Comment by DigitalSea | Hacker News Reader

Comment by DigitalSea | Hacker News Reader

Parent Full thread

I don't think any service can claim to be 100% secure from NSA spying. Are we forgetting the claims that the submarine USS Jimmy Carter is used to tap into under sea fiber optic cables to intercept traffic from numerous web services and communications? Considering military technology is most likely 5 to 10 years ahead of civilian technology, we can't assume anything is secure or private any more. In computing power years, 5 years is a long time to research, test and refine hardware capable of breaking supposedly secure encryption schemes.

So while some startups might claim to be NSA snooping free, they don't control the traffic while in transit, it's that middle-layer that's free game for the NSA to tap into and store without anyone being any wiser.

Having said that I have seen tonnes of services start to capitalise on the whole NSA fiasco, namely Duck Duck Go and their billboard ads propping themselves up as a secure Google alternative. And while they might not store searches, that doesn't stop the Government from doing it...

I think it's possible to build services that enable users to evade the dragnet, whether criminal or potentially governmental.

If either of those communities is targeting you in particular, it's much harder. How many people use universal 2FA? How many do it from their phones, which are potentially vulnerable? If not using 2FA, how many have typed passwords in front of security cameras?

And if you are targeted, as someone else pointed out, rubber hose decryption is always possible. The thing that is having people feel like a Christian Scientist with appendicitis (credits to Tom Lehrer) is the concern about the scope of information capture and the security of the systems and people that have access to that information, and I think one can build sound services to help address that level of privacy.

What you describe is a simple man in the middle attack albeit executed in a very complicated manner. With public key encryption using SSL you have end to end security under two assumptions: the NSA cannot break the public key structure and that the NSA cannot fake a public certificate. The latter is resolved with public key pinning and the former is highly unlikely.

i think it's more like 10-20 years ahead, but point taken :)

Yeah, I didn't know the exact figure. I just knew it was quite ahead of public technology, it's quite a gap when you're talking about hardware and scary as well.

Based on...?

Reply on news.ycombinator.com