Forgot your password?
typodupeerror
Encryption

Anonymous Source Claims Feds Demand Private SSL Keys From Web Services 276

Posted by Unknown Lamer
from the world-wide-fool-proof-cage dept.
Lauren Weinstein writes "With further confirmation of the longstanding rumor that the U.S. government (and, we can safely assume, other governments around the world) have been pressuring major Internet firms to provide their 'master' SSL keys for government surveillance purposes, we are rapidly approaching a critical technological crossroad. It is now abundantly clear — as many of us have suspected all along — that governments and surveillance agencies of all stripes — Western, Eastern, democratic, and authoritarian, will pour essentially unlimited funds into efforts to monitor Internet communications." If this is true it means that SSL/TLS to any Internet service could be useless — the authorities could simply man-in-the-middle anyone. Without knowing who has given keys over, or if anyone has given keys over... The NSA does claim encryption poses a problem for them, but honesty isn't their best attribute. The source claims that major providers at least have resisted (assuming it is happening), but that smaller companies may have folded to the pressure.
This discussion has been archived. No new comments can be posted.

Anonymous Source Claims Feds Demand Private SSL Keys From Web Services

Comments Filter:
  • by Lieutenant_Dan (583843) on Wednesday July 24, 2013 @02:42PM (#44372661) Homepage Journal

    Well, at least it's not "man-in-the-middle" because that would be bad.

    • by TWiTfan (2887093) on Wednesday July 24, 2013 @02:57PM (#44372803)

      It's not a "man in the middle" attack. It's the "government on top" attack.

    • by lgw (121541) on Wednesday July 24, 2013 @03:01PM (#44372859) Journal

      The larger issue IMO is

      governments and surveillance agencies of all stripes â" Western, Eastern, democratic, and authoritarian, will pour essentially unlimited funds into efforts to monitor Internet communications.

      We haven't had a constitutional amendment in the US for some time now. We need one here. Forget specific technologies and the bizarre precedents that have twisted the 4th to allow this - we need a major reset.

      Something like "The government shall not collect or store any information, even publically available information, about the activities of a citizen except upon issuance of a warrant; said warrant shall only issue upon evidence that a specific individual has committed a specific crime."

      I casn accept a lower bar for "collecting and storing information" than for "searching" but there must be some bar to clear.

      • Probably has to be agency specific, as others have noted, some agencies legitimately do need your information to properly provide services.

        Not a bad first start though.

        Maybe something like 'information collected may not be used for prosecution except when collected under issuance of a warrant.'

        Constitution writing is hard :)
        • Huge loophole: What is meant by 'prosecution?' That might stop the government from openly jailing someone for upsetting a senator, but it doesn't stop classic abuses like poking at the victim's life to find another crime they can be prosecuted for (Everyone has broken a law somewhere), or subjecting them to intensive audits and investigations that could leave their reputation ruined. It's quite possible to persecute without prosecuting.

      • by jythie (914043)
        Even if we had a constitutional amendment along those lines, they would simply pull the 'except when related to national security' like they have for so many other things that you would think would be protected.
      • by evilRhino (638506)
        There isn't anything wrong with the 4th Amendment. The problem is that Congress has authorized and re-authorized the PATRIOT act that allows this type of surveillance. If we have an amendment, it should be for Congress to start representing Americans [wolf-pac.com] instead of donors, who pick up these fat contracts to spy on us.
    • Re: (Score:3, Funny)

      by ProzacPatient (915544)
      Shouldn't it be called "the-man-in-the-middle" since it's being done by The Man, man?
  • Self signed? (Score:5, Interesting)

    by Ubi_NL (313657) <joris&ideeel,nl> on Wednesday July 24, 2013 @02:45PM (#44372683) Journal

    Does this mean a self-signed certificate is more secure than a commercial one?

    • That's actually been my opinion a while. When Firefox tells me "This connection may not be trusted" I'm less inclined to worry, because the CA is just one extra link in the chain to be broken.

      • by ron_ivi (607351) <[moc.secivedxelpmocpaehc] [ta] [ontods]> on Wednesday July 24, 2013 @03:05PM (#44372903)
        The US DoD shares your opinion. https://www.my.af.mil/afp/netstorage/login_page_files/afportal_faqs.html [af.mil] Looks like a self-signed cert not issued by any commercial vendor in the default browser lists.
      • http://convergence.io/ [convergence.io] is the real solution
      • by EvanED (569694)

        because the CA is just one extra link in the chain to be broken.

