ASG
IBM
Zystems
Cressida
Icon
Netflexity
 
  MQSeries.net
Search  Search       Tech Exchange      Education      Certifications      Library      Info Center      SupportPacs      LinkedIn  Search  Search                                                                   FAQ  FAQ   Usergroups  Usergroups
 
Register  ::  Log in Log in to check your private messages
 
RSS Feed - WebSphere MQ Support RSS Feed - Message Broker Support

MQSeries.net Forum Index » IBM MQ Security » What if CAs give our digital certs to the NSA?

Post new topic  Reply to topic Goto page Previous  1, 2
 What if CAs give our digital certs to the NSA? « View previous topic :: View next topic » 
Author Message
bruce2359
PostPosted: Mon Jul 22, 2013 6:30 am    Post subject: Reply with quote

Poobah

Joined: 05 Jan 2008
Posts: 9469
Location: US: west coast, almost. Otherwise, enroute.

exerk wrote:

Bruce, please define what you mean by '...improve security...'. At my current organisation they're pretty much as secure as they can be in terms of business data etc., but if a government body serves up a legally binding request for that data just what is 'secure'?

NSA has co-located sniffing hardware/software at AT&T (and other) telecom sites. It is capturing our data in bulk, for long-term storage, and eventual decryption.

In the past, we all presumed that a court-order for your data would be presented to the source of the data - your organization. This is not the case here.

In the current scenario, NSA goes to FISA court, and gets a secret court-order requiring Thwart of Verisign or ... to provide your certs. You/your organization will not know this is taking place. Your organization will not know when/if its data is being decrypted, and given to other 3rd parties (think IRS).

Did you bring this to the attention of your management? Do you intend to? If not, why not?
_________________
I like deadlines. I like to wave as they pass by.
ב''ה
Lex Orandi, Lex Credendi, Lex Vivendi. As we Worship, So we Believe, So we Live.
Back to top
View user's profile Send private message
exerk
PostPosted: Mon Jul 22, 2013 6:45 am    Post subject: Reply with quote

Jedi Council

Joined: 02 Nov 2006
Posts: 6339

bruce2359 wrote:
NSA has co-located sniffing hardware/software at AT&T (and other) telecom sites. It is capturing our data in bulk, for long-term storage, and eventual decryption.

Assuming it traverses a USA-based network?

bruce2359 wrote:
In the past, we all presumed that a court-order for your data would be presented to the source of the data - your organization. This is not the case here.

The wonderful catch-all of 'national security'

bruce2359 wrote:
In the current scenario, NSA goes to FISA court, and gets a secret court-order requiring Thwart of Verisign or ... to provide your certs. You/your organization will not know this is taking place. Your organization will not know when/if its data is being decrypted, and given to other 3rd parties (think IRS).

I believe most governments have a get-out-of-jail-free card in that respect, i.e. sharing 'intelligence' between departments.

bruce2359 wrote:
Did you bring this to the attention of your management? Do you intend to? If not, why not?

The Eu, as an organisation, takes data protection very seriously - although I wonder how serious they are about being able to read it themselves...
_________________
It's puzzling, I don't think I've ever seen anything quite like this before...and it's hard to soar like an eagle when you're surrounded by turkeys.
Back to top
View user's profile Send private message
Vitor
PostPosted: Mon Jul 22, 2013 7:11 am    Post subject: Reply with quote

Grand High Poobah

Joined: 11 Nov 2005
Posts: 26093
Location: Texas, USA

bruce2359 wrote:
Did you bring this to the attention of your management?


No, because most of my management have trouble even spelling SSL & will not understand the issue except at the political level.

bruce2359 wrote:
Do you intend to?


No, and see above. I'd also prefer them to focus on thing they can influence, like enforcing code reviews & testing because...

bruce2359 wrote:
If not, why not?


...as others have said, if the government obtains a court order (from an open or a secret court) then they're going to get the data anyway because we're going to give it to them. Or any provider with wire-sniffing technology is going to give it to them.

Note that:

bruce2359 wrote:
In the past, we all presumed that a court-order for your data would be presented to the source of the data - your organization. This is not the case here.


It is the case here. It's just that the court is not what you envisage when you frame the concept, it's a judge in a windowless office under the NSA but it is a judge. All governments play by the rules by definition because they make the rules.

You don't like it, start a revolution. It worked last time but be careful: the enemy isn't standing in the middle of a field wearing red coats this time.
_________________
Honesty is the best policy.
Insanity is the best defence.
Back to top
View user's profile Send private message
mqjeff
PostPosted: Mon Jul 22, 2013 7:14 am    Post subject: Reply with quote

Grand Master

Joined: 25 Jun 2008
Posts: 17447

Vitor wrote:
the enemy isn't standing in the middle of a field wearing red coats this time.

