Slashdot Mirror
IETF Floats Draft PRISM-Proof Security Considerations
hypnosec writes "PRISM-Proof Security Considerations, a draft proposal to make it harder for governments to implement and carry out surveillance activities like PRISM, has been floated by the Internet Engineering Task Force (IETF). The draft highlights security concerns as a result of government sponsored PRISM-like projects and the security controls that may be put into place to mitigate the risks of interception capabilities. Authored by Phillip Hallam-Baker of the Comodo Group the draft is however very sparse on details on how the Internet can be PRISM-proofed."
An IETF draft starts with "draft-ietf-". This is merely a proposal by a member of the IETF to discuss this subject.
Mandatory end to end security was in IPv6. The Feds didn't like that, so guess what? It got removed.
If you ask me, it's time to shit-can the IETF too.
I can't imagine what difference it would make.
Well not being owned by the US Government might be a good start, don't you think?
There is some (debated) evidence that NIST was compromised by directions from above, by external control of its budget, etc.
Lets face it, security and privacy were not designed into the protocols we use on the internet today, they were bolted on afterward, and the government played a big (and self serving) part of that effort. Any amount of data hardening would be welcome at this point. There will still be metadata that can be collected but content should be able to be kept private by default.
I would rather have a community of enraged engineers driving the design and management than a bunch of federal paper pushers with a police mentality.
Sig Battery depleted. Reverting to safe mode.
He repeats this line at least twice, which I am assuming is a result of copy and paste. Unless he is saying that PRISM is a second government, I guess my first suggestion would be to add the word "program" in there somewhere ;-)
Guns don't kill people; Physics kills people! - John Lithgow as Dick Solomon on Third Rock From The Sun
Why play cat and mouse with your own governing body? PRISM is illegal. Put effort towards ending it. Otherwise, you're helping terrorists... (rolls eyes)
Out-of-control governments are the real terrorists. Al-CIA-da would salivate at doing one one-thousandth the damage a cancerous government can do.
It is a miracle that curiosity survives formal education. - Einstein
"Lets face it, security and privacy were not designed into the protocols we use on the internet today, they were bolted on afterward, and the government played a big (and self serving) part of that effort."
For those that doubt that statement, please read the documentation provided by the none other than the NSA itself.
http://www.nsa.gov/ia/programs/suiteb_cryptography/
That page was posted by the NSA 4 1/2 years ago and updated in May 2013. Surprisingly, they name names--exactly who worked on what--and even go so far as to provide addresses and personal information for these people. These names can be used to locate networks of "cooperation", just like the NSA uses metadata to find out things about us. For instance, one of the key writers in this document ( http://www.ietf.org/rfc/rfc6318.txt?number=6318 ) when Googled is linked to this document-- https://www.google.com/patents/US6243467 , which in turn adds more names. Follow the names, and see just how much trust you have afterwards.
Dig through the links! Very informative! Start asking yourself what crypto might be safe from the NSA, and you'll quickly realize--the further you dig--that none of it is safe from the NSA. They've identified and created "secure" versions of almost every protocol, for themselves (Suite B), and stuck the rest of the world with lesser versions, versions that would obviously be crackable given that they possess something better.
To be honest, I'm a little surprised that page is still available. I suspect it won't be for long.
the draft is however very sparse on details
Don't worry the NSA and GCHQ will help fill in those details.
Two of my imaginary friends reproduced once
Like the 100k civilian dead in Iraq? How in the world do we have any right pontificating on Syria?
Anyone can submit an I-D for anything. With few exceptions they are uploaded automatically with no human review, zero buy-in, endorsement, weight..etc by anyone. This ID has not even been adopted by a particular WG.
Then theres question of what is it this draft proposes reads more like a hapazard list of one mans problems.
To be clear I'm not attacking the I-D I'm attacking the warped characterization of it by people who should know better.
GF implied that intervention was called for based on 100k dead. Anyway, so we are outraged at 4000 killed by CW and that's the red line? The first 100k dead didn't matter? It makes the current case for intervention even more absurd.
I'm sorry, but that has nothing to do with Syria.
The reason that there are 100k Iraqi civilians dead has nothing to do with the decision about whether or not to invade. The 100k is an argument for actually spending the time to make sure the plans are realistic. Had there been an adequate number of troops in Iraq that would never have happened.
It's beyond me how idiots like you can confuse the issue.
That's small comfort to the 100k DEAD and their friends/family, idiot. Very convenient rationalizing 100k dead based on an "if". Oops! bureaucratic mistake, no harm no foul! How asshats like you can be so cavalier about human life is beyond me.