        No, no it isn't. Not really.

        According to this post [slashdot.org], this post [slashdot.org], and my own intuition [slashdot.org], CAs never see your private keys. A CA cannot reveal more information than is known publicly anyway, even if they are thoroughly malicious. The most you could argue about the standard set up is that CAs give a false sense of security.

        I can only think of one attack that could occur with CA-signed certificates but not with self-signed certs. If you remove all defa

        • by omnichad (1198475)

          If you have the CA's own key, you can generate a fake certificate that looks real in every way to the browser. You would be encrypting with a different private key when communicating with the visitor's browser. The user just wouldn't know since they're decrypting with their own key.

    • Kind of ironic then that every modern browser treat self sign like a pestilence. Frankly i've always tought that forcing warning on self signed were more about creating a legitimate certificate racket. I mean when buying a wild card certificate cost you more then 5000$....
      • by h4rr4r (612664)

        A wild card cert is a lot cheaper than that.
        $600 is closer to what they actually cost.

      • Re:Self signed? (Score:5, Informative)

        by Unordained (262962) <unordained_slash ... @pseudotheos.com> on Wednesday July 24, 2013 @03:18PM (#44373025) Homepage

        Self-signed is only fine if the client and server are in a trusted environment, exactly the environment where pre-shared keys are a possibility, so you should have loaded that cert into your client before attempting the connection.

        Barring that, and in the 99% of cases where clients are talking to servers out on the wide-open internet, CA's and the warning against self-signed certs serve a very good purpose -- preventing man in the middle attacks during handshake.

        If anyone (your ISP and the NSA included) hijacks your initial connection, proxies it, and substitutes their own cert, you need a way to know whether that cert is really from the destination site, or a phony. That's exactly the problem CAs solve. (Other solutions include "web of trust", pre-sharing all important keys, concensus methods, etc.)

        At worst, this news means that it's possible NSA (but probably nobody else) has been able to decrypt legitimately encrypted traffic (no MitM attack with substituted keys, just a tap using the real ones) for some services, or if they have CA keys, might have been able to issue their own legit-looking certs, which with some additional work, could have enabled them to perform MitM attacks on arbitrary sites and all of their users.

        But this does not mean that self-signed certs are just as good as CA-backed ones in a general sense; if you rely on those, without pre-sharing keys with all clients, then all clients are vulnerable to MitM attacks from anyone with access to modify the communication channel, not just the NSA. And considering the known issues with insecure DNS, that's a much wider field of potential attacks.

    • Re: (Score:2, Insightful)

      by GameboyRMH (1153867)

      In some situations yes, but in those same situations I don't think this news really changes anything (where you set up the cert yourself on one of your own servers for use by yourself, for instance). Otherwise this just means that these certs are slightly less secure because governments have a copy. If you're connecting to a strange server, it may be better to have a signed cert because they're still not quite as easy to come by as a self-signed one.

      In any case this doesn't change the old fact that a self-s

      • In any case this doesn't change the old fact that a self-signed cert is at least as good as an unsecured connection and browsers should stop throwing a shit-fit when they run into one.

        If you think browsers should instead always notify you when using a trusted CA-signed cert ("Congratulations! This site appears to actually be legit!"), with the default for self-signed and unencrypted communications being silence, yeah, I can kinda see your point. You should default to paranoia, right?

        Otherwise, no; the warni

        • If you think browsers should instead always notify you when using a trusted CA-signed cert ("Congratulations! This site appears to actually be legit!"), with the default for self-signed and unencrypted communications being silence, yeah, I can kinda see your point. You should default to paranoia, right?

          That's what I was thinking, and modern browsers are already halfway there with the address bar lighting up in a bright color on signed HTTPS connections.

    • Re:Self signed? (Score:5, Interesting)

      by MightyMartian (840721) on Wednesday July 24, 2013 @02:54PM (#44372763) Journal

      Yes, providing you can guarantee the security of the private keys, if you're concerned about government(s) spying on your communications, that is definitely the way to go.

