Forgot your password?
typodupeerror
United States Communications Encryption Government Privacy The Internet Your Rights Online

CNET: Feds Put Heat On Web Firms For Master Encryption Keys 148

Posted by timothy
from the our-public-servants dept.
First time accepted submitter fsagx writes "The U.S. government has attempted to obtain the master encryption keys that Internet companies use to shield millions of users' private Web communications from eavesdropping. These demands for master encryption keys, which have not been disclosed previously, represent a technological escalation in the clandestine methods that the FBI and the National Security Agency employ when conducting electronic surveillance against Internet users."
This discussion has been archived. No new comments can be posted.

CNET: Feds Put Heat On Web Firms For Master Encryption Keys

Comments Filter:
  • Dupe (Score:5, Informative)

    by rsmith-mac (639075) on Thursday July 25, 2013 @07:51AM (#44379785)

    I know this is an important issue, but didn't we just do this exact same article yesterday?

    http://it.slashdot.org/story/13/07/24/1812227/anonymous-source-claims-feds-demand-private-ssl-keys-from-web-services [slashdot.org]

    • by Pikoro (844299)

      Was just going to post that same link.

    • by Anonymous Coward

      I wanted the first post saying it was a dupe!

      Anonymous Source Claims Feds Demand Private SSL Keys From Web Services
      Posted by Unknown Lamer on Wednesday July 24, 2013 @02:41PM
      from the world-wide-fool-proof-cage dept.

      [shakes fist at rsmith-mac]

    • Re:Dupe (Score:4, Funny)

      by TWiTfan (2887093) on Thursday July 25, 2013 @08:15AM (#44379975)

      Maybe we're in a loop like in that movie "Groundhog Day," where every day we wake up and learn the NSA are dicks all over again!

      • by 1s44c (552956)

        That film was a third rate twilight zone ripoff. A bit like the NSA in that regard I guess.

        • All the movies/shows that use the repeating day theme are PKD ripoffs. Twilight zone being the first to rip him off isn't special.

          • All the movies/shows that use the repeating day theme are PKD ripoffs.

            Then why hasn't Dick's estate sued?

            • by ulatekh (775985)

              Then why hasn't Dick's estate sued?

              Why not? After all, Yes album-cover artist Roger Dean is suing James Cameron [yahoo.com] because he thinks "Avatar" looks too much like his acid-drenched artwork...

            • by oobayly (1056050)

              Because they got a shit load of abuse for suing Google when they decided to call their phone Nexus One. That, or they're too busy working out ways to make more money from their father's work without inputting anything of their own.

              As you might guess, I've a very low opinion of children of live of their parent's copyrighted works.

      • by Anonymous Coward

        And it will repeat, day after day, until we finally elect a libertarian majority congress. We're in for a long wait...

    • Or a decade ago: http://m.slashdot.org/story/18188

    • by gstoddart (321705)

      I think this is being treated as coming from a more reputable source since it's CNET (form your own opinion).

      But this shit, is stuff that matters.

      They're trying very hard to implement the full-scale Big Brother crap. I don't see this being anything but some very scary shit. There isn't much room for freedom and anonymity when your government can watch everything you do.

    • by Tasha26 (1613349)
      Maybe it's good to regularly remind /. users how horrifically evil the Feds can be. I mean, are they out of mind? Master encryption key!? Why not also ask for their CC pin number and Paypal password?
  • by nanospook (521118) on Thursday July 25, 2013 @07:52AM (#44379795)
    From TFA.. "Apple, Yahoo, AOL, Verizon, AT&T, Opera Software's Fastmail.fm, Time Warner Cable, and Comcast declined to respond to queries about whether they would divulge encryption keys to government agencies." Now you know who is coughing up to the NSA..
    • by mmcxii (1707574) on Thursday July 25, 2013 @08:06AM (#44379881)
      Don't think that they're the only ones. Given the current climate I think it is reasonable to assume that you're being monitored regardless of your method of communication.
    • "Apple, Yahoo, AOL, Verizon, AT&T, Opera Software's Fastmail.fm, Time Warner Cable, and Comcast declined to respond to queries about whether they would divulge encryption keys to government agencies."

