Follow Slashdot blog updates by subscribing to our blog RSS feed

 



Forgot your password?
typodupeerror
×
Communications Crime Government Privacy The Internet Your Rights Online

FBI Complains About Wiretapping Difficulties Due To Web Services 228

c0lo writes with news that the Federal Bureau of Investigation is lamenting the difficulty in executing wiretaps because of "web-based e-mail, social-networking and peer-to-peer services." "President Barack Obama's administration is debating ways to deal with Web-based services not covered by traditional wiretap laws, including incentives for companies to build in surveillance capabilities, said Valerie Caproni, general counsel at the FBI. Many Internet services are not covered by the Communications Assistance for Law Enforcement Act (CALEA), which requires traditional telecom carriers to allow law enforcement agencies real-time access to communications after a court has issued a wiretap order, she told members of a subcommittee of the US House of Representatives Judiciary Committee. But Caproni told lawmakers she was not asking for expanded CALEA powers. And she stopped short of calling for rules requiring Web-based communication providers to build in so-called back doors allowing law enforcement access to their software, although she said she's optimistic the US government can find incentives for companies to 'have intercept solutions engineered into their systems.'"
This discussion has been archived. No new comments can be posted.

FBI Complains About Wiretapping Difficulties Due To Web Services

Comments Filter:
  • by Anonymous Coward

    The FBI needs to have easy access to everything - to keep up safe. All sites need to provide the FBI with all user data.

    • Re: (Score:2, Funny)

      by Pennidren ( 1211474 )

      The FBI needs to have easy access to everything - to keep up safe. All sites need to provide the FBI with all user data.

      Why stop there? Open up your homes, people! Place your possessions on your front lawn, just in case the FBI needs to come by and make sure you aren't a 'bad guy'.

      • by Joe The Dragon ( 967727 ) on Saturday February 19, 2011 @09:25PM (#35257244)

        in the UK the cameras can see in to alot of homes and apartments.

        • And all the cameras see is a raging alot [blogspot.com] staring back at them.
        • No, they can't. It's illegal for cameras to be able to see into people's windows. To that end, they have mechanical interlocks that prevent them being pointed in certain directions, and pre-programmed "blanking areas" that blank out the video feed if they're aimed at certain areas.

          Using CCTV to look through people's windows is generally a sacked-first-time-it-happens thing.

    • Re: (Score:3, Insightful)

      by jdpars ( 1480913 )
      It definitely sucks that they want access to communication they can't get to right now. It's difficult, and it should be, to want to let them in. I think there are good arguments for giving them the power, and good arguments against. In favor of it, it would allow them to catch more criminals more easily. I think that's an easy positive most people would agree with. The drawback, however, is that the system could be abused (Anyone have research on wiretapping abuse? I think that'd be fairly relevant). We pu
      • This is where the government's and courts' assertion that every law that currently applies in the US is null and void by adding the words '...with a computer' bites them in the ass. Irony that the reason the government took this position because they wanted to get around search and seizure, privacy and fair use laws.

      • by Darkness404 ( 1287218 ) on Saturday February 19, 2011 @11:31PM (#35257672)

        I think there are good arguments for giving them the power,

        Such as? Despite what the media may try to represent, in real life there are few cases of "evil" people walking free because of legal protections when compared to the many people who have their constitutional rights abused because of this power. The right to expression is also followed by a right to secrecy just as the right to vote is followed by a right to secret ballot. Imagine how less free elections would be if everyone would know who and what you voted for (as ordinary citizens in elections, not as members of congress voting on bills). Just as the right to vote comes the right to be anonymous about what you vote for, so should the right to have secure and secret communication. Of course, just like you can tell everyone who you voted for, so can others hear, listen or read what you communicate, but the right to be anonymous (if one chooses) is needed to ensure a free society.

