Reading your email..

[Puggit]

Pop up on my phone says Russia have given Snowden asylum allowed Snowden to leave the airport.

[collateral]

Just going to leave this here...

[BertieWooster]

Snowden has left the building: http://news.sky.com/story/1123215/fugitive-edward-snowden-leaves-moscow-airport.

Bertie W

[Odie]

Art0ir said:

Well the leaks show that GCHQ filters Bittorrent data our at "source" from fiber lines.

Bit torrent is probably already being monitored by a different department, I cant imagine its the safest way to communicate secret plans anyway due to its nature. I can think of better ways.

[Art0ir]

Odie said:

Art0ir said:

Well the leaks show that GCHQ filters Bittorrent data our at "source" from fiber lines.

Bit torrent is probably already being monitored by a different department, I cant imagine its the safest way to communicate secret plans anyway due to its nature. I can think of better ways.

My point was they discard it. I imagine they do the same with Netflix, Youtube data, etc.

[bitchstewie]

Bit more on what BT and Vodafone are apparently assisting GCHQ with:

http://www.theguardian.com/business/2013/aug/02/te...

[Regiment]

bhstewie said:

Bit more on what BT and Vodafone are apparently assisting GCHQ with:

http://www.theguardian.com/business/2013/aug/02/te...

Surely this was never a secret though, reports about governments having this access has been known about for years.

[collateral]

Regiment said:

bhstewie said:

Bit more on what BT and Vodafone are apparently assisting GCHQ with:

http://www.theguardian.com/business/2013/aug/02/te...

Surely this was never a secret though, reports about governments having this access has been known about for years.

It might've been assumed to be happening, but there hasn't been proof until recently

[jurbie]

Regiment said:

Surely this was never a secret though, reports about governments having this access has been known about for years.

A colleague works in the data centre for one of the mobile operators and tells a tale of the fun that was had when GCHQ wanted to install there own servers into that data centre. This wasn't a problem but apparently GCHQ insisted it be installed in it's own secure room and it took some time to explain to them that their servers would overheat and die within a matter of hours if they did this.

[0000]

I thought air conditioning usually resolved that problem.

[jmorgan]

I am guessing no one is going to put some serious heaters in a room without enough cooling.

Reading the other day that kids are putting families at risk when the blab about going on hols etc on the web in the usual places. I wonder how much is put on line vs gubbmint having a shufty and the difference in what they find? Not saying it is a good thing, just wondering.

Edited by jmorgan on Sunday 4th August 13:01

[98elise]

0000 said:

I thought air conditioning usually resolved that problem.

Yup, every data centre I've ever been in has been air conditioned, I'm not sure what the OP is getting at? Is he suggesting that GCHQ didn't know that? If so then its a load of bks!

[jurbie]

Sorry didn't make myself clear, when I said a room what I should have said a secure safe like box with no access except for an occasional GCHQ visitor.

However the point of the story isn't GCHQ's lack of understanding of server cooling requirements more that it illustrates in an entirely second hand way that GCHQ have their own kit in commercial data centres and have done for quite some time. The one thing my colleague couldn't answer was whether this kit is to monitor what goes through the data centre (his belief based on nothing more than why would it be there then) or perhaps it is just some sort of secure comms kit purely for GCHQ's use.

Apologies for the confusion I just though it was an interesting anecdote.

[Regiment]

collateral said:

It might've been assumed to be happening, but there hasn't been proof until recently

I've known for years, stories that emails being sent and received by UK citizens are scanned for key words are well known in the tech community and they've been around since the late 90s. There are ways to scan pictures as well for certain key words and most probably certain people in pictures.

I'm sure the press have known as well but now, now it's a big sensationalist story to rile people up and sell papers.

[egor110]

Now the general public know this what do you think they'll do?

Will they stop using facebook/twitter and go back to sending letters to gain some privacy?

I think not.

[0000]

Sort of. Facebook have apparently enabled HTTPS by default in the last week or so.

[bitchstewie]

0000 said:

Sort of. Facebook have apparently enabled HTTPS by default in the last week or so.

I think that gives a false sense of security to joe public who sees a padlock icon in their browser and assumes their traffic is safe.

We scan and filter HTTPS traffic for certain types of traffic such as Social Networking and Webmail sites - SSL is only secure so long as nobody else has the required keys.

[0000]

bhstewie said:

We scan and filter HTTPS traffic for certain types of traffic such as Social Networking and Webmail sites - SSL is only secure so long as nobody else has the required keys.

You mean by hostname rather than the content?

I don't disagree though; there's a tendency for people to think it's a silver bullet, but it is at least an improvement.

[bitchstewie]

0000 said:

You mean by hostname rather than the content?

I don't disagree though; there's a tendency for people to think it's a silver bullet, but it is at least an improvement.

No I mean the content.

Our firewall can decrypt and if you have the trusted root cert installed on clients (the important part) it's totally transparent unless you looked at the SSL icon to see the certificate that's actually being used.

My point is just that if I can do that with a £2k firewall it's not a giant leap to assume that the authorities may have access to public facing root certificates and may be able to do it at will.

[0000]

If they've got access to the client I guess it's game over anyway. If they were to abuse the CA chain outside a local network you'd hope someone would notice and I guess certificate pinning should help too as that becomes more widespread.

It raises the bar a little, reduces opportunity for mass interception and forces them to be more targeted.