Hacker News Reader

Comment by McGlockenshire | Hacker News Reader

So, we all knew that this was probably going to be announced at some point or another, but I find myself amazingly dissatisfied by this article.

I was expecting more detailed evidence. How did they break SSL? Do they just have root certificate copies, or just the certs used for the certain specific sites that they're monitoring data transfer on passively?

The article claims that many VPN technologies are broken, but which ones? Are they talking about specific products here, or actual technologies in use?

View on HN

The newspaper is walking a very fine line between writing this up and disclosing things that would give ammo to those that would rather shut these things down under any pretext including 'helping the enemy'. The things you are asking for are exactly in that direction.

The problem I have with that is that the things asked for affect myself and a significantly large number of ethical and/or law-abiding individuals and businesses. If revealing this info would help the enemy, and if many of us would benefit from knowing this information, doesn't that make many of us part of "the enemy"?

The catch-22 here is that revealing specific details might both "aid the enemy" and aid ordinary people to protect their privacy. Because the government only cares about the former, any appeal to the merits of the latter will fall on deaf ears. The Guardian & NYT know this and the pertinent individuals don't want to end up in court getting the Manning treatment.

The government wanted to use its treatment of Manning to deter leaking of future information, and it has already succeeded in doing so here. It's rule by intimidation, making our government little more than a well organized mafia.

I agree with your point: the Times and The Guardian should avoid getting shut down over "helping the enemy".

However, some folks will want to know what's compromised to avoid becoming part of the collateral damage. I do, for example. Some other folks would like to know this in order to do some Forensic Economics. Like the mid-50s Central American coups, I imagine insiders could profit off this sort of thing in a big way.

It would be nice to know if the NSA has pushed Microsoft products solely because of the ability to influence weird little design decisions that could become trapdoors. That way, we could relieve the Linux people's big question about why the "Year of the Linux Desktop" never arrived.

The year of the Linux Desktop for me was 2004... It doesn't arrive at the same point in time for everybody, but the NSA had very little to do with it arriving for me.

The NSA does not hold control over the purchasing decisions made in countless governments and companies all over the world, for that to be a legitimate worry you'd have to show that in America linux was used substantially less where it should have been used compared to other countries. I doubt you could make that case convincingly.

My guess: -SSL protects only as far as the cloud; they sits after decryption and can get the clear text data

-They can hack into people's computers (using zero day) and read the data before it's ever encrypted

-SSL/TLS do not offer forward security, so the encrypted data can be stored and then cracked if/when the keys become available later

-Man-in the middle attacks that substitute fake keys to both sides and capture the data anyway. It hepls if they captured one or more certificate authorities.

-Brute-force attacks against poorly-configured keys (too short) for SSL and VPNs.

I am feeling like there is a myriad of approaches:

* covert agents in companies -- * stealing certs -- * stealing plans -- * planting code

* direct (yet coerced) cooperation by the corps (goog, fb, etc)

* RNG prediction based on planted flaws in various components

* direct backdoors placed in certain mfr chips (see my comment about being told cisco was required to provide backdoors as early as 1997)

---

You're correct - that we knew that this was going to be revealed. We did not know if it was going to be "NSA's quantum computer the size of a datacenter cracks all encryption in real-time" or the above multi-vector attack.

What is important to see here though is that there is, effectively, absolutely NO escape from NSA eyes.

If you encrypt, they will get you. If you refuse them, they will shut you down. If you build a whole new service to thwart them - maybe they could even lean on PayPal to freeze your funds as well /tin-foil....

Reply on news.ycombinator.com