        • Leaving out the second part of that sentence alters the meaning. The are reasons for, like catching criminals, and reasons against, like creating an overbearing police state with no regard for citizen privacy. You can't do a cost benefit analysis if you won't look at the costs and benefits.
      • "I think that's an easy positive most people would agree with." No, I don't agree. "The Law" doesn't use the tools it has at it's disposal already, effectively. What makes anyone think that giving them more tools, more power, and greater jurisdiction will make them any more effective? Google for stories of repeat offenders. The cops KNOW, in many cases, just who the bad actors are in their jurisdictions. They KNOW who the repeat offenders are. But, the law is so screwed up, they can't keep the real p
  • by BitterOak ( 537666 ) on Saturday February 19, 2011 @08:55PM (#35257120)
    Would peer to peer services which offer end to end encryption like Skype be required to re-engineer their software to allow government wiretaps? This could be the end of personal use encryption as we know it.
    • Re: (Score:2, Funny)

      by Anonymous Coward

      Would peer to peer services which offer end to end encryption like Skype be required to re-engineer their software to allow government wiretaps? This could be the end of personal use encryption as we know it.

      Only criminals use encryption. If you're not doing anything wrong, what is there to hide?

      • by Isaac Remuant ( 1891806 ) on Saturday February 19, 2011 @09:07PM (#35257162)

        Would peer to peer services which offer end to end encryption like Skype be required to re-engineer their software to allow government wiretaps? This could be the end of personal use encryption as we know it.

        Only criminals use encryption. If you're not doing anything wrong, what is there to hide?

        Nothing, of course. Unless you're part of the goverment. In that case, you're hiding information to protect your citizens.

        • Privacy on any level is about concealment, whether necessary or un-necessary, for good or bad. Youi can't have something and nothing to hide at once, shit, given human nature - and the nature of privacy, nothing to hide is impossible to begin with, but the idea of having something to hide and nothing to hide simultaneously, making P ^ ~P = true when logically impossible, makes my brain explode.
          • But that's not really the case. Privacy is about not having your personal information collected all the time.. about somebody not snooping on you. There's a difference between a public Facebook post and somebody downloading ALL the Facebook posts from you and your friends from all time. Until recently collecting that much data on somebody was time intensive and quite obvious... and was considered illegal in many places. Even for law enforcement as a type of harassment because it was used for social "blac

          • Privacy on any level is about concealment, whether necessary or un-necessary, for good or bad

            Exactly, Unless you conceal a large portion of your activities, then the presence of concealment is like putting a large arrow on your really private activity, saying: "INVESTIGATE THIS".

      • by KlomDark ( 6370 ) on Sunday February 20, 2011 @07:02AM (#35259064) Homepage Journal

        >If you're not doing anything wrong, what is there to hide?

        Wrong answer: If I'm not doing anything wrong, then are you doing looking?

        Everybody's got something to hide, but most do not have anything illegal to hide. Every person should have the right to at least some data that's completely private to all others. Seems like it is a basic human right. At least until they develop direct brain-reading, which probably isn't too far from now.

    • by jbolden ( 176878 )

      Its fairly easy to design something to do what skype does. You will quickly have alternatives that are encrypted....

      As for personal use encryption they tried that in the 1980s and we fought it and won. http://en.wikipedia.org/wiki/Clipper_chip [wikipedia.org]

    • by Anonymous Coward on Saturday February 19, 2011 @09:50PM (#35257354)

      Skype has been on the Infandous Imperial Elite's "Must-Crack" list for a couple of years now. German Intelligence tried first and soon gave up. Then the DoD's DARPA publicly offered a US$50K reward to the black-hatter - *any* black-hatter - who could ably provide *any* Man-In-The-Middle (MitM) solution at all, sans physical access to the box in question.

      See http://theregister.co.uk for chronology and related details; just search the site for "Skype" and there you are. Seems Dynamic Key Encryption, when executed on-the-fly in realtime, is one tough nut to crack hands-off. As for Skype Corporation ever being Judicially Forced to backdoor the product:

      1) If it were so ordered, well there goes Skype Inc's entire business model. I reckon the matter'd be tied up in court for a while afore any breach i' th' hull ever be allowed, Cap'n. ;)

      2) Trust our own homegrown Practical Privacy Providers to come out with a block-um-out add-on widgit right quick anyway, if ever 1) above be implemented. (It's only 65536 ports and there is little likelihood of hardship-in-identification, methinks.)

      On reflection, this rises to mind: A really healthy resistance effort, once sparked and fueled by such intrusion attempts as this hypothetical instance, just might simultaneously stop the tap-stream, spoof the outbound IP addy *and* spue forth a fine smelly-brown stream of plaintext keywords of the "Spook-bait" persuasion. (Virginia Langley knows the vocabulary very well, of course.) Indeed: As the Imperial Criminal USAn Police Globalization State attempts each additional intrusive advance in its greedily tyrannical drive to Control Just Everything, more and more able and goodhearted Sovereign Forced-Underclass Citizens the world around shall surely take up the Rallying Cry from Heaven: "DON'T TOUCH MY JUNK!!!!"

