I'm thinking there are questions about even open source projects. Who is to say they've not been covertly influencing them, or even running them altogether?

I'd certainly agree that open source offers the potential for independent verification of its nature, how many of these applications and libraries have been examined in detail by those who have the deep expertise to spot a subtle flaw and how many are just taken at face value?

The whole thing is frankly a cluster frak.

It goes deeper than that.

If I owned any server hardware, chances are it would be in a rack in a datacenter. What's to say somebody hasn't walked in, flipped a badge and taken my SSL private keys? In fact, that's quite probable.

You're thinking too small scale.

Certificate Authorities are almost certainly compromised. Why bother with one at a time when you can just force the vendor to hand the keys to the castle over? Sign your own certs, MITM anyone you want.

MITM isn't the issue, we assume for the most part that the NSA is a passive eavesdropper. Easier in that situation to sniff and decode with a stolen secret, rather than rewriting traffic on the fly.

Right, but my point is that the CA is the central point of failure for all of those scenarios.

Not really. For a passive attack the key would have to be stolen from a server rather then the CA, who never sees the private key, rather only the CSR (public key).

We're assuming under the current circumstances that it's backdoored, basically. The NSA definitely doesn't want to have to go knock on doors to collect those private keys.

The CA doesn't usually have access to your private key - they just sign the public key.

Right, I've gotten certs before. I'm saying that they could be faking certs for their own usage, and we're also assuming they have subtle backdoors in openssl, for example, to perhaps render having the private key moot.

True. You should host in a non-US and non-EU country (i.e. Switzerland) to be able to sleep better.

Any recommendation?

Haven't tested them yet, but they seem to be among the bigger (independent) ones: http://www.green.ch/en-us/home.aspx

Beware: If you do, it is going to be even more easier to crack.

Except now we also have to be much more vigilant about open source standards, too.

For example, now I worry the security model of WebRTC has been compromised by NSA, because it has the potential to offer very secure P2P conversations to the masses (at least 1 billion users - and that's before IE even adopts it in IE12, hopefully).

If your goal is to communicate securely, it's preferable to encrypt using a native (and obviously open-source) application (and OS) and to avoid the browser, for the time being.

Is to meet in person in a secure place.

Whatever channel you use might be compromised, if you cannot control both ends.

If you have an Android phone, Google tracks your location (GPS, cell towers and maps-wardriving-provided Wifi hotspots at least), so it's probably easy to see who met who. Maybe they also save seen bluetooth devices.

Phones don't record conversations in the pocket by default yet, but it's not inconceivable when computing efficiency improves that recording is always on, and keyword data is saved by default. Handy if it can creates calendar markings from verbal agreements...

And with Glass, video too.

So meeting in person is getting less secure as well.

> And with Glass, video too.

Glass adds the perversion that you don't have your say regarding surveillance of society, anymore. Your "friends" will do it for you.

Only solution: Get vocal whenever you see somebody wearing Glass.

Most phones let you pull the battery out, still.

Even when they don't, it's probably easy enough to disconnect the battery on your own.

Does anyone know how to disable WebRTC in the browser ? (Apart from downgrading of course)

I assume there is a chrome Flag for it, and a config option for firefox?