      For our organization, due to the highly confidential nature of some of our data and communications, I am about to build a machine that will have no network connection whatsoever that will hold the CA and private keys, and will use it to produce public keys for our VPN, mail server, web services and the like. The server will be behind lock and key and locked down with LUKS, and the keys for that will be held in a separate location. Obviously nothing is 100%, but it's going to physical access to the server and to the private keys to compromise the system.

      • by TubeSteak (669689)

        For our organization, due to the highly confidential nature of some of our data and communications, I am about to build a machine that will have no network connection whatsoever that will hold the CA and private keys, and will use it to produce public keys for our VPN, mail server, web services and the like. The server will be behind lock and key and locked down with LUKS, and the keys for that will be held in a separate location. Obviously nothing is 100%, but it's going to physical access to the server and to the private keys to compromise the system.

        Counterpoint:
        http://www.foreignpolicy.com/articles/2013/07/16/the_cias_new_black_bag_is_digital_nsa_cooperation?page=full [foreignpolicy.com]

        During a coffee break at an intelligence conference held in The Netherlands a few years back, a senior Scandinavian counterterrorism official regaled me with a story. One of his service's surveillance teams was conducting routine monitoring of a senior militant leader when they suddenly noticed through their high-powered surveillance cameras two men breaking into the militant's apartment. The target was at Friday evening prayers at the local mosque. But rather than ransack the apartment and steal the computer equipment and other valuables while he was away -- as any right-minded burglar would normally have done -- one of the men pulled out a disk and loaded some programs onto the resident's laptop computer while the other man kept watch at the window. The whole operation took less than two minutes, then the two trespassers fled the way they came, leaving no trace that they had ever been there.

        Over the past decade specially-trained CIA clandestine operators have mounted over one hundred extremely sensitive black bag jobs designed to penetrate foreign government and military communications and computer systems, as well as the computer systems of some of the world's largest foreign multinational corporations. Spyware software has been secretly planted in computer servers; secure telephone lines have been bugged; fiber optic cables, data switching centers and telephone exchanges have been tapped; and computer backup tapes and disks have been stolen or surreptitiously copied in these operations.

      • by Adnonify (2964415)
        You are better off this way (which I use by the way) Get some PKI compliant smartcard, compile everything on an offline machine (drivers, pcsc / opensc) and then make the smartcard's crypto engine generate a private key and protect it with a pin. Use the smartcard to hold the keys. Keep the card on you at all times. Cloak it with printing a banklogo on top! You can make 2 cards, one holding the CA and you can vault that one (it has 3 pin attempts after which the cards data is LOST) and use that card to sig
      • If the data is that confidential, you should probably look into an actual FIPS-certified network-connected HSM instead of rolling your own.

        I did a project a few years back using nCipher NetHSMs (they've since been bought up, I believe) and they were quite cool technology. Even then, I think one of these devices was in the $25K range at most.

        The great thing is, if you generate a key pair with one of these, you literally cannot get access to the private key to hand over to the government, even if you wanted

    • Re:Self signed? (Score:5, Informative)

      by Todd Knarr (15451) on Wednesday July 24, 2013 @02:56PM (#44372777) Homepage

      No. The Feds are requesting the private keys from the server operators themselves, not from the CA. A self-signed certificate's no guarantee the site operator hasn't coughed up the private half to the surveillance people. I'm not any more worried about this, though, since as demonstrated with XMission the government doesn't need to eavesdrop on communications when they can get access directly at the server end of things. As long as the Feds can threaten the site operator with unspecified nasty things if they don't cooperate or if they even say a word about what's going on, I have to assume any site I don't control myself is potentially compromised and any data sent to it's potentially visible to the various agencies involved or to the private contractors those agencies are using to do the grunt work. In many cases that doesn't matter much since the nature of the site's such that I won't put anything sensitive or compromising on it in the first place.

      • by TWiTfan (2887093)

        The Feds are requesting the private keys from the server operators themselves, not from the CA.

        Something tells me that before this is over, we'll find out they've been requesting them (and getting them) from the CA's too.

        • by EvanED (569694)

          Actual question: do the CAs even ever have access to the private keys?

          I'm pretty sure there's no technical reason they need them -- the CAs just need to attest to the public key, which they could do just by signing the public key. But that doesn't mean that's how the system is set up in practice, of course.

          • Re:Self signed? (Score:5, Informative)

            by Abalamahalamatandra (639919) on Wednesday July 24, 2013 @03:39PM (#44373269)

            Actual answer: no.

