Hacker News Reader

Comment by NelsonMinar | Hacker News Reader

This is what security looks like when your threat model is well funded government agencies.

Same threat model with black hats. Here's a recent example from high-security field that's remarkably simple but stops tons of attacks:

http://www.cc.gatech.edu/grads/c/csong43/oakland16-hdfi.pdf

Its related work & extension page has a ton of references to other things showing just how much work it is to stop regular black hats in systems without verified software. Nation states just do more of the same stuff.

Edmison's has a nice survey & design for when you don't trust anything outside the SOC:

https://theses.lib.vt.edu/theses/available/etd-10112006-2048...

NSA targets those levels, too. At that point, your bases are covered so long as the fab receives and doesn't alter your design. Plus the complex tooling works...

Exactly, and I think it's worth noting that they likely only apply this level of security because of state actors. Which then shows that they are trying to prevent eavesdropping by NSA & Co., they probably just realized too late how far advanced they were.

Eric Grosse from Google says as much here, ...

Edit, it seems I have copied the wrong video, please us the link in the child comment

This talk is also discusses the adversaries: https://www.youtube.com/watch?v=0knR6vXba7g

. . . how far advanced, and the lengths they would go to.

Which then shows that they are trying to prevent eavesdropping by NSA & Co.

Why would the NSA eavesdrop on Google, they are in bed with them, aren't they?

Snowden revealed the opposite: https://cdn.grahamcluley.com/wp-content/uploads/2013/10/nsa-... NSA actively tries to eavesdrop on Google.

And the chips are probably the reaction to exactly that slide. Not only enabling SSL between datacentres, but verifying all code that servers run, to avoid that the NSA can download private keys from Google servers just because they handed an ESL to the datacentre operator.

Of course they can still use courts to get data directly from Google, but that way they can always only target individuals or small groups, not whole nations.

Got links?

For me, the whole takeaway of the Snowden leaks was that the NSA can legally force Google (or anyone) to hand over basically anything, am I mistaken? Articles like [1] seems to underline they are indeed working together.

[1] http://www.huffingtonpost.com/2014/05/06/nsa-google_n_527343...

The Snowden disclosures did not suggest that Internet companies like Google were coordinating with NSA. The disclosures suggested that NSA was wiretapping all traffic across the Internet, and then parsing it, storing it, and indexing it so as to be able to make sense of what traffic represented e.g. a Google web search, and then search that semantically later.

Because at the time Google did not use encryption in their network links between data centers, NSA was able to siphon up a whole lot of information that way - maybe more than just interaction between users and Google services, potentially as much as interaction between internal components of Google.

Anyway, Google and other companies responded by employing encryption in these links, and promoting the use of encryption across a number of other protocols. The Snowden disclosures were in my perspective a catalyst for Google's promotion of HTTPS in the Chrome browser, and TLS in Gmail, and probably Certificate Transparency. The fact that these initiatives such as encryption between data centers started after the disclosures suggests that they were a response from Google to thwart this kind of surveillance.

Google was requested large amounts of data by the NSA since ~2007 [1]. They were might or might not ordered to keep silent about it. They only started to address it as a reaction to the Snowden revelations. Additionally, there are letters such as linked above that show they are in fact very friendly with the NSA. One can argue they were caught red handed with little to nothing like an email here and there, but circumstantial evidence shows otherwise.

Personally I would go further, those multi billion dollar companies should have found a way to speak up if a contractor was able to, not just after the fact.

[1] https://en.wikipedia.org/wiki/PRISM_%28surveillance_program%...

If the NSA could force Google to hand over anything, why were there Snowden slides showing that the NSA was secretly tapping Google's internal networks?

https://www.washingtonpost.com/world/national-security/nsa-i...

>If the NSA could force Google to hand over anything, why were there Snowden slides showing that the NSA was secretly tapping Google's internal networks?

First, they can force Google to hand over anything. NSLs and the PRISM program are evidence of this, and both are relatively narrow in scope. However, each time the feds compel a top-tier tech corporation like Google to cooperate, the entire thing is scrutinized by lawyers on both sides, and risks drawing the ire of pissed off employees. There's probably many more potential Mark Kleins in Google than there are at a telecom like AT&T—the latter company's relationship with the NSA being best categorized as incestuous.

That being the case, why conduct bulk data collection overtly when they can do it covertly? The aforementioned overt measures ensure prompt data access in the event of an emergency, and keep everyone thinking they're on the up and up. Meanwhile, the truly nasty stuff like domestic bulk collection is conducted behind the scenes.

The infiltration is especially striking because the NSA, under a separate program known as PRISM, has front-door access to Google and Yahoo user accounts through a court-approved process.

I don't know. Maybe it is easier than going to court all the time? Who knows?

Snowden didn't reveal anything even suggesting this "front door access". He's got some PowerPoint slides that say prism and some that have Google logo on them. All meaning of these materials has been supplied by internet conspiracy theorists.

An abusive, rapey relationship is not the same thing as being "in bed".

That link is anything but an abusive relationship. Still, I fail to see how silicone is a countermeasure to a court order.

When Google has its networks compromised and is routinely compelled to comply with NSLs, I'd say that counts as abusive.

Reply on news.ycombinator.com