Slashdot Mirror
CNET: Feds Put Heat On Web Firms For Master Encryption Keys
First time accepted submitter fsagx writes "The U.S. government has attempted to obtain the master encryption keys that Internet companies use to shield millions of users' private Web communications from eavesdropping. These demands for master encryption keys, which have not been disclosed previously, represent a technological escalation in the clandestine methods that the FBI and the National Security Agency employ when conducting electronic surveillance against Internet users."
I know this is an important issue, but didn't we just do this exact same article yesterday?
http://it.slashdot.org/story/13/07/24/1812227/anonymous-source-claims-feds-demand-private-ssl-keys-from-web-services
From TFA.. "Apple, Yahoo, AOL, Verizon, AT&T, Opera Software's Fastmail.fm, Time Warner Cable, and Comcast declined to respond to queries about whether they would divulge encryption keys to government agencies." Now you know who is coughing up to the NSA..
Have you fscked your local propeller head today?
Fuck the NSA.
"The government's view is that anything we can think of, we can compel you to do."
Seems pretty spot-on. Unless people challenge these illegal activities, they'll just keep on and on.
After all, they have pretty-much unlimited resources compared to most private entities, and no real pressure to justify their usage.
Your tax dollars at work.
If they can get the keys, then they don't need to use PRISM, they can grab the data upstream.
It lets them hide the PRISM surveillance, Google/Yahoo/Facebook/DropBox etc. no longer gets to see the volume of requests, it is hidden. US companies can claim, with some degree of truthiness, that they no longer deliver data to PRISM requests, as if the program has been ended, because they no longer see the requests or get to challenge them. In fact surveillance had been expanded to all https traffic.
They gain 'plausible deniability', and NSA gains 100% surveillance of their https traffic and the ability to man-in-the-middle at will, by simply using their connection upstream. NSA also removes the problem of companies challenging the intercepts.
The fix is to avoid US based services, either their servers are compromised by the NSA, or their keys.
More difficult is if NSA has signing rights from the US certificate authorities. Most of these are built into your browser. I tried deleting them from Firefox but it was not possible. With those compromised NSA can sign *foreign* traffic and man-in-the-middle intercept it even though both ends of the conversation are outside NSA control.
The fix there is to avoid traffic being routed across NSA controlled territories (USA/Canada/UK/NZ/AUS). So if it crosses the UK they record everything and the private keys will let them record all https traffic too. A lot of backbone crosses the US, and a lot of European traffic crosses the UK, so France to Germany might cross the UK, and Germany to Japan might cross the US.
"We" collectively have elected these Idiots. However, "I" have not voted for a winner in at least 30 + years. So .... don't blame me. Blame the "vast majority" of people who think we only have two parties. Republicrats and Demicans. Or as I call it, Men who look like pigs and pigs who look like men (see Animal Farm)
Agent K: A *person* is smart. People are dumb, stupid, panicky animals, and you know it.
Every telecommunication company that operates within the United States is required by law to provide law enforcement access to communication streams on demand. It's called CALEA and all telecommunications companies are required by law to follow it.
CALEA also requires that encrypted communications be decrypted. This includes services like Skype(specifically). CALEA requires that Microsoft provide law enforcement access to the UNENCRYPTED streams of Skype communications, on demand. This is not new and, in light of the House vote yesterday, is not likely to change.
Seem like the better option now. At least you know what the CA has done with the master key.
Join the Slashcott! Feb 10 thru Feb 17!
Total Information Awareness, championed by Admiral John Poindexter, former United States National Security Advisor to President Ronald Reagan, a one time felon over Iran-Contra (overturned on appeal), wanted to do much of what the NSA is doing today. When the details of TIA became public there was an outrage and the plans for it had to be scrapped. Or were they?
The point is this: the public (voters) say "no" to these things... and they just sneak around our backs and do it anyway. Saying "no" once is not sufficient. If, as a citizen, voter, and patriot you believe that these ideas are bad you need to say "no" repeatedly, early, and often. Once whole bureaucracies are constructed to serve a bad aim it is difficult, and perhaps impossible, to stop them.
As U.S. Supreme Court Justice Louis Brandeis once said, "Sunlight is the best disinfectant." With all due respect to Justice Brandeis, if some of these bad ideas do survive, though, it might be more because of public exhaustion than of public acceptance. Or, more simply, perhaps once a secret bureaucracy gets big enough in the darkness there is no way to kill it once it comes into the light. Even sunlight has its limits.
The good news is that if the web servers use forward secrecy in the SSL encryption ( https://community.qualys.com/blogs/securitylabs/2013/06/25/ssl-labs-deploying-forward-secrecy ), then an attacker who has the private key is not able to decrypt a connection he has passively eavesdropped on. An active man-in-the-middle attack is required in order to listen in on the connection.
What I wish....
FED, "Give us your encryption keys"
CORP: "EAD, DIAF!"
Reality....
FED: "Give us your encryption keys"
CORP: "Why?"
FED: "To fight terrorisim, you are not harboring terrorists are you?"
CORP:" Here's the keys, would you also like the keys to the bathrooms and the filing cabinets?"
Do not look at laser with remaining good eye.
If you are relying on a service with a master key for security, you have no security. This is true regardless of whether the government has access to those keys.
you've managed to make me feel sorry for the poor saps that have to spy all day on us
the preceding comment is my own and in no way reflects the opinion of the Joint Chiefs of Staff
Talk to a lawyer
great, now he has two problems.
the preceding comment is my own and in no way reflects the opinion of the Joint Chiefs of Staff
Our two party system only works were the two parties are not the same.
I've said it before, and I'll say it again...the left-leaning half of the Ruling Party is no more, or less, virtuous than the right-leaning half of the Ruling Party.
The only real difference between them is how they want to kill us. The left want to smother us in a stifling nanny-state bureaucracy that'll collapse under its own weight, and the right want to abandon us to fend for ourselves. The latter is more sustainable, but either way we die a miserable death.
"Once we've identified and embraced our sickness, we'll have strength...and that's when we get dangerous." - John Waters
All the commentary I'm reading about this just talks about using it to decrypt captured traffic. One aspect I've not seen anyone address yet is this: wouldn't this allow them to spoof the services in question, and just capture any data they want directly? If you have someone's server certificate (which the server will give you freely), and the corresponding private key, you can set up a server which looks exactly like the real, say, gmail.com, legit certificate signed by a trusted CA and all, and capture unencrypted data to your heart's content.
Maybe that's what the government wants those private keys for? It would completely sidestep the issue of forward secrecy. To me that's even more scary than the possibility that they may be capturing encrypted traffic and using these keys to decrypt it...