            The CSR (Certificate Signing Request) contains only the public half of the key, to be signed by the CA's key which results in the CA attesting that the information is verified.

            The entity whose key was signed always maintains control of the private key. Which, to me, is the reason that public-key encryption is not "over". The NSA would have to strong-arm every single holder of an SSL key, not just the Certificate Authorities.

            Granted, though, those private keys are not often held terribly securely - they're most often just files on a server that aren't even password-protected, because that requires an admin to type in passwords whenever the Web server is restarted. They COULD be held in an HSM, a hardware security module much like a TPM on steroids, but that's very expensive and difficult to set up.

            However, none of this means that public-key crypto is broken. It's possible that individual sites could be compromised via this route (Facebook, Google, etc) but as a whole, no.

            • by omnichad (1198475)

              As long as you have the CA's key, you can sign your own private key to execute a MITM attack. You don't need to have the real private key to do this. In the middle, you decrypt and re-encrypt before sending packets along. The site visitor doesn't know if they're connecting to the "correct" private key. There's no way to know that. They just know they're connecting to a site that's using a public key that has also been used to sign a certificate.

              And since your certificate is unknown to the CA, it won't

            • It'd be easy enough to sign a false certificate though. If done on a large scale it'd be noticed eventually, but as a targeted intercept just on a few individuals it'd work.

        • Re:Self signed? (Score:4, Insightful)

          by Speare (84249) on Wednesday July 24, 2013 @03:27PM (#44373121) Homepage Journal
          Please see Schneier's paper on the "compelled certificate creation attack." Rather than asking a CA for the keys from Alice to Bob, they could compel a CA to vouch for an Alice to Eve, Eve to Bob connection as if it were Alice to Bob directly.
        • by skids (119237)

          That would only be useful to forge certificates, and using such forged certificates would allow tracking of surveilance activities -- the provider would not see them in their own keyring so if they were seen in the wild and came to a privider's attention, their natural reaction would be to accuse the CA of having been compromised... because you have no way of knowing it's the NSA that's doing it.

          Unless it totally sucks or is also hosting your SSL service, a CA neither needs nor asks for your private key, it

    • Not more, but not necessarily less. With a self signed cert, you cant verify the identity of the signer/cert. With the possibility of a compromised CA, you have (essentially) the same problem. (As far as understand it anyways).

      What I would like to know is what (if anything) can be done to verify keys without a CA? I don't know that much about crypto, so am genuinely curious. Are there techniques to do this? (Diffie-Hellman-Merkle?)

      • by Sarten-X (1102295)

        With a self signed cert, you cant verify the identity of the signer/cert.

        Correct, and that's really all you're paying for when you buy a certificate from a CA: You pay enough money and provide enough documentation that they're confident you are who you say you are.

        With the possibility of a compromised CA, you have (essentially) the same problem.

        Almost correct. You can't really verify the identity, but your computer won't really even try because it trusts the compromised CA. The solution is to check revocation lists, but there are problems with that.

        What I would like to know is what (if anything) can be done to verify keys without a CA?

        Let each person be a CA [wikipedia.org]. If I know you, I can sign your certificate myself. Anybody who knows me and trusts me

        • Let each person be a CA [wikipedia.org]. If I know you, I can sign your certificate myself. Anybody who knows me and trusts me would then trust you. Again, compromises are fixed by revocation and expiration, but the impact is somewhat less severe.

          then you get something like the ebay problem where every review is AAAAAAA++++++++++++!!!!!!1!!!!one!!eleven!!
          and are useless

          just because i trust my friend doesn't mean i always trust him to show good judgement...how do i know he was of sound mind when he signed the cert for that tattoo parlor and came back with the pink bunny tattoo on his forehead?

          • by Sarten-X (1102295)

            Not to sound dismissive, but that's an implementation detail. PGP uses a system of partial trust, though its particular implementation I don't know.

            I do recall some (long-outdated) research into this particular problem, where a trust network didn't simply have "trust" or "do not trust". Rather, it maintained a percentage of trust - Each hop in a chain decreased the total trust in the chain, but each separate path increased it. At the end of the chain, the client could compute exactly how much a particular s

      • Re:Self signed? (Score:4, Interesting)

        by Znork (31774) on Wednesday July 24, 2013 @03:26PM (#44373115)

        There's always the Convergence project (based on the previous Perspectives CMU work).

