Tech Companies and Government May Soon Go to War Over Surveillance
wired.com
wired.com
Or we can all start to use something like this (both projects are from Moxie Marlinspike):
I mean, there's no way to tell apart the certificate from the intermediary from the cert from the endpoint as they're the same.
Worse, if a trusted certificate authority's private key is compromised, then the TLS public-key infrastructure as a whole is broken. An attacker who can also intercept traffic (e.g. by routing traffic through a data centre they control) can execute a MITM attack by issuing their own TLS certificate for any domain.
The only way to detect such an attack would be to notice that one time you connect to a site you see the legitimate key, and another time you see the attacker's key. That's what certificate pinning detects.
At this point it's probably safe to assume that the NSA has compromised at least one certificate authority's private keys via a subpoena and gag order and can therefore do MITM attacks on TLS traffic.
If a CA is compromised then we have much larger problems since it is impossible to verify the identity of the participants in the session. Since an attack was used to create valid certificates as part of the attack on Iran's nuclear program it is likely that other attacks exist and are in the hands of the same actors. We can't move to ECC based SSL fast enough.
I've been thinking about installing the EFF's SSL Observatory - a sort of distributed cert pinning and comparison plugin.
What's the point of providing such service if anyone capturing your internet traffic can change it in flight to a "return True" equivalent?
Edit: tried https... come on, they're not even trying: "The certificate is only valid for the following names: whispersystems.org , www.whispersystems.org"
Outside of the tech community, i have yet to hear large amounts of actual outrage.
I thus predict the same outcome as say, patents:
Techies will complain on techie-friendly websites about how it sucks, rather than doing something productive like repeatedly contacting their congressfolks, requesting and having real live meetings with them.
People will propose technical solutions, apparently oblivious to the fact that the government will simply require you not to use them (as they have in the past).
Nothing will change.
Techies will then blame the tech companies for losing this war, or blame it on not spending enough money on lobbyists, or some bogeyman that does not require realizing the harsh truth: As a whole, techies refuse to actually get involved when it's something that actually requires doing something other than coding or writing comments on a website.
Instead, they rely on EFF and other orgs, which are simply not enough.
From doing it. From watching how DC works, from working next to DC lobbyists and politicians for many years, and watching people be effective and get things done in DC for many many years.
I'm not sure why you think it doesn't work. Have you actually done it?
They care tremendously what their constituents believe, contrary to popular belief. They get daily morning briefings on their constituents views on issues, etc.
So basically, anecdotal evidence. Got it.
This issue has been discussed on HN before, and we had overwhelming response from people who actually worked for Congresspeople that the vast majority of letters and calls from constituents get either ignored, or given canned responses. This fits my anecdotal experiences with politicians in general as well - for the most part, the politician is paid for by private interests and lobby groups.
So yes, on an individual level, your vote is worthless. However, in the aggregate, constituent feedback counts for a lot, possibly the biggest single input. And so once you accept that you as an individual are insignificant in the grand scheme of themes, you can actually accomplish a lot by minimizing the personal effort you expend on writing your congressperson and instead getting lots of other people to vote the same way you do.
This suggests an interesting hack. Create a really simple mobile app that lets you subscribe to all upcoming legislation on issues you care about. It'd be structured like a news app or RSS reader, where you can flick it open whenever you have a spare moment and read the latest upcoming issues. And then let you easily indicate your position - perhaps swiping right means "Aye" and swiping left means "Nay". A swipe automatically sends a canned form letter to your congressman indicating your support or opposition for the legislation.
Basically, you're leveraging technology to enable direct democracy. Create a direct information line between constituent and congressperson, where the constituents have all the information available to them that congresspeople do, and can vote just as easily.
I recall the creator talking about this at length on reddit or somesuch in recent months.
Also Direct Democracy is a nightmare. See: California. Arnold Schwarzenegger outlines why his attempt at making most of his major issues ballot initiatives in his first term was a disaster in his book Total Recall.