      Sorted! I'll get me coat now. And that is all! 0{:-)o

      • by Anthony Mouse ( 1927662 ) on Saturday February 19, 2011 @10:23PM (#35257444)

        tap-stream

        You seem to be assuming the way they would implement this is to have your client send a second copy of the stream to the FBI. Certainly that is the easy way to do it, but also the trivially detectable way -- the app is using twice as much bandwidth as it should and half the packets are going to some server in Virginia.

        The smart way is to combine ISP-level wiretapping in with a back door that CCs the encryption key to the Feds so that they can decipher what they capture from AT&T. Skype already has to open a third party connection to look up the IP address of the peer you want to call, and it's pretty easy for a couple dozen bytes to get lost in the noise.

        If you really want to be sure you better have the source and a binary compiled by someone you trust (like yourself).

        • by icebike ( 68054 )

          tap-stream

          You seem to be assuming the way they would implement this is to have your client send a second copy of the stream to the FBI. Certainly that is the easy way to do it, but also the trivially detectable way -- the app is using twice as much bandwidth as it should and half the packets are going to some server in Virginia.

          Agreed.

          There is already evidence that taps at ISPs and carriers have been used in the past, so as you suggest, placing backdoors in the client itself would be the hard way. Even if they did, what percentage of users would even notice twice the outbound packets were being sent? Especially if it were turned on only for parties under investigation.

          The people who would be doing this probably have enough computer power to capture a stream and decrypt it at their leisure.

          I speculate it might be easier to know

      • 1) If it were so ordered, well there goes Skype Inc's entire business model. I reckon the matter'd be tied up in court for a while afore any breach i' th' hull ever be allowed, Cap'n. ;)

        I doubt it, most Skype users probably don't give a damn about the security of it. They'd go right back to POTS if it could compete on price, quality and convenience.

        I assume Skype to be insecure because the calls are routed through a server I don't control, and it uses a closed encryption scheme that could already be backdoored for all that I know. US law enforcement could easily ask for access and just put a gag order on Skype. But I don't need secured communications for idle chat with relatives anyways. I

    • by Anthony Mouse ( 1927662 ) on Saturday February 19, 2011 @10:06PM (#35257392)

      Would peer to peer services which offer end to end encryption like Skype be required to re-engineer their software to allow government wiretaps? This could be the end of personal use encryption as we know it.

      They can't really stop personal use encryption at this point. Skype isn't fully open source, but that doesn't mean there can't or doesn't exist open source P2P encrypted communications software. And even if the official maintainers of that software were required to add a back door, the idea that no one would distribute a version with the back door removed is laughable. It's like trying to suppress DeCSS. Moreover, OpenSSL and OpenSSH are BSD licensed -- it's not like adding strong encryption to a communications app is rocket science. (Although for crying out loud, can somebody please fix the OpenSSL documentation?)

      I would also expect Skype to strongly resist efforts to make them add a back door, if only because of the damage it would do to their reputation. Everybody knows that back doors are truck-sized security vulnerabilities that tempt black hats like chocolate cake tempts Michael Moore. People use Skype for confidential communications because it appears to be secure. Make it notoriously insecure and an alternative will appear which people will use instead.

      Of course, that isn't to say that this proposal is puppies and unicorns and nobody needs to oppose it. People who demand good security -- including criminals -- will use software that has good security and no back doors. But there is still a need to protect innocent fools from organized criminals. Making the software that the average fool uses substantially less secure has the potential to make organized criminals much more effective -- remember, most people aren't terrorists, so intentionally creating a vulnerability that impacts both stupid innocents and stupid criminals will disproportionally impact the innocents because there are more of them.

      • security vulnerabilities that tempt black hats like chocolate cake tempts Michael Moore.

        This is clearly a nominee for the metaphor of the award.

      • People use Skype for confidential communications because it appears to be secure.

        LOL, idiots...

    • by icebike ( 68054 )

      Would peer to peer services which offer end to end encryption like Skype be required to re-engineer their software to allow government wiretaps? This could be the end of personal use encryption as we know it.

