Slashdot Mirror
Snowden's NSA Leaks Gave IETF a Needed Security Wake-up Call
alphadogg writes "Security and how to protect users from pervasive monitoring will dominate the proceedings when members of Internet Engineering Task Force meet in London starting Sunday. For an organization that develops the standards we all depend on for the Internet to work, the continued revelations made by NSA whistleblower Edward Snowden have had wide-ranging repercussions. 'It wasn't a surprise that some activities like this are going on. I think that the scale and some of the tactics surprised the community a little bit. ... You could also argue that maybe we needed the wake-up call,' said IETF Chairman Jari Arkko. Part of that work will also be to make security features easier to use and for the standards organization to think of security from day one when developing new protocols."
Go ahead. NSA will destroy you if you do anything that actually secures the internet.
they still suggest things that hep the spy agencies like utterly retarded "trusted proxy" garbage. they are either still asleep or part of the spying apparatus.
And yet, despite the clear conflict of interest, an NSA employee remains in a position of trust in a cryptography standard. No accusation against the guy since don't know him. However, if you or I got caught trying to damage the standard we were working in, we'd get sued. If he got caught he'd just be told to be more careful next time. It is totally inappropriate and the IETF should act.
It's about time... There are many standards that the IETF has domain over that are weak and some that should be considered wholly insecure and not recommended or deprecated. These were developed when we were much more trusting of our neighbors on the Internet. Hopefully they'll start taking this to heart when it comes to new standards.
Harrison's Postulate - "For every action there is an equal and opposite criticism"
And that's with scripting disabled even. NetworkWorld is a whore.
just to answer the bullshit "the co-chair can't influence the standard he's working on line"; remember, if he works for the NSA, he already knows where the problem in the standard is. If he notices someone working in that direction, all he has to do is ask a few extra favors and they won't have time to spot the problem.
This article is an example of poor technology journalism. The article offered a pathetic excuse as to why security has not been implemented: it's too complex and difficult. No one ever bothered to write a good user interface for the security mechanisms. Most of the security tools are written to be used by engineers. Why not make a user interface that glues together these tools so that every Tom, Dick, and Harry can use them? It isn't necessary to use such complex tetminology either. I'm not saying dumb it down completely but make some tools for the less computer savvy.
If you care about Internet security, especially what we call "end-to-end" security free from easy snooping by ISPs, carriers, or other intermediaries, heads up! You'll want to pay attention to this.
You'd think that with so many concerns these days about whether the likes of AT&T, Verizon, and other telecom companies can be trusted not to turn our data over to third parties whom we haven't authorized, that a plan to formalize a mechanism for ISP and other "man-in-the-middle" snooping would be laughed off the Net.
But apparently the authors of IETF (Internet Engineering Task Force) Internet-Draft "Explicit Trusted Proxy in HTTP/2.0" (14 Feb 2014) haven't gotten the message.
What they propose for the new HTTP/2.0 protocol is nothing short of officially sanctioned snooping.
In November IETH already almost promised that. Now we are holding our breath. Please hurry. Thank you.
So we get great changes to how packets move and their origins while moving. This would have made any city, state, federal or intergovernmental efforts for tracking not so easy in past years.
The reason we seem to be getting all the good crypto news and 'fixes' might be that the vast illegal domestic spying programs have move on and are now ready for any such changes to the internet.
The next step seems to be "NSA head floats idea: What if we only gathered terrorist communications?" Mar 1 2014
http://arstechnica.com/tech-po...
i.e. a new “collect-it-all” option for domestic and international use offering deep pack inspection at a level (exchange, digital loop carrier) to keep the first 'hop'.
You can then move all the packets globally, encrypt all you want, at some point if your work, First Amendment-related activities or tracked daily movements become interesting your digital interactions can all be recreated.
Other efforts to gain your passwords can then be attempted.
Domestic spying is now "Benign Information Gathering"
Any Idiot can right a RFC-Draft, they don't even have to know anything about networking.
"GET / HTTP/1.0" 200 51230 "-" "Mozilla/4.0 (compatible; Setec Astronomy)"
Perhaps if the God you refer to is Tyche.
Happiness in intelligent people is the rarest thing I know.
Ernest Hemingway
are you currently reading The Catcher in the Rye?
Happiness in intelligent people is the rarest thing I know.
Ernest Hemingway
Or they'll just pay someone smarter than you to unsecure it again.
These guys work 24/7 with a budget beyond most corporations to ensure they are one step ahead of everyone and can access any piece of information they want to get to.
Short of never connecting your computer to a public network (and even that might not cut it), You're fighting a losing battle against these guys. If there's any technology out there you could truly use to secure yourself against the NSA, they'll do everything to make sure it never sees the light of day.
The only way to really combat this, is to fight for democracy, open government, and legislation to make these sorts of operations criminal activity.
The IETF is deprecated, and can never be trusted. They have always been against security, as demonstrated by HTTP and HTML's lack of interaction with TLS/SSL.
We already have HTTP-Auth using hash based proof of knowledge via HMAC with a server nonce. So, when deciding to add encryption to the Internet we could have just taken the output of the existing HTTP-Auth -- the proof of knowledge -- and key your symmetric stream ciphers with it instead of sending the proof back and forth in the clear. See?
Yes, this means that you must arrange a pre-shared key with the endpoints, but it's not MITM able (the MITM would only be a relay for encrypted data.
Oh, and before you get all Public Key Crypto on me: Public key crypto just moves the problem of pre-shared secret to be the public keys of the end points. We could use a trust graph -- and I do with PGP -- but no one actually does that. At least if you share a secret in person, face to face with friends, or even when physically at your local bank, then plain old fucking symmetric stream crypto using hash based proof of knowledge as keys instead of exchanging them as in HTTP-Auth would give you an avenue to have security. You should be putting in your password BEFORE the site even pops up, hell the browser can remember it or perhaps optionally generate a per-domain passphrase via hashing your master password with the domain name and some salt -- Presto: ONE PASSWORD FOR THE WHOLE DAMN WEB. That wasn't so fucking hard, now was it? It's been decades. Why don't we have this? The IETF has always been antagonistic to security.
SSL / TLS PKI has always been completely fucked up by design. Just look at the CA system whereby roots can create certs without domain's permission: FF > Settings > Advanced > Certificates > View > "Hong Kong Post" -- you trust bad actors as roots, and introduce an explicit man in the middle. Remember Diginotar? Every security researcher knows to avoid a single point of failure. The CA system isn't a single point of failure, it's MANY points of failure and a SINGLE compromise of any trusted root destroys the security of the whole system -- THAT'S FUCKING INEPT. No competent security aware individual would design a system thus!
Fire the IETF. They have never had our best interests in mind when it comes to security. If this was the best they could do for decades, then they do not deserve to be in charge of any networking standards.
Ghostery turns the tables just like Mega turns the tables. It's tells advertisers what we really think of their methods by adding a usable opt-in layer to their supposed opt-out. The difference here is the advertising industry is happy to pay for that knowledge.
Also, no speed problems with NoScript doing it's thing. Most web pages get bogged down on useless scripts and flash videos.