[citation needed]
I highly doubt this is what was said, because it's simply not true. I certainly don't remember it being said either. Certainly, if that was the the "overwhelming response", you should have no trouble providing links. If you do, i'm happy to admit I was wrong. As far I know, having talked directly to legislative assistants of congressman, and chiefs of staff of senators, is that they are a huge input into how congressmen and senators vote.
Excerpt from first reply:
"ETA: I've also typically seen that regardless of the amount of pressure applied by the public for one side of an issue, nearly every politician will simply vote the party line anyways. They know where their bread is buttered, and won't go against party leadership. I've watched legislators look over at a senior party member and be signalled which way to vote when their turn comes up. I don't think anything I've done or said to my representatives has had the slightest impact on their opinion or voting record. That's just how the game is played."
Excerpt from second reply:
"IME: email is worthless. canned letters / faxes go in the garbage. A polite phone call may accomplish something. Better yet if you donated or voted for that politician. Even better if you phone banked." [followed by an explanation of what works, i.e. money]
Excerpt from third comment:
"I was an intern for a congressman. My job was to answer and return constituent emails and calls. We took the feedback, searched for the proper prewritten form letter, printed it out and sent it back with a stamp of the congressman's signature. He never got a single bit of the feedback himself."
Fourth comment mentions that anti-SOPA call-ins seemed to have been successful, but they are forgetting the billions of dollars of corporate money that went into protesting SOPA. Again, it was about money.
If you look at the GDP to national debt map on wikipedia you will notice, that most (if not all) first world countries, the beacons of human rights and democracy, owe more that they can produce in the foreseeable future. It is not the tax money they are spending.
The highest debt:GDP ratio on the list under either measure is Japan's under the CIA measure, at a little over 200% of GDP. That's not more than it can produce in the forseeable future (its a little more than it produces in two years.)
It may be more than they can are likely to pay off in the forseeable future, but then, that's a completely different story.
> It is not the tax money they are spending.
That's not a question that is addressed by debt:GDP ratio, its a question that is addressed by deficit:budget ratio, which is a very different beast.
There was a country just a little over 20 years ago that was in debt up to its neck and was trying to do global surveillance and project global power. Half of the world was screwed when it fell, and not everybody in the eastern block did recover yet. God help us all if this happens to the usa.
After you misrepresented the last one without actually linking to it, I'm not really inclined to expend the effort to verify your characterization of this one.
> There was a country just a little over 20 years ago that was in debt up to its neck and was trying to do global surveillance and project global power.
AFAICT, the Soviet Union, just before it fell, had an estimated $65-$100 billion in foreign debt with a GDP on the order of $2.5 trillion -- it wasn't really "in debt up to its neck".
Are we still required not to use them, like > 40 bit DES in various circumstances? In 1997 I helped a lawyer who'd previously done embedded programming apply for an export license for a piece of my company's software, in which I either degraded the use of DES or confirmed that the code already did that.
But the Cold War/Clinton anti-strong crypo regime is over. For that matter, the Cold War/Vietnam national security and more ecosystem took major, major hits in the mid-to late '70s, e.g. the Church Committee (although for all we know the most critical thing was J. Edgar Hoover dying in 1972).
Why are you not heartened by the Amash Amendment vote? Especially in how it didn't break down according to any conventional lines?
Everything I can see in my corner of Red State America says enough people believe the government has stepped over a line such that we can very possibly win. Then add discrete lobbying by tech companies ... which will I expect play out a lot slower and limited than normal given the Joseph Nacchio object lesson.
Very few people go down this road and come back with their ideals and principles intact.
The problem, as the article points out, is that people are demanding greater security, and government abuse is driving this. That security comes at a cost for things like wiretaps. The choices are bleak and the showdowns are commencing. Dangerous times.....
Remember, though, this isn't just "government vs. the little guy". There are large interests that don't particularly care for the US government intercepting their every move. Some of these may sue, some may contribute to furthering encryption technology, who knows what else.