      Any time someone offers you an encrypted service where you don't have the option to set your own encryption key
      you need to view it as encryption as a minor inconvenience to eavesdroppers, and nothing more.

      Nothing on any service like skype can assumed to be truly private. Best you can do is encrypt your email with
      some strong encryption and hope your correspondent does as well. A wiser choice might be to never commit
      to a computer record that which you may need to keep secret.

      You don't need to be involved i

      • by whoever57 ( 658626 ) on Sunday February 20, 2011 @01:09AM (#35257974) Journal

        You don't need to be involved in any nefarious stuff to use encryption. I've ordered several things via emai with credit cards, and I always send it encrypted.

        Encryptions is ubiquitous today, you just have to:

        1. Log onto your bank's website.

        2. Use Gmail with default settings.

        3. Order anything online.

        4. Use a VPN (many, many company laptops are configured with VPNs)

        5. Use SMTP-TLS or POP-TLS.

        etc.

    • Would peer to peer services which offer end to end encryption like Skype be required to re-engineer their software to allow government wiretaps?

      Ahahahahaha! You kill me, you really do.
      https://secure.wikimedia.org/wikipedia/en/wiki/Skype#Security_and_privacy [wikimedia.org]

    • The fundamental problem with encryption is key negotiation. You don't get any security at all if the attacker can listen in when the session is being set up.

  • Oh cry me a river!

  • by Man On Pink Corner ( 1089867 ) on Saturday February 19, 2011 @09:03PM (#35257138)
    If police work is easy, it means you're living in a police state.

    They're here to serve us, not the other way around. History shows that when you give the FBI increased investigative powers, those powers are used not to prevent the next 9/11 or OKC bombing, but to spy on dangerous subversives as Martin Luther King and John Lennon. [nytimes.com]

    With power should come responsibility, or at least accountability. The FBI has shown neither.

    • As always ... (Score:5, Insightful)

      by khasim ( 1285 ) <brandioch.conner@gmail.com> on Saturday February 19, 2011 @10:19PM (#35257436)

      Fascism begins when the efficiency of the Government becomes more important than the Rights of the People.

      And it is always sold the same way.

      They want to "protect" you from the "enemy".
      So you need to do your part and give up some rights (just for a little while) to make it easier to find the "enemy" hiding among you.

      If you aren't supporting their team ... that means you're
      a. supporting the "enemy's" team
      b. delusional / stupid
      c. secretly hate us and really are hoping the "enemy" wins

  • by Opportunist ( 166417 ) on Saturday February 19, 2011 @09:08PM (#35257168)

    allow me to say this:

    "PLEASE! WE'VE BEEN WAITING FOR IT!"

    Ok, on a more serious note, how long do you think 'til such a backdoor will be sniffed out and abused by people with even less concern for constitutional rights and fewer qualms to abuse such a privilege?

    Think about it for a split second. What qualities would such a backdoor have to have? First, it would have to work with all such providers, every single network, and you may rest assured that it will have to follow some standard and possibly even be accessible with a single set of login credentials. And second, the provider would of course not be allowed to monitor or even log such an access to keep them from possibly noticing such an access (of course, only to make sure that no "inside man" could warn the bad guys).

    Can anyone, or everyone, here see the possible value for MUCH worse guys?

    • by iter8 ( 742854 )
      Single point of failure. If the FBI can get in the backdoor, so can lots of others.
  • Comment removed (Score:5, Insightful)

    by account_deleted ( 4530225 ) on Saturday February 19, 2011 @09:13PM (#35257196)
    Comment removed based on user account deletion
    • I wish I could mod that down simply because we can't have evil politicians stealing your ideas.

      Good thing they rarely read slashdot ;)

    • Thank you for providing another reason we need a flat tax with no way to game the system in whatever way a given politician wants.

  • by cheekyjohnson ( 1873388 ) on Saturday February 19, 2011 @09:19PM (#35257222)

    The poor little FBI is having trouble spying on people (court order or not). Let's all show our love for them and help them out!

  • by Superdarion ( 1286310 ) on Saturday February 19, 2011 @09:21PM (#35257228)

    although she said she's optimistic the US government can find incentives for companies to 'have intercept solutions engineered into their systems.

    I wonder if the FBI considers "not facing bankrupting fines and legal harrassment" an incentive...

