mnordhoff_

Matthew Green wrote about GSM and LTE a few months ago:

http://blog.cryptographyengineering.com/2013/05/a-few-though...

TL;DR: GSM security is a joke. LTE is okay, except for two critical issues: One, an attacker can jam LTE and cause a downgrade to GSM. Two, it doesn't offer forward secrecy, so an attacker can record your traffic, obtain the private key from your carrier, and decrypt it. It's a reasonable assumption that NSA and your local sigint agency routinely make copies of your carrier's key database.

Edit: Reword last sentence.

IIRC, Poland was the EU country that was the focus of attention.

Skimming Wikipedia's most definitely totally truthy article on the subject [1] (actually, it has a lot of citations, so it should be easy to verify), the UK's only alleged black site was the US base on Diego Garcia, which is "UK", but not "basement in London".

[1] https://en.wikipedia.org/wiki/Black_site#Suspected_black_sit...

Edit (T+18 minutes): Wikipedia lists numerous other European countries as possibly being involved. Information is really sketchy -- they are called "black" sites. Another question is which officials in the lucky host countries even knew about it.

Public Service Announcement: "SHA1(password+salt)" is an extremely unsafe way to store passwords. Use PBKDF2, bcrypt or scrypt.

Edit (T+7 minutes): Rewritten to not be a jerk.

Nginx has an equivalent preference, ssl_prefer_server_ciphers on. (Scroll down a bit on evmar's link.)