If the IETF is serious about foiling NSA's PRISM scheme, there is one item that they should add in their proposal ...
DO NOT USE ANY CISCO DEVICE
All CISCO devices come with NSA backdoor pre-installed
Muchas Gracias, Señor Edward Snowden !
My point is that the reason US pols started getting antsy had nothing to do with how many people were killed, it was the way they were killed.
According to the internet, over a quarter million people die every day. A portion of those can't be saved, but a good portion probably could. Where's the line drawn between sacrificing the future well being of my immediate family for the benefit of someone I've never met, never would meet and quite possibly who will, no matter what outside parties try to do, continue to make bad decisions and will drain you dry if you let them. At some point you have to recognize that taking action can result in a net negative result. The whole moral requirement goes both ways, you may say that those who are better off have an obligation to those who are worse off, but at the same time those who are worse off have an obligation to improve their lot and become a net contributor. Much like a life guard and a drowning swimmer, sometimes they'll take you down with them.
I read an article today where they were talking to Syrian refugees and the people in the refugee camp are developing anti-American sentiment because we're not fighting on their side. If the US intervenes then they get lambasted. If they don't they get lambasted. Well fuck it then.
Not sure if I made a point or not.
Is this guy kosher?
The best encryption is the kind that even when they hand you the algorithm you can't break it.
If we could just get government spooks out of the development chain and do it all in opensource we could prevent the backdoors they demand.
If we went to a plug-able encryption module web servers, mail servers, etc could support many of them, and the user could take their choice.
There are a lot of methods we could improve, and every single one of them is easier than your recommended restructuring of government.
Sig Battery depleted. Reverting to safe mode.
New Zealand and Australia may soon be getting the keys to the net encryption too.
http://www.smh.com.au/technology/technology-news/whistleblower-reveals-australias-spy-agency-has-access-to-internet-codes-20130906-2tand.html
Domestic spying is now "Benign Information Gathering"
Watching all Tor endpoints and coordinating the traffic between them is an O(N^2) problem. Not a problem for a targeted attack, not so easy for attacking everybody, unless not many people use it. So people who bittorrent through Tor are, ironically, doing a public service.
You can have end-to-end security any time you want. The problem is, most people don't know to want it.
This is an individual submission, not an IETF working group draft, and does not appear to either be proposed for an IETF wg draft or to be in the RFC Editor's queue. In short, it has nothing to do with the IETF.
The number of civilians killed in the 9/11 attack was approximately equal to a little over a month of fatal traffic accidents in the US for 2001. If the government had spent even a fraction of the money spent on security and military action after 9/11 on road safety and public transport instead, they could have prevented several 9/11s each year.
Politics and public reaction are not rational.
I'm European. As far as I'm concerned you can keep your troops and guns at home, thank you very much.
I'm pretty sure most of my fellow Europeans feel the same.
But then, where would you spend all those shiny weapons your military-industrial complex keeps making and selling you?
If you are really so concerned about the Syrian people, stop arming foreign terrorists and sending them there. Haven't you learned anything from all the fuck-ups you did before?
Before anyone calls me an anti-American, that goes for France and UK, too.
My point is that the reason US pols started getting antsy had nothing to do with how many people were killed, it was the way they were killed.
Yes. When the news reports about the chemical weapons first started coming out, they kept making a big deal out of this. I kept wondering, "and if those people had been shot instead, would that make you feel better?" Seems I'm not the only one to think of that.
It is a miracle that curiosity survives formal education. - Einstein
Politics and public reaction are not rational.
More like, the media discovered long ago that sensationalism sells better than rational thinking because emotions are much easier to manipulate. Being mostly followers who have been conditioned not to think critically, the public and thus the public's representatives simply follow.
It is a miracle that curiosity survives formal education. - Einstein
We need this. Without a way to make sure the NSA isn't invading our privacy, we need to take matters into our own hands. Laws won't do the job. My God, the NSA's philosophy is "We're hunting terrorists. We don't need no stinking 4th Amendment." Unfortunately, I doubt that encryption will keep NSA out entirely, but it will make it harder for them to pick us out of the crowd. Decrypting still takes extra time & effort and that little bit of hassle may be enough to keep their noses out of your business. One thing we can do right now is stop storing stuff on Dropbox, iCloud, etc., where it's easy pickings for NSA Take it down and stash everything in a CloudLocker (www.cloudlocker.it), which works just the same but it's private and stays in your home where they still need a warrant to see inside.