NSA admits listening to U.S. phone calls without warrants

Re:NSA admits listening to U.S. phone calls without warrants by mpyne on Saturday June 15, 2013 @10:37PM (#5887208)

Far more than enough people use Chrome (or a different browser with cert pinning) with GMail that such an activity by the NSA would already have been tripped.

This is how other hacked SSL certs have been caught in the wild, remember? Do you think Iran has more GMail users than the U.S.?

Even my own S/MIME private key the NSA wouldn't be able to get a hold of without actually having to take my smartcard, and I'd certainly notice that.

Either way, there's something that the NSA has actually screwed up so I'm honestly a bit surprised that people are still arguing so much about a FISA compliance API. That horse is already essentially dead and buried. So dead and buried that others are saying that tptacek is tearing down a strawman for still mentioning it...

[ Parent | on HN ]

Re:NSA admits listening to U.S. phone calls without warrants by sneak on Wednesday June 19, 2013 @08:58AM (#5905216)

I am talking about entirely passive, offline decryption attacks, not MITM. Think beam splitters.

I'm sure there are browsers out there that won't negotiate PFS DHE modes with Google (which were only enabled a year ago serverside anyway). NSA has had long-haul and undersea fibers tapped for many years.

Cert pinning won't help because it's not MITM.

[ Parent | on HN ]