy-nilly, the government pays for the privilege.

The problems with passing a privacy law that attaches to data given to third parties, like is done in many countries with higher standards of living than the US, are not the citizens' problems. Political tenability is a problem for politicians, but that is of zero consequence. If the populace wants (for some measurable quantity of want) this to happen, politicians will either make it happen or lose their careers or lose their heads to pikes (as has happened throughout history). However, politicians are counting on people having low self-esteem and taking "no" for an answer. It's not the citizen's duty to be cowed by their laziness and bad hearts, though.

> A foreign intelligence agency like the NSA actually needs less of a legal framework to spy on a foreign company as opposed to a domestic one. It's sort of the whole point of a foreign intelligence agency, not respecting the laws of other countries.

That's why the NSA has links to UK and Australian intelligence agencies. They can "share" intelligence (as in, let the other guys spy on their people). I wouldn't be surprised if the NSA didn't have people on sequester to foreign agencies, but still based in the US, doing nothing but spying on US citizens and passing the information to the NSA (plus giving a few tidbits to the foreign agency, to justify the sequester); as a legal loophole.

DDG searches are delivered over HTTPS. It doesn't matter if the NSA can siphon off DDG traffic.

How unreasonable is it that DDG could have their private key taken by the NSA?

I expect the NSA does this as a matter of course, at least for large enough companies.

It does matter and the article has reasoning about why it does. "The NSA could get the DuckDuckGo master cert in one of three ways:

1. Be given the cert

2. Physical access to servers or load-balancers

3. Remote access to servers or load-balancers"

If they can get direct access to the DDG servers, then it doesn't matter if they can siphon off traffic at the ISP level. They can just access the data.

But wouldn't that require constant access to the server, whereas the key they could steal once with short access to server and use until it expires without the victim noticing?

Well the point raised by the article is that HTTPS doesn't matter much if the certificate is compromised.

Is this true even with perfect forward secrecy, as is used on DDG?

My understanding is that if they're using Perfect Forward Security it doesn't matter, because unless you're modifying the traffic in flow (which is much harder to do secretly) then it doesn't matter if someone-else has the private key, they won't be able to decrypt the data in any case.

How do you expect to get the nonce across the network without the NSA getting it?

I'm no expert in PFS in TLS, but there are various key-agreement protocols that allows parties to establish a secure key over an insecure channel.

I believe the way PFS works is that it uses RSA to verify identity and then Diffie-Hellman to establish keys.

If you're only able to passively intercept data (i.e. you can't impersonate the server and MITM) then you're unable to discover what the key established by DH is.

(incidentally nonces are generally only relevant for preventing replay attacks; the nonce doesn't play a part in passive defence)

> I believe the way PFS works is that it uses RSA to verify identity and then Diffie-Hellman to establish keys.

It's the other way around. First you do the DH and then use RSA to authenticate (a hash of) DH parameters.

This article may help explain how: http://vincent.bernat.im/en/blog/2011-ssl-perfect-forward-se...

Https doesn't have to terminate at the server doing the work. A feed splitter could be put between the https termination and the engine room. If ddg were compelled to do this, it's entirely possible to do so without giving up the cert.

comrade1, you are hell-banned.

Actually a company based out of US jurisdiction and using TLS certs should be "safe" to use assuming they don't voluntarily share your info with any governments. It is expo exponentially harder to compel a country to compel a company to give up info.

Or you an use Off The Record Messaging which has perfect forward secrecy.

If, say NSA and BND co-operate, NSA listens all but Americans and BND listens all but Germans and both exchange information. Everything is covered.

And that's really all there is to it. That's why you don't build secret courts, secret orders, and gag orders.

3. It would be almost trivial for the U.S. government to snoop on DuckDuckGo's traffic at the switch or cloud provider level even without informing DuckDuckGo of this. I believe they host at EC2 East, which is in DC and a major U.S. government linked hosting provider (see Amazon FedRamp).

The cloud is not private, period.

Oh, I'm sure they can easily collect the traffic. I think any secure service needs to be made with that in mind now. But the question is if they can get the data unencrypted.

Even if they're getting it encrypted, they can still learn a lot from correlations of addresses and times and such.

Do we have any evidence the US asked any corporations to spy? The only instances I am aware of of the US asking corporations for help was requesting/ordering access to data the the company was already collecting.

AT&T, for one.

http://news.cnet.com/8301-13578_3-57581161-38/u.s-gives-big-...

https://www.eff.org/nsa-spying

Reply on news.ycombinator.com