        Basically, instead of CA's you have notary servers that track changes to certificates and that you (your browser) contacts to verify that they and you are seeing the same certificates.

        That way, if a MITM attack is ongoing it will, if targetting you specifically, probably show a discrepancy between the certificate presented to you and the one presented to them. If targetting the specific website and MITM'ing all connections to it the only demonstration of a problem might be that the site suddenly appears to have a new certificate, but that would still most likely alert site operators who may be surprised to note a change they didn't do.

      • by tlhIngan (30335)

        What I would like to know is what (if anything) can be done to verify keys without a CA? I don't know that much about crypto, so am genuinely curious. Are there techniques to do this? (Diffie-Hellman-Merkle?)

        Well, you can always fingerprint a key and verify with the owner of the site that the fingerprint is correct.

        The CA model is called a "web of trust" model - it relies on you trusting someone and then seeing if a key you've been given was signed by someone you trust. In the CA model, the CA signs public

    • by Daimanta (1140543)

      I really dislike the way certificates are treated right now. Certs incorporate two different things, namely authentication and encryption. Ofcourse I understand that it is more secure to have an encrypted channel while communicating with a host that needs to be authenticated but the reverse isn't always the case.

      Sometimes I am not interested in authentication with a machine because I know that the machine in question is the right one. What I AM interested in is the fact that I should be able to communicate

    • Re:Self signed? (Score:5, Insightful)

      by Sarten-X (1102295) on Wednesday July 24, 2013 @03:00PM (#44372845) Homepage

      No. When a CA signs a certificate, they don't get the private key used for decryption. They just assert that a particular public key really does belong to who it says.

      If the NSA has Verisign's key, for example, they'd be able to do two things:

      1. decrypt traffic sent to Versign, which isn't very useful in itself
      2. Create and sign their own certificates as though they were Verisign.

      The latter is where the man-in-the-middle attack comes in. The NSA can claim to be whoever you're trying to reach, and the certificate will look valid and be trusted by default on any system that trusts Verisign. On the other hand, a self-signed certificate isn't signed by anybody else. The NSA doesn't need anyone else's private keys to make their own and claim to be anyone. The client will see the certificate, ask you if you trust it, and unless you're in the habit of memorizing certificate fingerprints, you won't notice a difference. Once any certificate is trusted (either by default or by your acceptance), your traffic will be sent to (and decrypted by) the certificate holder.

      This is actually already a problem. CAs have been compromised, and their stolen credentials have been used to sign certificates claiming to be governments, Microsoft, and other generally-trusted sites. The apparently-trusted certificates are then used to make scams look more legitimate.

      • by Damouze (766305)

        I would not be surprised to see that the NSA - or any other nation's intelligence service - can devise ways to make you think (and take it for a fact) they are whoever they tell you they are.

        As for certificates and CAs: certificates, keys and CAs are about building trust. Between the service provider on one end for example, and its customers on the other. The Certificate Authority asserts that the service provider is who it claims to be, and another Certificate Authority (or maybe even the same - the root C

      • by Burz (138833)

        CAs including Verisign actually advertise the fact that they provide "lawful intercept" services. IOW, they cooperate with the spies and I assume they don't have to give up their master keys to the NSA in order to assist with MITM attacks. CAs are in the business of intercepting our communications.

        All they have to do is keep a database of bogus certs for the addresses they verify, and perform a verification against a bogus cert for particular user IPs on a surveillance list supplied by the spies. Then all t

    • by X.25 (255792)

      Does this mean a self-signed certificate is more secure than a commercial one?

      I have spent almost 10 years of my life trying to explain people why self-signed certs are much more secure.

      People don't care.

    • by citizenr (871508)

      They already have access to commercial ones and can decrypt those :)

  • by Anonymous Coward

    Time to learn Klingon, or invest in carrier pigeons and a Little Orphan Annie decoder pin.

    I wonder if our government will be responsible for single handedly killing our consumer tech industry.