It's America.

We'll just shoot anyone in a suspicious looking hoody.

(Note, all hoodies are suspicious.)
Back to top
View user's profile Send private message
exerk
PostPosted: Mon Jul 22, 2013 7:16 am    Post subject: Reply with quote

Jedi Council

Joined: 02 Nov 2006
Posts: 6339

mqjeff wrote:
Vitor wrote:
the enemy isn't standing in the middle of a field wearing red coats this time.

It's America.

We'll just shoot anyone in a suspicious looking hoody.

(Note, all hoodies are suspicious.)

I'll be leaving mine at home when I come a-visiting, especially the red one...
_________________
It's puzzling, I don't think I've ever seen anything quite like this before...and it's hard to soar like an eagle when you're surrounded by turkeys.
Back to top
View user's profile Send private message
Vitor
PostPosted: Mon Jul 22, 2013 7:20 am    Post subject: Reply with quote

Grand High Poobah

Joined: 11 Nov 2005
Posts: 26093
Location: Texas, USA

exerk wrote:
mqjeff wrote:
Vitor wrote:
the enemy isn't standing in the middle of a field wearing red coats this time.

It's America.

We'll just shoot anyone in a suspicious looking hoody.

(Note, all hoodies are suspicious.)

I'll be leaving mine at home when I come a-visiting, especially the red one...


The Big Bad Wolf will be so disapointed.
_________________
Honesty is the best policy.
Insanity is the best defence.
Back to top
View user's profile Send private message
exerk
PostPosted: Mon Jul 22, 2013 7:26 am    Post subject: Reply with quote

Jedi Council

Joined: 02 Nov 2006
Posts: 6339

Vitor wrote:
exerk wrote:
mqjeff wrote:
Vitor wrote:
the enemy isn't standing in the middle of a field wearing red coats this time.

It's America.

We'll just shoot anyone in a suspicious looking hoody.

(Note, all hoodies are suspicious.)

I'll be leaving mine at home when I come a-visiting, especially the red one...


The Big Bad Wolf will be so disapointed.

I am not going to dress up for you again - it was too embarrassing the last time, and I nearly sprained an ankle trying to walk in those bloody heels!
_________________
It's puzzling, I don't think I've ever seen anything quite like this before...and it's hard to soar like an eagle when you're surrounded by turkeys.
Back to top
View user's profile Send private message
Michael Dag
PostPosted: Mon Jul 22, 2013 7:35 am    Post subject: Reply with quote

Jedi Knight

Joined: 13 Jun 2002
Posts: 2607
Location: The Netherlands (Amsterdam)

mqjeff wrote:
(Note, all hoodies are suspicious.)

What!? I really miss the smiley here so are you serious?
_________________
Michael



MQSystems Facebook page
Back to top
View user's profile Send private message Visit poster's website MSN Messenger
exerk
PostPosted: Mon Jul 22, 2013 7:43 am    Post subject: Reply with quote

Jedi Council

Joined: 02 Nov 2006
Posts: 6339

Michael Dag wrote:
mqjeff wrote:
(Note, all hoodies are suspicious.)

What!? I really miss the smiley here so are you serious?

Probably, if you're clutching a bag of sweets too...
_________________
It's puzzling, I don't think I've ever seen anything quite like this before...and it's hard to soar like an eagle when you're surrounded by turkeys.
Back to top
View user's profile Send private message
Vitor
PostPosted: Mon Jul 22, 2013 11:52 am    Post subject: Reply with quote

Grand High Poobah

Joined: 11 Nov 2005
Posts: 26093
Location: Texas, USA

exerk wrote:
Michael Dag wrote:
mqjeff wrote:
(Note, all hoodies are suspicious.)

What!? I really miss the smiley here so are you serious?

Probably, if you're clutching a bag of sweets too...


I've warned you about men with bags of sweets.

Especially when you're wearing those heels.
_________________
Honesty is the best policy.
Insanity is the best defence.
Back to top
View user's profile Send private message
Display posts from previous:   
Post new topic  Reply to topic Goto page Previous  1, 2 Page 2 of 2

MQSeries.net Forum Index » IBM MQ Security » What if CAs give our digital certs to the NSA?
Jump to:  



You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
Protected by Anti-Spam ACP
 
 


Theme by Dustin Baccetti
Powered by phpBB © 2001, 2002 phpBB Group

Copyright © MQSeries.net. All rights reserved.