You're getting down voted because of all the Google, Facebook, and Apple employees here on HN.

point proven.

What is proven? Your wrong assumptions?

The NSA was also wiretapping the connections between Google's datacenters, so they were victims of the NSA too.

(Until we know more about their relationship with the NSA, I also don't condemn them for the PRISM allegations.)

I acknowledge there's a moral and ethical distinction there, but I dispute that there's any pragmatic difference: If you use Google services, your data is compromised, period.

It doesn't really matter whether the NSA or GCHQ are tapping Google's datacenters, paying off low-level employees, operating under a legal court order, or benefiting from the enthusiastic help of Google executives. The end result is the same: You cannot trust cloud services.

The question has never been "Can you trust cloud services?"

It's "Can you trust them more than the alternatives?"

Yes, you can almost certainly keep your private data more secure in a system you build and monitor yourself(1). Until an NSA or GCHQ-level entity takes interest in you, and uses a 0-day exploit on your system or just physically walks in with a warrant and steals your physical media. How is that functionally different from "If the NSA / GCHQ takes interest in you, they can have the cloud service provider hand your data over?" And that's before you add the overhead of maintaining, securing, and physically protecting your own systems.

(1) Note that even this step is a huge hurdle for most people; "You cannot trust cloud services" basically tells those people "Don't use the Internet."

There is a massive, massive difference between automatically slurping all data coming in and out of a cloud provider, and going after somebody with a targeted exploit or physically seizing machines.

I'd rather make them go through the trouble of getting my data physically then just typing

  grab * -ss 834-29-1293

or whatever they do.

Is 834-29-1293 your actual SSN? :\

834 was never used as an area number:

http://www.socialsecurity.gov/employer/ssns/HGJune2411_final...

The difference is the same that enable a police officer to walk the street, but require a warrant before entering a home.

Even NSA do not like to invade peoples homes. Its a health risk for agents, its costly, it competes with other agencies, and its bad for PR. The legal steps required are also much smaller when asking a cloud service to hands over information.

The answer CAN be "all of the above." Just because the NSA went beyond any agreement they may have with Google, and Google is genuinely pissed off about that, doesn't mean Google (or any other major technology company in the US) hasn't cooperated with the government regarding surveillance.

It is certain that telecom carriers participated willingly in the massive collection of telephone network CDRs from way back when these were on mag tape.

So far, every time someone has asked "What if the government is using X for surveillance?" the answer has eventually been yes. 100% of the time. Nothing is out of bounds. And that includes making partners victims if it is part of the mission to collect everything. Belgium, for example, is both a partner, somewhere in the hierarchy of partners outside of the Five Eyes, and a victim of GCHQ hacking. Being a partner doesn't spare you and being a victim isn't indicative you're not a partner.

I don't dispute that there was some collusion or collaboration, but at the same time, I don't condemn people on an incomplete pictures. Period.

For all we know, PRISM was more-or-less a euphemism for "we had a shallow collaboration that we used to pivot into a larger compromise of their networks".

Conversely, I'm going to have to agree with 'tptacek and his (probably not popular) opinion on Google and their influence on privacy and security at large.

https://news.ycombinator.com/item?id=8949256

So I stand by my decision to not condemn them until we learn more about the nature of their collaboration with the NSA's plot to deteriorate human rights the world over. Not because I love Google and think they can do no evil, but because I believe in charitable debate and skeptical inquiry.

> I believe in charitable debate and skeptical inquiry.

I believe in the odds. And the odds are that any technology that has a high potential to significantly add to surveillance capabilities has been exploited for that purpose either by hacking it or convincing (strong-arming if needed) the technology provider to cooperate.

I don't deny that Google does a lot of great things in general, and in security research specifically. That would be denying the plain facts. But I also do not think that has any impact at all on the relationships the government builds with (or forces upon) large corporations regarding national security.

When the chips are down, the NSA and other TLAs are going to get what they want. Now that tptacek is part of a larger transnational security company, he may find that out firsthand.

What exactly was it that you thought Matasano did, that the NSA might have ever leaned on them for anything? People on HN have historically had really weird ideas of how my work intersects with privacy. Matasano is a software engineering service.

I think we all know Matasano were the masterminds behind Regin.

I meant besides Regin.

Matatsano was probably too small. Didn't it get bought by a larger firm?

You didn't answer my question. What exactly do you think it is NSA wants firms like Matasano to do? Stop being evasive. Say something specific, so we can actually address the innuendo.

It seems much more likely that NSA would lean on your consulting practice: you build telephony and communications software. Obviously, I don't think NSA leans on companies like yours either.

The comment at the top of the thread is about Google. Not everything is about you.

I think you should tell that to the person who brought me up.

Sorry Thomas, I only referenced you because I thought the post in question was worth sharing in this context.

I never mentioned Matadano. I specifically refered to the "larger transnational security company" that acquired Matasano. If that's not correct regarding Matasano, I'm sorry. But I'm not being evasive in any way.

I'll let you know when I scale up to where I get a glimpse into the abyss.

I ran the professional services division for one of the largest companies in the same space as Matasano.

I'd love to hear what you think the NSA might have persuaded us to do?

I worked for the "multinational" for two years after the acquisition and I'm curious about NSA's evil influence too. Tell us more, Zigurd? Seriously: just a theory about what could have been happening would be great.

Since your indignation is fully intact, "one of the largest companies..." would not be RSA, right?

RSA isn't in remotely the same space as Matasano, nor would it be "one of the largest" if it were in that space.

As I rock back and forth in my chair, silently repeat the serenity prayer, and try to remain charitable; what sort of work do you think Matasano (or NCC, Accuvant, or VerizonBusiness, my former employer) does?

No?

Where did you read that? They're still alive and kicking.

'tptacek left it to start a new company. As far as I can tell, Matasano is quite successful and many of its employees are highly regarded hackers and engineers.

Some of what they do:

    * cryptopals.com
    * microcorruption.com
    * cryptoservices.github.io

See also: the 'whoishiring threads every month.

EDIT: You should probably respond to his post instead of mine.

Well, he is correct that Matasano was acquired by NCC Group. But as a rank-and-file Matasanoan since before the acquisition, I can't say I've noticed a huge impact on the day-to-day.

Okay, I wasn't aware previously. Thank you for correcting my ignorance.

You'd be surprised.

And yes I know what Matasano did. Which is why I say you'd be surprised.

"Does", not "did". But I really don't understand what you're trying to say.

Right, "does" - I forgot they just nested their namespace after going to NCC, sorry.

If you had to make a guess, you'd probably guess correctly, but we'll just end this thread here (don't guess). FWIW I'm not supporting Zigurd's statements, which sound crazy.

I'm more confused now than before you commented.

Joke's on you: he left Matasano.