My personal feeling is that the NSA's surveillance is going to slowly but surely get much harder over the next few years. Centralization was convenient, but if there's enough push to decentralize, it can be done, and will be done. And further, the exact stuff that the NSA is most interested in is going to be the first to go.
We're overdue for another wave of decentralization anyhow.
It's already gone. That's what's so insidious about this whole NSA/CIA/FBI/DHS/DEA debacle: it's all a wasteful charade. They haven't caught __anyone__. They haven't stopped __anything__ of import. It's a bunch of bureaucrats playing cold war with real lives and money. They shouldn't have access to anything because they don't DO anything worthwhile with it.
The world is getting safer. Information/education (power) via technology is being shifted to the individual in a big way and they HATE it because it makes them irrelevant. The current state of the government three letter agencies is an ongoing FUD apparatus that exists for almost no other purpose than self sustenance.
The NSA has systematically and illegally shared information with the DEA and other domestic law enforcement[1]. It has done so while encouraging them to cover it up using “parallel construction” to establish probable cause for an arrest. The FBI entraps people into terror plots and then "busted" them[2]. The ATF sells guns to the Mexican drug cartels[3].
Look at the sources below. It's Forbes, The New York Times and The Washington Post. This isn't edge case conspiracy theory. This is systematic institutionalized corruption covered daily in the main stream press .
The military industrial complex and it's self-sustaining security theater is eating billions (trillions?) in real tax payer money and costing us god knows what via chilling effects and opportunity costs of human lives ruined or snuffed out. It makes me sick to think about the scale of the losses.
The only good news is we (as in we, the people) are winning, as of now. We can all still talk about this stuff without secret police showing up at our door. And, more importantly we ARE talking about it. Everyone is pissed, congress' approval rating is 11%. Pretty soon everybody will know everything. Obama, Holder, Clapper and co have a lot more to hide than we do. That's why the government and their financiers are so freaked out and paranoid.
[1] http://www.washingtonpost.com/blogs/the-switch/wp/2013/08/05...
[2] http://www.nytimes.com/2012/04/29/opinion/sunday/terrorist-p...
[3]http://www.forbes.com/sites/realspin/2011/09/28/fast-and-fur...
Once someone puts the whole picture together and the middle class continues to decline, and the rich get richer, and the poor get poorer, and the safety net gets dismantled more and more (although Obama Care is at least a step forward I'd say), and the prisons keep expanding, and the endless drug war keeps going on, and the debts keep rising, and the population keeps expanding, and the costs of goods keep going up and up, and the whole myriad of other things that are going on in secret and out in the open, well... I'd imagine it's not going to be pretty at best. Hopefully things can change slowly and we can avoid all the whole house of cards collapsing, but who really knows?
All this has happened before, all this will happen again:
The previous battles are I think small skirmishes compared to what is coming.
That was exactly the issue during the crypto wars. The cat was out of the bag by the time NSA agents showed up in Rivest's office and started treating it like a crime scene. The DOJ brought up stories about common criminals using PGP to avoid prosecution when Zimmerman was testifying before Congress. The crypto wars were an effort to prevent cryptography from becoming commonplace, not just about a few high-level targets using it.
"there will be much money to be made trying to build NSA-proof services"
First of all, privacy is not a service, at least not if "privacy" means "NSA-proof." Hushmail and Lavabit have proved that point beyond any doubt.
I also doubt that privacy-enhancing technologies will be very profitable. There is a general lack of understanding of what things like PGP actually do, which makes it hard to sell such things. People want convenience more than privacy. Business users are willing to accept systems with back doors, for both their own internal needs (a dead employee's files should not be lost forever) and for compliance with various regulations (e.g. Sarbanes-Oxley).
What you almost certainly will see are lots of scams and snake-oil security.
