Hacker News Reader

Comment by jgrahamc | Hacker News Reader

This presentation is from 2008. According to the presentation on PRISM Facebook joined the program on 3 June 2009. That would indicate that the searches here are based, most likely, not on participation by Facebook but by passive sniffing of HTTP traffic and then session reconstruction.

View on HN

In 2008 Facebook ran on HTTP, so back then it would have been easy to sniff this data. I believe Gmail also transferred in plain text back then. When those companies switched to HTTPS, the NSA likely 'leverage some pressure' to get them to join PRISM, which puts the data back in this system.

You've got your timeline wrong. Facebook didn't support HTTPS for anything but user login until 2011.

[0] https://www.facebook.com/blog/blog.php?post=486790652130

From the screenshots it's obvious that the captured data is an HTTP form submission in facebook.

So they didn't have access to private messages, they just intercepted internet traffic and relied on it being unencrypted. Facebook didn't always enforce https by default like it does now

> That would indicate that the searches here are based, most likely, not on participation by Facebook

Gag warrants existed before PRISM.

EDIT: "National Security Letters"

Around about the time when people started rolling out SSL as standard. That'd make sense, as they'd need to move their beam-splitters (prisms!) to behind the SSL endpoints.

I think PRISM is just the public-private partnership aspect of this, where they have to go to service providers and install kit, as they can't tap SSL traffic.

Reply on news.ycombinator.com