  • by meta-monkey (321000) on Wednesday July 24, 2013 @02:50PM (#44372719) Journal

    Of course encryption is a problem for them. It's the same problem Allied intelligence had acting on information that could only be attained because Enigma was broken. [wikipedia.org]

  • by zlives (2009072) on Wednesday July 24, 2013 @02:57PM (#44372793)

    I wish I was back in my last cisco vpn class and see what my instructor (who according to his self was installing security for major industry) has to say now about my question about transparent proxies and ssl and cisco road map. he was recommending ssl as a better replacement to ikev2. Granted my tin foil hat was fully deployed about NSA snooping but...

    i wish i was wrong.

    • by skids (119237)

      They were doing this not for NSA reasons it's just what the tech industry does: find a protocol that is a bit inconvenient to set up, and instead of making it more convenient to set up, figure out an alternate scheme that's a little easier to set up, but for which they can charge a license fee for the feature, because it's new and shiny, and the sales force has been told to make sure all the PHBs know it is new and shiny.

      Of course then the rimshot comes and they realize in their haste they've done something

  • by Anonymous Coward

    So the next time the US wants to chastise another country for spying on their citizens, the response is going to be "go away you hypocritical assholes".

    America has lost her moral compass, and is quickly turning into a police state.

    Papers please comrade.

    • Re: (Score:2, Insightful)

      by Anonymous Coward

      america has been a police state ruled by fear for some time now, your among the most oppressed people in the world but its balanced by ignorance, its taken you guys this long to notice.

  • by xxxJonBoyxxx (565205) on Wednesday July 24, 2013 @02:59PM (#44372835)

    >> "The government is definitely demanding SSL keys from providers," said one person who has responded to government attempts to obtain encryption keys. The source spoke with CNET on condition of anonymity.

    So...some guy said "yes, they're collecting keys." No written evidence, no names. We demand "citation" from people posting backstories of cartoon characters on Wikipedia, so how exactly is this "confirmation" of anything?

  • by Midnight_Falcon (2432802) on Wednesday July 24, 2013 @02:59PM (#44372837)
    Many have assumed for a long time that root SSL certificates have been provided by American CA's (GoDaddy, VeriSign, Network Solutions etc), but what about foreign ones? StartSSL is Israel-based, so it can be assumed the Israeli government has the root key. What about SwissSign, based in Switzerland and run by the Swiss Post? :)
    • Who says they don't all have a big sharing agreement? Even countries that are unfriendly to each other, it would be worth it to both sides. You can be sure the governments themselves aren't using this stuff.

      • That is absolutely true -- there is no way to be sure. However, it seems as though the Swiss have a penchant for privacy, especially from the Americans, which has only been rarely and recently broken. Switzerland isn't unfriendly so much as perpetually neutral, which is why it is used for private banking services, so it seems less likely a Swiss CA is compromised than an American one. Unless anyone has any information that might point otherwise...
  • by DickBreath (207180) on Wednesday July 24, 2013 @03:06PM (#44372913) Homepage
    In some cold war police states half the population was employed to spy on the other half. No wonder their economies sucked.
    • by Kjella (173770)

      Yeah today between machines and self-service spying (meaning, people post it on Facebook themselves) it's like shooting fish in a barrel.

  • Will this do it? (Score:5, Interesting)

    by Taantric (2587965) on Wednesday July 24, 2013 @03:15PM (#44372987)

    If this does not kill off the cloud or at least seriously damage the business model, I think it would be safe to say human apathy has reached critical mass and we deserve everything that is coming in the next 20-30 years.

    • by amiga3D (567632)

      Oh come on. I don't think it's right but I have to say the government pretty much knows everything about me now anyway. What difference if they have access to my private info. I know they are watching so I'm certainly not going to provide them with anything damaging to me. There are ways around this if you know it's compromised and even without this article I was pretty sure it was compromised anyway. Any security that you don't have 100 percent control of isn't totally secure by definition. I know th

      • You are missing the point amiga3D. When "the government pretty much knows everything about [everyone] now anyway" - then there is no more ability to effectively and democratically reform society for the better, right injustices, fight to change the status quo etc. For example try and organize a rally, information drive, any form of community organization against or for [insert cause]. If it upsets those in power you will be picked up/harassed/fired/detained before any of your emails/chats/phone calls to or

  • To decrypt, don't they just need the private key for the CA? From there I believe its all down hill to eventually get the session keys.
    • by Skapare (16644)

      If they have the CA key, they can create a new private key for the service you are going to, reroute your traffic intended to go to that service sending it to their own server, provide the public half of the "master" key they created which is signed by the CA key, and your client (browser) will believe it is reaching that service when it is not. This is the man in the middle attack, styled slightly different by having the CA key instead of the target private key.