Right. I totally get that. I am just saying it is totally different now that the government has given everyone strong incentive to use crypo as a matter of course. If people don't trust the government to be responsible regarding wiretaps, the government won't be able to wiretap.....
I imagine it'll be fought, but quietly and sealed under various letters/orders/statements for the next 30 years.
Just watch out for Apple's that's-no-office-building spaceship. (It's easier to disguise a launching platform as an office building rather than build an (undetected) assembly platform in LEO.)
That's a nice little phone company you have their Mr Brinn it would be terrible if something happened to your telecoms licence.
You repeat yourself.
Suppose you were an idiot. And suppose you were a member of Congress. But I repeat myself.
"It could probably be shown by facts and figures that there is no distinctly native American criminal class except Congress."
Suppose you were a member of Congress. And suppose you were an idiot. But I repeat myself.
Otherwise the only idiots in the world would be Congressman.
The next time they come for the gun owners (well, that would be yesterday: http://www.pagunblog.com/2013/08/29/obama-issues-executive-o...) you might want to consider that this set of rights is indivisible.
There's no reason normal citizens need high-strength crypto.
I'm pretty sure that would be illegal in the case of an NSL.
And then, when the government says "Stop doing that, we want to watch your users," the only way to do that and hide the watching would be to disable the system wide security view. And people make their conclusions.
The secrecy part can be a violation of the 6th amendment (right to confront your accuser), but theoretically evidence procured under the NSL will be produced by trial time (except when shown to conflict with national security, which judges can sometimes accept too readily).
The real problem with secrecy is the first amendment, since you are forcing people to not divulge that they received an order to hand over information. Typically prior restraint like that is heavily circumscribed to protect an ongoing investigation but no further, which means that indefinite gag orders should have correspondingly extraordinary justification. Considering the hundreds of thousands of NSLs that have been issued, this seems unlikely to be the norm.
The first amendment approach has been successfully[1] argued by the EFF at the district court level. This has opened the way for more lawsuits, including an appeal of that case, which will hopefully make their way higher in the court system.
(read the linked EFF article if you're interested in more. It lays the case and the judge's ruling out in great detail)
[1] https://www.eff.org/deeplinks/2013/03/depth-judge-illstons-r...
Unfortunately, the alternatives will have to come from elsewhere - from disruptive (in privacy) start-ups that will launch only services with security in mind from day one, as they try to steal customers away from those companies.
> My guess is the de facto interception technique of the future will involve targeting users’ endpoints (phone, computer, tablet, whatever) instead of trying to intercept communications in transit.
The data is still stored in the hands of tech companies, and as such outside the realm of control of the owners of the data. The article writer would do well to realize that it's not about national security, terrorists, or China -- but instead it's about control.
No matter where the data ends up being stored, if it has to GO somewhere, and you are the man in the middle everywhere, things start getting a lot easier to track.
ADDED: which helps explain the current behavior of other companies we'd like to think better of. I'm sure the people running them would to, but they and their families (who the Feds have targeted in other political prosecutions) would prefer they stay out of Federal prison.
It is their interest to band together now as one powerful lobby group and force a change to the legislation.
I guess I view this as highly naive. What makes you think the US won't get agreement from these places to share? They already have in a large number of cases.
But we are very far from a usable quantum computer. I doubt we'll get it in 15 years, and I doubt we'll get it before everything changes because of AI, nanotech, some other disruptive tech, or some kind of doom.
Yes, there is nothing stopping you from using ECC with a 2k bits key. Except that you aren't.
1: http://www.people-press.org/2013/06/10/majority-views-nsa-ph... 2: http://en.wikipedia.org/wiki/Joseph_Nacchio
Deleted comment
In this war, the government should win, because the government is by extension the people. It is up to the people of the world to make sure that their governments implement the right laws to restrict surveillance.
History tells us no. History also tells us that tech companies often don't give a shit. Perhaps a highly visible company like Google or Twitter might, but a little visible company like IBM or Cisco? I wouldn't bet on it.
What journalistic integrity.