    • "That's a nice little website you have there. It'd be a shame if something happened to it. Y'know, like it suddenly being taken down because it has copyrighted material on it."

      But, fortunately, the FBI never accidentally takes down websites. And, if they did, I'm sure they'd be really sorry. But these things happen, you understand...

  • A few reasons (Score:5, Interesting)

    by sjames ( 1099 ) on Saturday February 19, 2011 @09:25PM (#35257248) Homepage Journal

    I can think of about 84,000 good reasons we don't want to make pushbutton law enforcement any easier than it already is.

    Watching people is supposed to be resource intensive, that's what makes sure they only do it when it's absolutely necessary.

    Here's an idea, I will build in a police API to tap the web messages BUT it will automatically CC all requests to the EFF, ACLU, and Wikileaks. By using the API they agree to the CC up front.

    I'm guessing it will be the world's least used police back door.

    • You jest, but you just described a relatively effective system. I would exclude Wikileaks though, as they've demonstrated amply that they disseminate information and damn the consequences, whereas the ACLU or EFF (or similar localised entity) would be well placed to determine whether it's something to cry foul about or leave alone due a legitimate need for secrecy (for example, an actual terrorist). It would serve the needs of making it relatively painless to tap if there's a need, but still have that trans

  • Not in the US (Score:4, Insightful)

    by Jane_Dozey ( 759010 ) on Saturday February 19, 2011 @09:26PM (#35257252)

    Many Internet services are not covered by the Communications Assistance for Law Enforcement Act (CALEA)

    They do realise that even more Internet services are not even in the US....right? Or does their jurisdiction actually extend to other countries now?

    • The internet is run (owned) by the US government. They really do think they have the right to spy on everyone, everywhere.
      • by toriver ( 11308 )

        No, the Internet is a loose-ish mesh of cooperating individual network operators. Some are in the US, most are not.

        The most commonly used and generally agreed-upon root DNS is "owned" by a US entity, that is correct. But the DNS can be replaced if needed be...

    • by Draek ( 916851 )

      Or does their jurisdiction actually extend to other countries now?

      As far as they believe, yes. Their current wars in Iraq and Afghanistan are only the latest examples of their quest in fulfilling their roles as self-appointed World Police.

      I think if you look around, instances where the US respected the sovereignty of a foreign power are much scarcer than the opposite, and all with an ulterior motive.

  • http://en.wikipedia.org/wiki/NSA_warrantless_surveillance_controversy

    The NSA has been tasked with the domestic spying on America's own citizens by executive order. While I don't understand how said agency can decipher all the communications that criss-cross American territory on top of all the data that goes through satellites, cable, fiber to foreign destinations on top of all that, is beyond me.

    http://insidecharmcity.com/2007/06/25/nsa-power-supply-problems-continue/

    Perhaps, this explains all the recent p

  • by Indy1 ( 99447 ) on Saturday February 19, 2011 @09:27PM (#35257258)

    When the fascists at the NSA and FBI started their massive domestic spying program (Echelon, Carnivore, etc), I decided to make their lives harder and run my own mail server. While they can still snoop on the big boys (yahoo, aol, msn, etc), at least email from my end is safe, and if I send emails to non US based mail servers over SSL, theres at least some chance the fascists cant read the traffic.

    • Or you could just use end to end encryption. PGP or S/MIME are pretty easy to set up...
    • by forand ( 530402 )
      You are aware that your emails are sent in plain text unless you only send email to people whose servers support an encrypted connection? Most do not.
      • You are aware that your emails are sent in plain text unless you only send email to people whose servers support an encrypted connection? Most do not.

        STARTTLS has been around for awhile now. Are you sure that "most" servers don't support it?

        A lot of larger financial institutions are even beginning to require other companies they do business with to enforce TLS encryption when communicating with them (so, for example, if you do business with JP Morgan/Chase, they want you to configure your outgoing SMTP server to refuse to deliver mail to JPMC's servers if a TLS connection fails, bouncing the message to the sender instead of falling back to plain text).

  • by Phoenix666 ( 184391 ) on Saturday February 19, 2011 @09:35PM (#35257292)

    And here we are seeing a wave of democracy sweeping the Arab world, facilitated in part by these very technologies. At the same time, the U.S. government is positioning itself to prevent those very tools being used against it.

