Hacker News Reader

Comment by gonvaled | Hacker News Reader

This is all nice and good. Unfortunately, it means absolutely nothing. Since we know that lying is (by law) part of what corporations are forced to do when addressing questions of "national security", no amount of denies, press releases, public outrage or congressional talk will restore trust. Even new legislation specifically forbidding snooping will not help, since we can never be sure that there is no "secret legislation" specifically allowing it - and forcing companies to comply.

I am sure lots of people want to genuinely change the situation in the US. Unfortunately, we can not believe it. For all the talk that the reddit co-founder will, as a private person, make, the simple question to reddit-the-company: "are you snooping on me" has no meaning whatsoever. Either the answer will be a "no comment", or it will always be perceived to be lie.

View on HN

> Since we know that lying is (by law) part of what corporations are forced to do when addressing questions of "national security", no amount of denies, press releases, public outrage or congressional talk will restore trust.

What law are you referring to? The FISA gag orders do not mandate lying.

Sometimes lack of response is quite telling. Sometimes telling garners severe consequences. That doesn't leave alternatives.

"Honey, are you cheating on me?"

Corporations have been denying participation for years because acknowledging being part of the program was a crime.

What law are you talking about? Google has hardly been denying participation with NSL gag orders; they've been pretty vocal about it. What they aren't legally allowed to do is to disclose details about them or inform the subjects of them.

They publish aggregate numbers of the non-secret ones here, by the way: http://www.google.com/transparencyreport/userdatarequests/US...

http://www.theatlanticwire.com/technology/2013/06/google-wan...

"The FISA requests don't already show up in Google's regular transparency reports because they are top secret, according to the law. So now Google wants to tell the world exactly how much they cooperate with the U.S. government."

So now that a whistle blower has tell us all about it, they want to come clean. Of course we know that there is now a "FOSA" program, which is the new top-secret program, which nobody will tell you about, until a whistle blower tells us about it - in 13 years.

That I call lying.

There is an answer that will restore confidence: Open systems for endpoints, including firmware, and zero knowledge in the cloud. That may require you to pay where ad supported services had been free. But every piece of it could be productized in weeks.

Funny that none of the cloud service providers has put that forward as a way to restore their credibility.

Productized in weeks ? even firmware ? that seems really hard.

How would you do it? Please share(if it's OK).

Opening firmware would be simple. Many devices have loadable firmware, like your phone's baseband processor. The toolchain is unlikely to be exotic, and providing build-able source code should not be a great burden. Some people hack baseband firmware for fun. They manage to reverse engineer it and inject new code with publicly available tools.

Considering the grave threat to US online services' from lack of trust, you would think that some announcement in this direction might have been made. Crickets, so far.

Android is a huge,complex codebase. doesn't this mean it's hard to verify it's security ?

Android has a userland made of unprivileged code running in a VM. To the extent it is different from a desktop Linux, it should have fewer userland components that could subvert system security. So, it's the same or perhaps easier to audit Android.

I'd be more worried about peripherals.

Telephones are hard to secure. That's why I mentioned open firmware. I'm not an expert on hardware-level security, but the combination of SoC architecture and lots of programmable cores in peripherals makes me think you would find ways of extracting information from a device that way. And the mobile baseband controls some of the audio paths in a handset.

It will be interesting to see if there are any revelations about device-makers and security that come out of the heightened interest in this topic.

Open isn't necessarily verifiable.

Reply on news.ycombinator.com