Tag Archives: snooping

Posted on
by

The UK Government snooping bill will apparently “handle” HTTPS and encrypted communication protocols like Skype.

More clarification is clearly needed, but to me this is concerning and means on of the following:

  1. Nothing new, and this was just hand waving: The bill already plans to monitor connection data, so even with HTTPs which encrypts content an observer can monitor requests at the domain level. The page request and any payload is encrypted, but the fact that you’re visiting a given site is not, meaning that an observer will be able to see that you visited https://foo.com, but not which pages therein.
  2. They have site/tool level back doors: More worrying is that the snoopers have muscled back doors into sites like gmail and facebook, and protocols such as skype.

    Rumours about Skype back doors have previously been circulated, but have been denied. Skype’s own websites state that all communication is encrypted and that no transport node on the network has access to the unencrypted data, but since the tool is proprietary it is impossible to independently verify this. In my view this damages the tool’s credibility as a tool to conduct business communication securely.

  3. Compromised root certificates: Most concerning would be if the snoops had managed to strong arm certificate providers into compromising the SSL root certificates, allowing them to perform a man in the middle attack without the usual warnings. This is particularly alarming and puts at risk our entire eCommerce and banking ecosystem when these are inevitably left on a train.

Urgent clarification is needed, but to me this casts doubt on centrally issued certificate based encryption and proprietary protocols, for the time being at least.

Image “GCHQ” by James Stringer.

Posted on
by

As you are probably aware, Nosy-parker in chief Theresa May wants to record all the internet activity and emails of everyone in the UK, just in case you do something the government thinks is wrong (or decides is wrong sometime later down the line should you become “Politically inconvenient”).

One wily UK citizen recently did a very British act of defiance and, using the Freedom of Information Act, requested CCDP like information for just one UK individual, namely Theresa May.

Since she is so keen on snooping on the rest of us, I’m sure she wouldn’t mind.

After a certain amount of back and forth the request was unsurprisingly denied. What I find interesting is that the request was denied on cost grounds due to the breadth of the request. This begs the obvious question: if the cost of obtaining this information for one person proves too costly to comply with a simple FOI request, and that by their own admission the request is too broad, how on earth can they justify doing the same for ~65 million people?

As a government minister, much of the requested information would almost certainly be recorded anyway as a matter of course.

My suspicion of course is that this request was never going to be complied with, as always there is one rule for us and another for them, cost was just a convenient excuse. In the words of Lance-Corporal Jones, “They don’t like it up ’em”.

Posted on
by

I asked this question over on Hacker News, as well as Quora, but I thought I’d also ask it here…

The UK plans to intercept all electronic communication. They currently don’t plan to snoop on content, but as noted elsewhere connection data is just as invasive.

To me this is both a civil liberties and business risk problem. I view my list of business contacts as confidential information and I don’t trust the government not to leave this information on a train somewhere.

Legal solutions are one thing, but the snoops keep raising their heads, so my feeling is that we need to actually find a way to make this sort of thing technically impossible.

Content encryption is already largely solved, although for email we still need a critical mass of people using PGP or similar.

VPNs just seems to push the problem to another jurisdiction, and if this is an agenda all governments will one day pursue, this will become decreasingly useful.

What can an individual do to protect content and connection data? Onion routing for mail servers? Do technical solutions rely on everyone doing it and so are unlikely to get much traction?

So what are your thoughts? What can we build?