And you forgot a point: can they get an SSL root certificate signed for them, in order to perform MitM attacks on seemingly secured connections?
Yes, that is a good point that I forgot. I tend to assume the answer is "yes".
Re:How the NSA Got So Smart So Fast
by 6d0debc071 on Thursday June 13, 2013 @12:20PM
(#5874865)
> Re: #3; can you seriously imagine that they can't take control of an MS-Windows PC, with or without MS's knowledge?
Can they take control of an MS-Windows PC without the cooperation of my router maker and my firewall maker? And what does it cost them to do so for the different makers?
You know? I'm fairly sure they can, after all if some kiddy off the internet can what are the chances they can't. But what's the cost to cover the different profiles? Is there a single point of failure?
Shouldn't be hard for the NSA to monitor your web browsing for a few days and then inject a 0-day for whatever browser you're using into an HTTP response from, say, HN, right?
Re:How the NSA Got So Smart So Fast
by 6d0debc071 on Thursday June 13, 2013 @02:15PM
(#5875622)
If they've got to rely on the infrastructure provider to know what I've been looking at, then I assume that they don't have infrastructure in place themselves to arbitrarily do HTTP injection in a push button manner. May be wrong though.
And you forgot a point: can they get an SSL root certificate signed for them, in order to perform MitM attacks on seemingly secured connections? Here again it's a foregone conclusion, several less technically-savvy countries have been caught doing that.