Hacker News Reader

Comment by znowi | Hacker News Reader

> how are they getting all Facebook private messages and Gmail?

Perhaps you missed the news about PRISM? :)

This presentation is from 2008. According to the presentation on PRISM Facebook joined the program on 3 June 2009. That would indicate that the searches here are based, most likely, not on participation by Facebook but by passive sniffing of HTTP traffic and then session reconstruction.

In 2008 Facebook ran on HTTP, so back then it would have been easy to sniff this data. I believe Gmail also transferred in plain text back then. When those companies switched to HTTPS, the NSA likely 'leverage some pressure' to get them to join PRISM, which puts the data back in this system.

You've got your timeline wrong. Facebook didn't support HTTPS for anything but user login until 2011.

[0] https://www.facebook.com/blog/blog.php?post=486790652130

> That would indicate that the searches here are based, most likely, not on participation by Facebook

Gag warrants existed before PRISM.

EDIT: "National Security Letters"

Around about the time when people started rolling out SSL as standard. That'd make sense, as they'd need to move their beam-splitters (prisms!) to behind the SSL endpoints.

I think PRISM is just the public-private partnership aspect of this, where they have to go to service providers and install kit, as they can't tap SSL traffic.

From the screenshots it's obvious that the captured data is an HTTP form submission in facebook.

So they didn't have access to private messages, they just intercepted internet traffic and relied on it being unencrypted. Facebook didn't always enforce https by default like it does now

With regards to the data collection, the thing to realize (which I did so myself) is that email truly is the glue that ties together most internet services.

Take facebook for example. By default, almost any and all activity on the site is catalogued for you by email -- for your convenience. Someone mentioned you in an update, you get a notification. A friend sent you a private FB message, you can an email notification with the content in line (even with the support of replying to message via email as well).

Now, because email traffic on the internet is not encrypted by default, one is able to piece together the contents of communications just by looking at the email.

Essentially anything that you receive via email (e.g. password reset links; credit card statement summaries etc) is subject to capture and analysis. Given this, it may make sense to perhaps disable (potentially sensitive) email notifications as a workaround around this particular collection method.

PRISM allows them to retrieve individual users' messages via a FISA court order. It doesn't allow analysts to instantly obtain private data for any user they want. :)

Reply on news.ycombinator.com