      I'm sometimes surprised at big companies cozying up with big brother. This might help get them some favorable legislation and tax breaks, but it comes at the expense of international credibility. If I worked at a company in Europe, I would have second thoughts about purchasing software from a US vendor with backdoors for the US government. Same goes for cloud service providers where the US government could issue national security letters and read all my data without notifying me. I don't know how this ki

  • Congress agrees: Americans no better than foreigners, spy on everyone!

    • by shentino (1139071)

      Well they're right about that.

      As many people keep chanting, we're the ones who "elected" them. *cough*elected*cough*

      • "We" collectively have elected these Idiots. However, "I" have not voted for a winner in at least 30 + years. So .... don't blame me. Blame the "vast majority" of people who think we only have two parties. Republicrats and Demicans. Or as I call it, Men who look like pigs and pigs who look like men (see Animal Farm)

        • by BitZtream (692029)

          I will blame you.

          I'll blame you for resorting to childish name calling, which makes your point completely disappear as people instantly flag you as just some other ranting lunatic.

          Second ... STOP USING FUCKING BOOK REFERENCE WHEN YOU UTTERLY FAILED TO UNDERSTAND THAT PLOT. God, the slashdot meme of all time is for people to reference 1984, while Animal Farm is closer, you still failed to get the actual point. Stop trying to reference it to look smarter.

          • by causality (777677)

            I'll blame you for resorting to childish name calling, which makes your point completely disappear as people instantly flag you as just some other ranting lunatic.

            Being hypersensitive and too easily offended makes you look like the ranting lunatic. Specifically, it looks like you just don't like the guy and are clutching at straws for some way of taking a jab at him. Whether or not that's actually the case. It also makes you appear to promote this phoney decorum and perfect inoffensiveness that no living human being actually embodies in real life.

            Second ... STOP USING FUCKING BOOK REFERENCE WHEN YOU UTTERLY FAILED TO UNDERSTAND THAT PLOT. God, the slashdot meme of all time is for people to reference 1984, while Animal Farm is closer, you still failed to get the actual point. Stop trying to reference it to look smarter.

            He referenced a very specific part of it in order to make a joke about how incredibly similar the Democrats and Republi

            • Whether you agree or don't with me doesn't matter. You're a rare sort. And I mean that in a very positive way. My guess, is he viewed Animal Farm as a manual.

        • by Agripa (139780)

          I blame you for being insufficiently persuasive.

          I blame myself for the same reason but I have not voted for the winner or the loyal opposition loser either ever.

      • by 1s44c (552956)

        Well they're right about that.

        As many people keep chanting, we're the ones who "elected" them. *cough*elected*cough*

        Yes. We had the choice of freedom destroying warmonger or nice guy who turns out to be a freedom destroying warmonger. Our two party system only works were the two parties are not the same.

        • by ulatekh (775985) on Thursday July 25, 2013 @09:29AM (#44380817) Homepage Journal

          Our two party system only works were the two parties are not the same.

          I've said it before, and I'll say it again...the left-leaning half of the Ruling Party is no more, or less, virtuous than the right-leaning half of the Ruling Party.
          The only real difference between them is how they want to kill us. The left want to smother us in a stifling nanny-state bureaucracy that'll collapse under its own weight, and the right want to abandon us to fend for ourselves. The latter is more sustainable, but either way we die a miserable death.

          • by Froggels (1724218)
            True. It doesn't matter whether one is a communist liberal leaning leftwing moonbat pro-choice Democrat or a right wing neo-con facist Tea Party gun toting pro-life Republican: Both are circling the same drain, yet neither side seems to recognise what's happening.
          • by Jawnn (445279)
            Wow. It must be nice to live your black and white world. Mine is so many confusing shades of gray that I find that I am just unable to put suitable labels on most people and things.
            • by causality (777677)

              Wow. It must be nice to live your black and white world. Mine is so many confusing shades of gray that I find that I am just unable to put suitable labels on most people and things.

