Slashdot Mirror
Snowden Documents Show How Well NSA Codebreakers Can Pry
Der Spiegel has published today an excellent summary of what some of Edward Snowden's revelations show about the difficulty (or, generally, ease) with which the NSA and collaborating intelligence services can track, decrypt, and correlate different means of online communication. An interesting slice: The NSA and its allies routinely intercept [HTTPS] connections -- by the millions. According to an NSA document, the agency intended to crack 10 million intercepted https connections a day by late 2012. The intelligence services are particularly interested in the moment when a user types his or her password. By the end of 2012, the system was supposed to be able to "detect the presence of at least 100 password based encryption applications" in each instance some 20,000 times a month.
For its part, Britain's GCHQ collects information about encryption using the TLS and SSL protocols -- the protocols https connections are encrypted with -- in a database called "FLYING PIG." The British spies produce weekly "trends reports" to catalog which services use the most SSL connections and save details about those connections. Sites like Facebook, Twitter, Hotmail, Yahoo and Apple's iCloud service top the charts, and the number of catalogued SSL connections for one week is in the many billions -- for the top 40 sites alone. ...
The NSA also has a program with which it claims it can sometimes decrypt the Secure Shell protocol (SSH). This is typically used by systems administrators to log into employees' computers remotely, largely for use in the infrastructure of businesses, core Internet routers and other similarly important systems. The NSA combines the data collected in this manner with other information to leverage access to important systems of interest.
this is truly disgusting
I am playing the devil's advocate here.
Do users really care who reads their data? I mean they are anyway happily giving away all their data and communications to Facebook anyway.
Or do we say we trust Facebook more than the government?
how come so much stuff still happens even with all this collection going on? if it's anything like my local town's CCTV no one is even watching. unless there's some tits. or a spouse to spy on.
And there's basically nothing we can do for a long-term solution.
The US has different sets of laws and standards it applies whenever it wishes. And we all hope it is bad as hell for business. Move on already. The damage is done and will not be undone for at least fifty years.
fuck the nsa and ya know what we all should do is unite against them and hammer the fuck out of the us govt until it stops this bullshit
they have declared war on all of us
I'll point out that SSL is meaningless when the MITM can record it all and decrypt later, or possibly decrypt on the fly.
And HSTS is meaningless as well, so don't bother bring up that nugget.
I doubt there is any readily available encryption that can protect you at this point.
"If any question why we died, Tell them because our fathers lied."
Before we all get too hysterical, from the article itself:
In other words, the NSA, GCHQ and other intelligence services are probably only able to crack badly configured or unpatched and badly out of date systems. That doesn't stop them from using out of band vulnerabilities like hacking into someone's PC or forcing some online service to open up the decrypted data, but it seems likely that if you have a well-managed cert chain and your systems are kept up to date and patched, the odds of anyone, government or otherwise, busting into your encrypted data seems pretty low.
My big fear out of all this isn't the unlikely hacking of mainstream encryption schemes, but rather that those that do use encryption may end up being targets of other methods; like malware, to get at their critical data.
The world's burning. Moped Jesus spotted on I50. Details at 11.
It's time to stop sending keys using dumb methods. Time to start generating keys and physically swapping/installing them.
The authenticity of host '...' can't be established. RSA key fingerprint is .... Are you sure you want to continue connecting (yes/no)?
That's ssh letting you know that a man-in-the-middle attack could be successfully launched at you, and decrypt all your communication.
"First they came for the slanderers and i said nothing."
This is typically used by systems administrators to log into employees' computers remotely ...
SSH is normally used to log into company servers, not employee's computers.
very well said.
The company I work for asks me to change my password every month, so I am safe. Right?
Don't fight for your country, if your country does not fight for you.
those protocols or programs have a major rating (major according to the article means impossible unless someone made a mistake or malware was used)
OTR
TrueCrypt
those protocols have a catastrophic rating (catastrophic for the NSA is a win for US)
ZRTP
PGP
about the SSH thing, it all depend on the cipher used, if you use ssh with a MD2-DES cypher expect it to be decrypted
if you use something like twofish or salsa20 your probably quite secure
Does this Snowden character have a BLOG? I bet hearing his voice directly might be interesting....
Flying Pigs. Cute!
The article mentions:
Uh, Linux geek since 1999.
Say, I further "encrypt" my https sessions using ROT13. If NSA is on to me specifically, they will have no problem figuring it out. But if they opportunistically monitor main internet pipes for vulnerable traffic, I should be safe. What if web browsers encrypted data with one of hundreds of algorithms independently developed by smart people worldwide *before* standard https? At least some of them will prove resistent to cryptanalysis and even vulnerable ones will consume some of NSA's computing power and employee time to crack.