    There are still those here who will say that it's hyperbole, but the same tipping point is approaching here. Our real rulers (hint: neither political party, but those behind both) are getting nervous and moving to keep their grip on our society. They have perpetrated the most massive theft in the history of mankind, absconding with trillions of dollars of our money, selling our children into a lifetime of debt servitude while theirs party on; they know it, and we know it, and they're starting to realize that we know it too.

    • by srmalloy ( 263556 ) on Saturday February 19, 2011 @09:57PM (#35257368) Homepage

      There are still those here who will say that it's hyperbole, but the same tipping point is approaching here. Our real rulers (hint: neither political party, but those behind both) are getting nervous and moving to keep their grip on our society. They have perpetrated the most massive theft in the history of mankind, absconding with trillions of dollars of our money, selling our children into a lifetime of debt servitude while theirs party on; they know it, and we know it, and they're starting to realize that we know it too.

      "The tree of liberty must be refreshed from time to time, with the blood of patriots and tyrants. It is its natural manure." -- Thomas Jefferson

      The emphasis is mine. It is interesting that this quote is most often seen cut off after 'patriots'. Who might have a vested interest in seeing that the public stops thinking of rulers being made to pay for growing oppressive?

      • During the dark ages the countries of europe became unpleasant backwater countries, no rights and constant persecution (of some). During that time the arab nations were open/enlightened countries. It looks like we're heading back towards that. I'm not sure how long this wave of freedom will last in the middle east, it's happening because the money the dictators use to stay in power has dried up. Unfortunately that money is gone for the replacement gov as well, and it's hard to stay in power when you're
    • The big question is what will it take till we pull an egypt on these guys. Just how far must the fascists push us till we break out the torches and pitchforks? It would be extremely ironic if the middle east became the last bastion of freedom in the world while we slip into a fascist/military dictatorship.
  • Freedom Box. (Score:4, Informative)

    by Anonymous Coward on Saturday February 19, 2011 @09:35PM (#35257294)

    http://wiki.debian.org/FreedomBox

    Inspired by Eben Moglen's vision of a small, cheap and simple computer that serves freedom in the home. We are building a Debian based platform for distributed applications.

    Freedom Box is about:

            * privacy
            * control
            * ease of use
            * dehierarchicalization

    Vision Statement

    We live in a world where our use of the network is mediated by organizations that often do not have our best interests at heart. By building software that does not rely on a central service, we can regain control and privacy. By keeping our data in our homes, we gain useful legal protections over it. By giving back power to the users over their networks and machines, we are returning the Internet to its intended peer-to-peer architecture.

    In order to bring about the new network order, it is paramount that it is easy to convert to it. The hardware it runs on must be cheap. The software it runs on must be easy to install and administrate by anybody. It must be easy to transition from existing services.

  • by VortexCortex ( 1117377 ) <{moc.edargorter- ... } {xetroCxetroV}> on Saturday February 19, 2011 @10:10PM (#35257404)

    Here's how it works:

    1. Identify the individual you want to spy on.
    2. Identify the web services you want to spy via.
    3. Obtain the SSL certificates of the web services.
    3. Gag & Order the certificate authorities named in the SSL certs to create the FBI/NSA a new fake trusted cert.
    4. Use the unwarranted wire-tap systems already in place to "Man in the Middle" any connections the individual makes to the web services you wish t spy on.
    5. Return the fake cert to the individual, and re-encrypt the data to the web service using the real cert.
    6. Spy on the individual as much as you like.
    7. ...
    8. Oppress!

    Note: If the CA is not a US company, then simply use Verisign or other US company to creat the fake certs -- No one checks to see if the cert is actually the one that the domain normally uses...

    CAs can make certificates without the domain owner's permissions -- As long as the certificate authorities don't need the domain owner's permission to generate certificates the SECURITY THEATER of SSL will remain intact.

    Also Note: FF > Preferences > Advanced > Security Tab > View Certificates > CNNIC ROOT
    This is the root certificate that China will use in these types of MITM attacks.

    P.S. Remember when a large portion of the Internet was "accidentally" routed through China? [slashdot.org]

    • by bendodge ( 998616 ) <bendodge@bsgprog ... s.com minus city> on Saturday February 19, 2011 @10:47PM (#35257516) Homepage Journal

      No one checks to see if the cert is actually the one that the domain normally uses...