              The point was that the world is a great many shades of grey, and is therefore not suitably represented by our black-and-white two-party system.

              Reading comprehension is gravely on the decline. It's been replaced by an insatiable need to be right at someone else's expense, even if you have to put words in their mouths to do it.

  • Unencrypt this (Score:5, Insightful)

    by Anonymous Coward on Thursday July 25, 2013 @08:07AM (#44379899)

    Fuck the NSA.

  • by Bearhouse (1034238) on Thursday July 25, 2013 @08:09AM (#44379913)

    "The government's view is that anything we can think of, we can compel you to do."

    Seems pretty spot-on. Unless people challenge these illegal activities, they'll just keep on and on.
    After all, they have pretty-much unlimited resources compared to most private entities, and no real pressure to justify their usage.
    Your tax dollars at work.

    • by Bigby (659157)

      To make it legal, all they have to do is give a penalty of $1,000,000,000,000 for every company that refuses to turn over their private key. If we learned anything about Federal authority, they can't do anything directly, but they sure can impose a "tax" to do all kinds of Unconstitutional things...

    • Unless people challenge these illegal activities, they'll just keep on and on.

      At some point, people who are paying careful enough attention will realize that even if they challenge these illegal activities, they'll just keep on and on.

      And then they will be faced with the option of either supporting or abolishing that institution which abuses them.

  • by Anonymous Coward on Thursday July 25, 2013 @08:10AM (#44379927)

    If they can get the keys, then they don't need to use PRISM, they can grab the data upstream.

    It lets them hide the PRISM surveillance, Google/Yahoo/Facebook/DropBox etc. no longer gets to see the volume of requests, it is hidden. US companies can claim, with some degree of truthiness, that they no longer deliver data to PRISM requests, as if the program has been ended, because they no longer see the requests or get to challenge them. In fact surveillance had been expanded to all https traffic.

    They gain 'plausible deniability', and NSA gains 100% surveillance of their https traffic and the ability to man-in-the-middle at will, by simply using their connection upstream. NSA also removes the problem of companies challenging the intercepts.

    The fix is to avoid US based services, either their servers are compromised by the NSA, or their keys.

    More difficult is if NSA has signing rights from the US certificate authorities. Most of these are built into your browser. I tried deleting them from Firefox but it was not possible. With those compromised NSA can sign *foreign* traffic and man-in-the-middle intercept it even though both ends of the conversation are outside NSA control.

    The fix there is to avoid traffic being routed across NSA controlled territories (USA/Canada/UK/NZ/AUS). So if it crosses the UK they record everything and the private keys will let them record all https traffic too. A lot of backbone crosses the US, and a lot of European traffic crosses the UK, so France to Germany might cross the UK, and Germany to Japan might cross the US.

    • by BitZtream (692029)

      Having the keys helps prism get more data. PRISM doesn't magically have access to encrypted data.

      The fix is to avoid US based services, either their servers are compromised by the NSA, or their keys.

      Right, because you KNOW of a country that you KNOW isn't doing it as well ...

      Let me give you a hint: The only countries not doing it ... are only not doing it because they have a grand total of 3 computers in the entire country with Internet connections. You aren't hiding from this behavior by running to another country.

    • sign your own key. Use PSK with whomever you are communicating with.
      -nbr

  • by Anonymous Coward

    Seems like a PR stunt:

    1) NSA gets caught spying on everyone
    2) NSA makes a big public show of asking for encryption keys from telecoms, emplying they haven't been able to read as much traffic as previously thought.
    3) Telecoms of course refuse after rallying together.
    4) NSA is foiled! We all believe we have security again because the NSA can't read our encrypted e-mails!
    5) NSA goes back under the radar.

    Bullshit. If the US government wants to break standard encryption, they have the resources to do so. At best

    • by 1s44c (552956)

      But they can't practically break GPG on millions of emails a day, not even if they owned every computer in the world.

      GPG is your friend. More people should use it.