      Browsers could help with that by saving the

  • If true not so bad! (Score:2, Informative)

    by Anonymous Coward

    If true this could be bad as presently SSL uses the public / private RSA key pair for encryption as well as authentication.

    BUT under the latest SSL / TLS standard (only presently client side supported by Chrome) the encryption half of the secure connection can be performed by Diffie-Hellman key exchange and that would offer perfect forward security. Meaning that all a government with the private key can do is a MITM attack, and it is possible to spot that by using multiple IP path checking and other tests.

    U

  • I've seen this claim a few times in the past. Someone a few months ago told me they were confident that the government already have private keys for every major US site.

    If that were the case, why would they need to request data from Google, Microsoft, Facebook, Yahoo, AOL, etc. All of these companies have discussed how the government requests data from them, and how they have to provide it. If the government simply had the private keys and could just sniff all traffic, they wouldn't need to.

    I wouldn't be sh

    • by Skapare (16644)

      Having the CA keys, or the site private keys, does not automatically hand data over to them. They still have to intercept the data, being sure none of it reaches the intended destination except through their MitM attack. They have the taps and the means to do this. They do NOT have the resources to do this for 100% of the population ... yet. They still need to get certain subsets of other data from these providers to do what they are doing. Don't assume that because they are asking for certain data tha

      • They could just sniff traffic at all the tier 1 ISPs and filter for who they're looking for. They'd have info immediately. If they had keys and they weren't doing this, then they'd be idiots.

    • by dave562 (969951)

      "If that were the case, why would they need to request data from Google, Microsoft, Facebook, Yahoo, AOL, etc. All of these companies have discussed how the government requests data from them, and how they have to provide it. If the government simply had the private keys and could just sniff all traffic, they wouldn't need to."

      It comes down to legality. If the government intends to eventually prosecute someone, they have to follow the legal process.

      On the other hand, if all they want to do is snoop and "pr

      • That's precisely the point. The system that has been exposed (and many people have known about for years) is that the government uses NSLs to get data from companies. Requesting SSL keys doesn't make sense because they can't use the data.

  • Update, 11:40 a.m. PT: Adds additional comments from a Facebook representative saying the company has not received such requests.

    So how do we know this statement is not as it is due to a FISA or other type of gag order with accompanied threat? The truth is we simply do not if this statement is as it is due to the duress of a gag order. We have not have a pre-established a duress code word, nor the trust the needs to accompany it.

    • by blueg3 (192743)

      About the same way that we don't know the reporter or their source simply made up the statement.

  • Does the NSA really have a problem decrypting SSL/TLS? I find it hard to believe that they do not have dedicated hardware with specialized processors that have been custom built to crack SSL/TLS.

  • They should set up their own CA in some country immune to US pressure. They would not have to do the actual signing. (Probably difficult due the current fishbowl they live in.) They could hire the people set policies put their logo on it. They could set it up so actual signing occurs anonymously in some unknown country.

    Probably the only CA I would trust.

    • Setting up a CA is easy, anyone can do it.. The hard part is getting the CA's keys into the various browsers. If you don't get your keys into browsers then users don't have any confidence in the certificates that you hand out and the browser cannot detect a Man In The Middle attack. Users will (righly) see nasty warnings from the browsers.

      If the NSA says ''no'' then the major browser vendors will not distribute your keys with their browsers. Unfortunately: but probably so.

      Something needs to change else it i

  • "Anonymous source claims" ...

    That anonymous source guy is a nutcase. Imonths nonymous source the same guy who says Obama is a space alien?

    On the other hand, in 2008 Mr. Source said "you think 2% growth for six monthd is a bad economy? Just wait and see how Obama trashes the economy for six years", so I guess he's right sometimes.
    • The GDP in 2008 was negative for 3 out of the 4 quarters, and for the year. It was a CRUSHING -6.3 percent for Q4 2008. 2% growth would have been a giant improvement.

      Mr Source needs to update his talk.

HOST SYSTEM NOT RESPONDING, PROBABLY DOWN. DO YOU WANT TO WAIT? (Y/N)

Working...