And there's basically nothing we can do for a long-term solution
The only thing that is scary is that if everyone says what you say, then the future for the Western countries, including the United States of America, England, and the rest of Europe, will be very bleak
In short term of course, what the people can do is very limited, as the spooks have had decades of investments (in hardware as well as in hiring/training of their talents) and the infrastructure in place is indeed very hard to go against
In the long term, however, it is up to the people to decide whether or not they hand over their rights to the spooks, or the people demand that the spooks (and TPTB who supports the spooks) retreat from what they have been doing, and return the people their full rights
Until Snowden and his co-conspirators are brought to a US court of law, this means nothing. It's (at best) a Schrodinger's Unauthorized Disclosure.
Twitter supports and protects racists - by smearing their critics with the "Hate Speech" label.
Actually, I've had a Facebook account for years and I use it regularly.
Of course I'm well aware that they sift through all of my information and try to resell it. But IMO, it's a pretty well understood trade, and one that I don't have a big problem with. The fact remains, Facebook will only have the information that I willingly provide by way of posting it up there or filling out fields on the site. And meanwhile, they're enabling ME to obtain information on all of my friends and other online connections too.
I don't share or say anything on FB that I'm not already comfortable sharing with other people, so it's not like huge secrets are being revealed. Things I do get out of Facebook include using local buy/sell/trade type groups that people have set up (no fees to post listings or fees owed to the site operator upon successful sales) and special interest groups, such as one for one of the cars I own.
I've also been able to keep in touch with a number of old friends who I probably wouldn't keep up with otherwise, after moving. (And let's face it... that's primarily because there's nothing critical or earth-shattering to be gained by keeping up with these people's daily lives when you don't even live in the same city as them anymore. But when it's free and as easy as checking in on FB, it makes for a mildly enjoyable way to kill some time while better preserving those old friendships. You never know when you're going to visit a place you used to live, and it's nice not to do so without having to wonder if those people you "used to know" still live at the same address, etc.)
If Facebook does nothing for you, great. Don't use it! But I see so much bashing of the site that I think is unwarranted. Did FB ever so much as beg for donations from you to keep it operational, or limit how much time you could spend using it each month or day? Nope! And yet, you're even free to create new groups (even closed, private ones) without owing a dime. IMO, there's a lot of value to be wrung out of using the site -- despite knowing they're trying to cull value out of the content you put out there.
It won't change the need for justice exacted on him, just the method.
"But I have diplomatic immunity^w^w a pardon!" comes to mind when Snowden and his helpers find out the unfortunate error of their ways.
Twitter supports and protects racists - by smearing their critics with the "Hate Speech" label.
I hope that Edward isn't found dead and that when an autopsy is performed they don't find the lining of his trachea torn and bloodied from all of the screaming before he died. The kind of damage that only involuntary, reflexive staccato shrieking could cause. That would be VERY sad and just terrible. :(
Yet another digital fortress!!!
http://popularbloggingtopics.c...
But IMO, it's a pretty well understood trade, and one that I don't have a big problem with.
Okay, then, we're done. Good job enabling their unethical behavior.
And people think hackers are that stupid to carry out these recent attacks. It's the NSA stupid! It's a way to manufacture consent through the populace so they can pass internet controls in the form of regurgitated bills formerly know as PIPA and SOPA!
You are WHITEWASHING them. NSA+GCHQ are interested in the latest "emissions" of humans. The TEXT of your emails, you SMSs, the transcription of your phone, skype conversations. The TEXT you type into FarceBook. And SURE AS HELL, they have the storage capacity to record every single soul on this planet. Do the maths and you will figure. Most people do not generate more than 10kBytes of text per day. All that TEXT is then stored in a Google-esque Data Mart and ready to be queried and minded - just like you query the google index. That TEXT can be fed into AI systems in order to do all sorts of stuff. Like predicting who will be the next president or whether the plebs like your Next New War. And they can store this TEXT FOREVER. DO the math. What they can do, they will. It can be used as KOMPROMAT AS LONG AS YOU LIVE. And as long as you allow yourself to be intimdated by that, of course. They are running an ELECTRIC CHECKA, just without widespread torture and killing of their compatriots. Wait for that to happen, because they have already accustomed themselves to that during the 9/11 craze FOR THE WAR INDUSTRY.
...they have some built-in stuff, which (just as one example) works like this: You browse with your FreeBSD user "mike" to slashdot.org. They intercept traffic and insert a nice little exploit for FF. The exploit will run with FF privileges and exfiltrate the ssh key to NSA. This works on 99% of users. The 1% of the rest will be had by other means, some of which might reside in the kernel and/or the CPU itself. How difficult is it to insert a crack developer into a FOSS project in order to lay some easter eggs ? How difficult is it to insert a crack EE into Intel ? With the SSL crappile they have done it to the standard and major implementations themselves. Simply too complex to do properly.
Didn't see this posted but what the hell. Would this be a good opportunity to push self driving cars forward? These DUIs need to get to work, we need real world testing of these steering wheel-free Google cars. Might save a few folks who made a mistake from falling into a hole they can't crawl out of. Morally superior types have their Scarlet Letter in the form of the Google Dorkmobiles. Cameras everywhere inside/out to make sure the system isn't gamed. I'm sure I've ludicrously simplified the issues, but think there is an opportunity here.