      • by BitZtream (692029)

        PGP is not my friend. Its just RSA without the privilege of having an 'trusted' third party to verify. You already have fully functional encryption built into EVERY EMAIL CLIENT THAT MATTERS to do encryption of this level that doesn't require using a bunch of shitty hacks to get it to work with the client.

        SMIME with self signed/friend-signed certs is still far far better than PGP.

        GPG is just a horrible implementation (from a usability perspective) of PGP for freetards who don't actually know what they are

        • by Anonymous Coward

          Shill much?

          No trusted third party is exactly why I like PGP. I pack my own parachute, set trust levels, assign whom I think is worth trusting and who isn't, and if I'm convinced enough that someone's key belongs to their that I am willing to swear to it in a court of law, I sign the key.

          CAs are trading security for ease of use. A compromised CA can compromise millions of signees. With a web of trust, a compromised key would make little effect, and can be detected (especially if people sign keys they trus

        • by Velex (120469)

          You said:

          Its just RSA without the privilege of having an 'trusted' third party to verify.

          Then you said:

          SMIME with self signed/friend-signed certs is still far far better than PGP.

          How do you figure this? If you're using self-signed certs or even a self-generated CA that you can share among your friends like I had while I was looking into S/MIME for work, you're still back to the web of trust model for all intents and purposes (assuming the NSA has the ability to compel entities like Verisign to sign forged certs) that GnuPG uses. I can trust my friend's cert because he gave it to me on a thumb drive, and he can trust my cert because I gave it to him on a

      • GPG is your friend. More people should use it.

        But then you'd have to get your key signed. And to extend your web of trust outside your hometown, you'd have to fly to a key signing party elsewhere, get your junk touched, and still worry about what information airlines share with the spooks.

    • Bullshit. If the US government wants to break standard encryption, they have the resources to do so. At best, the telecoms crumbling under this demand would only reduce the required resources to spy on us.

      There is no evidence NSA or anyone else posses any such technology to defeat high security cipher suites in SSL.

      In many cases crypto is not the weakest link of the system and the other weaker links in the chain will be explioted first because they are easier to break.

      People are sloppy, commonly used software libraries, operating systems, random number generators may contain subtle flaws. We have seen Internet wide SSL surveys with evidence of key collisions way more than what would be expected given the b

  • Please Also Note (Score:4, Informative)

    by Anonymous Coward on Thursday July 25, 2013 @08:19AM (#44380001)

    Every telecommunication company that operates within the United States is required by law to provide law enforcement access to communication streams on demand. It's called CALEA [wikipedia.org] and all telecommunications companies are required by law to follow it.

    CALEA also requires that encrypted communications be decrypted. This includes services like Skype(specifically). CALEA requires that Microsoft provide law enforcement access to the UNENCRYPTED streams of Skype communications, on demand. This is not new and, in light of the House vote yesterday, is not likely to change.

    • by PPH (736903)

      This only works when the service provider manages the keys on my behalf. If I generated my own key pairs, the NSA would have to come to me to get my decryption key.

      In the case of a criminal investigation where law enforcement is looking to apprehend me, a warrant would be sufficient. Just hold me on a judges order until I couch it up. But for political or economic espionage, that would tip off your competitor. The point here is to monitor them while they carry on business as usual.

    • Every telecommunication company that operates within the United States is required by law to provide law enforcement access to communication streams on demand. It's called CALEA and all telecommunications companies are required by law to follow it.

      CALEA applies to ISPs not content. Content was explicitly EXCLUDED from CALEA using the "information services" language.

      CALEA also requires that encrypted communications be decrypted. This includes

      It does no such thing. It requires ISP to hand over encryption keys it possesses to decrypt but there is no obligation if the ISP does not possess the key. Further CALEA applies to Access not Content. The FBI and others have been pushing to change that but such legislation is currently dead.

      services like Skype(specifically). CALEA requires that Microsoft provide law enforcement access to the UNENCRYPTED streams of Skype communications, on demand.

      Skype != website. A web site operator is providing an "information service" which is exempt fro

    • by Sloppy (14984)

      CALEA also requires that encrypted communications be decrypted.