      I do! Via Perspectives [cmu.edu]. I've very, very rarely had it alert me to anything, but it could be extremely useful the one time it does.

    • by SanityInAnarchy ( 655584 ) <ninja@slaphack.com> on Sunday February 20, 2011 @01:09AM (#35257972) Journal

      I agree the vulnerabilities you mentioned are correct, but I really don't think "security theater" is appropriate here.

      First, SSL as a technology works just fine. It's entirely possible to create a restricted set of CAs and certificates and have a system at least as secure as, say, SSH. I know I do something similar with OpenVPN connections, which use OpenSSL certificates. Not every use of SSL is the mess that the typical HTTPS in your browser is.

      Second, it reduces the number of individuals who can successfully MITM you massively. For a live demonstration of this, walk into any coffee shop and fire up FireSheep, and look at how many people are vulnerable. Flip on SSL and, far from security theater, they are at least safe from you.

      By contrast, what Schneier was talking about was specifically the act of guarding against the sort of threat you'd see as a movie plot, which is a real threat, but is so unlikely and specific that defending against it simply isn't worth it -- often, it's not just a matter of money and resources, it actually buys you no additional security, whereas SSL does provide some security.

      Let me put it this way: Forcing you to remove your shoes and surrender any significant amounts of liquid is security theater, because it's defending against specific threats which we've already seen -- I suppose the next bomb will be in someone's hat instead, or made of solid pastes instead of liquid. By contrast, a bulletproof vest is not security theater just because it doesn't defend against a headshot -- even ignoring that helmets exist for that purpose, if it really seems likely you'll get in a firefight of some sort, it's still going to be a lot harder for someone to take you out of the fight, and certainly harder for them to do anything fatal.

      I do share your concern for SSL, though. If I may abuse the above analogy, it's become apparent that we need helmets, and maybe better armor.

  • yea no... (Score:4, Interesting)

    by Charliemopps ( 1157495 ) on Saturday February 19, 2011 @10:35PM (#35257470)
    My companies solution to this was to ship the entire email nightmare over to Google, let them deal with it. In fact, if law enforcement were to REQUIRE we do something anyway I'd think we'd just drop email all together. It's not profitable, we can't charge for it, it's nothing but a headache. So basically law enforcement would just be force ALL email off shore.
    • where the NSA by law does not need a warrant to inspect anything they want because it's "outside the USA" and the constitution stops at the boarder. Seriously, haven't you been reading anything?

  • My heart bleeds for the poor, defenseless FBI. Truly.

  • by Anonymous Coward

    I just checked the US Constitution and all the amendments. It is a quick read.

    There is nothing in it about the FBI having the right to wiretap peoples communications without a warrant. A few years ago, there were less than 3,000 judge approved wiretaps inside the entire USA. http://www.justice.gov/nsd/foia/reading_room/foia_readingroom.htm [justice.gov]

    There are 310,000,000 people in the USA. http://www.census.gov/population/www/popclockus.html [census.gov] They are suggesting all that this infrastructure be built to monitor 3,000

  • by unity100 ( 970058 ) on Sunday February 20, 2011 @04:36AM (#35258586) Homepage Journal
    A servant of public, appointed by representatives of people, selected by people, complains to those representatives of people that the servants working with him/her are not having an easy time SPYING on the public that had had put them in service .....

    and this is not only legal, but apparently, also 'ethical' and 'normal'.

    corporate democracy, youre one of a kind ...
  • Erm, "That criminal may be a ... an arms trafficker," ?!

    Guess who's the largest arms trafficker in the world? Yeah, the US [wikipedia.org]! All facilitated by the Feds.

    As for the rest of the rogue's gallery, if you want to argue that preventing those crimes is an absolute value [wikipedia.org], then you should also be arguing that there be one government "minder" for every citizen.

    What, you're merely promoting wiretapping, and not direct government surveillance (minders)? So you're in favor of child molestation?

  • While they are at it, why don't they force all keyboard manufacturers to include a firmware backdoor that records everything typed ? After all, if you are posting subversive messages, you have to type them first, and the manufacturers are at fault for allowing their products to be used to facilitate terrorism, right ?
  • It seems to me that a forced crippling of somebody's ability to communicate confidentially would be the essence of a prior restraint. The government can get prior restraint, but only in extremely unusual situations.

The best things in life go on sale sooner or later.

Working...