      True, within limited context. CALEA requires that the communication providers and equipment decrypt. If you can communicate with general-purpose equipment and networks (e.g. PCs and the Internet) where your software handles things, there currently isn't any law in the US which require it be decrypted. That is why the government wants a "CALEA II," [eff.org] to make it illegal for people to write or use secure software, such as ssh or gpg.

      The reason Sky

  • by sl4shd0rk (755837) on Thursday July 25, 2013 @08:19AM (#44380009)

    Seem like the better option now. At least you know what the CA has done with the master key.

    • Re: (Score:3, Insightful)

      by 1s44c (552956)

      The whole SSL CA setup was broken from the start. The trusted people at the top never were even remotely trustworthy.

      Self signed certs are a pain, what we need is something peer2peer based.

      • by BitZtream (692029)

        No matter how you spin it, the person at the top is still more trust worth than nothing at all. REAL people (i.e. not geeks who have nothing better to do with their time) are not dicking around asking their friends to build up a 'web of trust' only to have one of the certs lost ... and then having to start all over again.

        Its also rather stupid to trust random other people to validate your identity.

        As typical when some moron shouts 'p2p!', peer to peer is entirely impractical here.

        Your p2p encryption and si

        • by PPH (736903)

          And for all those people using it ... when I want your data ... I'l just start beating the ever living fuck out of you with a pipe wrench rather than trying to decrypt it. I promise you that you'll turn your keys over fairly quickly.

          But that interferes with the NSA's desire to conduct covert surveillance. When I've been beaten for my keys, I'll know something's up.

          The NSA isn't interested in catching terrorists or criminals. In this case, obtain a warrant (or beat them for their keys) while you hold them on suspicion. Decrypt the stored message traffic and you've got your evidence. When you are conducting ongoing political or economic espionage, you need your target to continue business as usual after breaking their secure communicati

        • by 1s44c (552956)

          Nice rant. What we need is a system that isn't a PITA to use and offers real security. Like you say GPG right now is a PITA. The current certificate model is so badly broken it should be thrown away immediately. Something web-of-trust-ish with a peer2peer distribution system might work if done right. But them so would peer2peer DNS in theory and that still hasn't happened.

          99.999% of the people in the world don't know how electricity works. That's not an argument for not using electricity.

        • by Velex (120469)

          What is your beef with PGP/GnuPG?

          Because its such a pain in the ass to use that no one other than some dorks trying to look like ultra-geeks and raving tinfoil-hat butters.

          I'll guess I'll count several large, nation-wide, health care clients who needed my employer to use GnuPG (not the other way around--I'd offered GnuPG to clients looking for encryption before TLS between email servers was common, but I would never require somebody to use it, nor would I care to support it) next time I revise my list of "ultra-geeks and raving tinfoil-hat butters."

          Most had been using GnuPG internally to protect emails that may contain ePHI and were looki

      • It all comes down to trust. Who do you trust? No one? Self signed certs it is. Keep em safe.

        • by 1s44c (552956)

          I trust my friends, co-workers, and family. Or at least a group of 3 or more of my friends and/or co-workers and/or family.

          Individual people can be corrupted easily. Companies can't be trusted to work for anyone but themselves and are easily forced into misbehavior by governments. Governments can't really be trusted.

    • by BitZtream (692029)

      Uhm, self-signed certs are absolutely no help at all.

      The signing happens on the PUBLIC key, not the private. They can still give their private key to the NSA, who can use it regardless of who signed the public key.

      They have the private key, so your self-signed cert will still validate it as legit. It IS the key they claimed they had ... they just also gave it to some else.

      • The signing happens on the PUBLIC key, not the private. They can still give their private key to the NSA, who can use it regardless of who signed the public key.

        The public key of the certificate is signed by the private key of the CA. In a self-signed scenario, I own the private key of the CA and I own the private key of the certificate. I'd have to give one of those up to make your scenario work.

    • Re:Self signed certs (Score:4, Informative)

      by IamTheRealMike (537420) <mike@plan99.net> on Thursday July 25, 2013 @09:47AM (#44381047) Homepage

      Common misconception - certificate authorities do not have private keys. Your private key never leaves your own computers. That's why the NSA would have to force companies to cough them up (or steal them).

      Also, for normal SSL having the private key lets you passively eavesdrop and decrypt. For souped up SSL with forward secrecy it doesn't, it only lets you MITM the connections, which results in the server and client having a different view of things - that's detectable, whereas a leaked SSL key isn't.

      Forward secret SSL is new, and not that easy to do. At the end of 2011 Google employees did the necessary upgrades to OpenSSL [blogspot.ch], but most other sites haven't deployed it (yet). Enabling forward secret SSL is the best and easiest step forward to beat the NSA/GCHQ right now, because if they HAVE obtained your private key, it forces them to start actively intercepting connections which is expensive and detectable.

  • I imagine this has crossed (or should have) the minds of a few people here, is there any "credible" advice about the theoretical process and the best/least-worst practical actions to take if you're approached by your friendly local domestic intelligence agency and told to pony up your company's private keys (for example) along with the explicit instructions not to inform anyone else, ever? For the record I'd like to declare that I've never been in that or any similar position.
  • by bsandersen (835481) on Thursday July 25, 2013 @08:38AM (#44380185) Homepage
    It seems bad ideas never die; they just get recycled. The US Government fighting encryption in the 1990's offered "key escrow" (where the Government had a backdoor into the encryption "just in case") as a way to allow citizens and business to protect their data and secure their privacy while allowing law enforcement a chance to use these transactions should it become necessary. It was wildly unpopular and eventually the idea was shelved. Now the government just comes and demands your keys.

    Total Information Awareness, championed by Admiral John Poindexter, former United States National Security Advisor to President Ronald Reagan, a one time felon over Iran-Contra (overturned on appeal), wanted to do much of what the NSA is doing today. When the details of TIA became public there was an outrage and the plans for it had to be scrapped. Or were they?

    The point is this: the public (voters) say "no" to these things... and they just sneak around our backs and do it anyway. Saying "no" once is not sufficient. If, as a citizen, voter, and patriot you believe that these ideas are bad you need to say "no" repeatedly, early, and often. Once whole bureaucracies are constructed to serve a bad aim it is difficult, and perhaps impossible, to stop them.

    As U.S. Supreme Court Justice Louis Brandeis once said, "Sunlight is the best disinfectant." With all due respect to Justice Brandeis, if some of these bad ideas do survive, though, it might be more because of public exhaustion than of public acceptance. Or, more simply, perhaps once a secret bureaucracy gets big enough in the darkness there is no way to kill it once it comes into the light. Even sunlight has its limits.

  • Forward Secrecy (Score:5, Informative)

    by Agent ME (1411269) <agentme49&gmail,com> on Thursday July 25, 2013 @08:39AM (#44380195)

    The good news is that if the web servers use forward secrecy in the SSL encryption ( https://community.qualys.com/blogs/securitylabs/2013/06/25/ssl-labs-deploying-forward-secrecy [qualys.com] ), then an attacker who has the private key is not able to decrypt a connection he has passively eavesdropped on. An active man-in-the-middle attack is required in order to listen in on the connection.

  • This is why such services that let users store data in their "cloud" should enable user-specific encryption keys - the user's public key encrypts the data, and ONLY the user's private key can decrypt it. Then if "authorities" want access to the data, they would have to ask each and every user for their key. Sure, as in I'm convinced I would do that!
    • by gstoddart (321705)

      This is why such services that let users store data in their "cloud" should enable user-specific encryption keys

      Or simply not get used.

      This has always been a very real risk with "the cloud", your data is not under your control.

      I can imagine that a lot of companies are looking at their usage of cloud computing and re-evaluating the risks. If the entities involved can be forced by the NSA to hand over your data, those companies aren't trustworthy, because they aren't the ones you need to worry about trusting

  • Is there any external mathematical difference between "we need to spy on terrorists" and "we are going to spy on political opponents"? How could we tell?

    - "Trust us" is used in both situations.
    - "We have processes in place" is claimed in both cases.
    - Alarms don't go off if an agent listens in on a call without a warrant. See first two points?

    I suppose we should rely on historical experience of how governments operate. Oh oh.

  • by Lumpy (12016) on Thursday July 25, 2013 @08:45AM (#44380259) Homepage

    What I wish....
    FED, "Give us your encryption keys"
    CORP: "EAD, DIAF!"

    Reality....
    FED: "Give us your encryption keys"
    CORP: "Why?"
    FED: "To fight terrorisim, you are not harboring terrorists are you?"
    CORP:" Here's the keys, would you also like the keys to the bathrooms and the filing cabinets?"

  • Master key == FAIL (Score:4, Insightful)

    by mbone (558574) on Thursday July 25, 2013 @08:45AM (#44380263)

    If you are relying on a service with a master key for security, you have no security. This is true regardless of whether the government has access to those keys.

    • by Shados (741919)

      You do know that by "master key" they just mean the private secret for certificates right?

    • by gl4ss (559668)

      If you are relying on a service with a master key for security, you have no security. This is true regardless of whether the government has access to those keys.

      well it was known.. this is why you have signing authorities.. they're supposed to be companies you could trust to not give the keys around so you could trust that someone checked that the certificate is legit. unfortunately you'll have to redesign the whole chain of trust thinking now - the upside is that they were getting all the mail they wanted from these companies already, the downside is that now they no longer have to bother those companies with it. however - and here's a big however for the companie

    • by Noway2 (942022)
      This is why I run my own email server and I use my own CA and certificates instead of relying upon a "trusted" 3rd party. The problem I see is, to what extent do you trust your service provider? Do you trust them to not hand everything over to the NSA or any other agency that claims authority? Unfortunately, as companies like Hushmail have show, even their stated privacy policies aren't enough. Interestingly, it seems that the response and possibly the answer lie in going peer to peer, via applications
  • ""Strongly encrypted data are virtually unreadable," NSA director Keith Alexander told (PDF) the Senate earlier this year." Hmmnnn, should I trust what the Emperor of the NSA, who has directly lied under oath numerous times, is saying? I have no doubt that if the companies don't provide those master keys (seems many if not all of the big ones won't do this), this intelligence empire would just obtain them illegally via direct attacks and/or people on the inside of these organizations.
  • ..no takers on THAT bet....too much like a sure thing.. BT (our biggest ISP and our biggest telecoms company) regularly spreads its legs for the government, so I would bet BT handed the keys over at the first hint.. So now anyone in gorvernment who doesn't like your face can make your bank accounts say whatever they want. We're all doomed.
  • It would explain a lot.

    • by Error27 (100234)

      Also they are presumably using the keys to store passwords for later.

      So probably Snowden has hundreds of SSL private keys and millions of passwords and account details.

  • Can the FBI or a spooktacular TLA simply request a US based CA hand over private keys used to generate an intermediate signing key?

      If not why? Is the CA's "private key" not a "tangable thing" and I could imagine it would be quite helpful to a great number of "authorized investigations".

    Planet scale trust anchors are an oxymoron anyway I suppose.

  • by Captain_Chaos (103843) on Thursday July 25, 2013 @11:22AM (#44382385)

    All the commentary I'm reading about this just talks about using it to decrypt captured traffic. One aspect I've not seen anyone address yet is this: wouldn't this allow them to spoof the services in question, and just capture any data they want directly? If you have someone's server certificate (which the server will give you freely), and the corresponding private key, you can set up a server which looks exactly like the real, say, gmail.com, legit certificate signed by a trusted CA and all, and capture unencrypted data to your heart's content.

    Maybe that's what the government wants those private keys for? It would completely sidestep the issue of forward secrecy. To me that's even more scary than the possibility that they may be capturing encrypted traffic and using these keys to decrypt it...

For every bloke who makes his mark, there's half a dozen waiting to rub it out. -- Andy Capp

Working...