Microsoft Makes Moves To Protect Customers From Government Eyes(securityweek.com)
securityweek.com
Microsoft Makes Moves To Protect Customers From Government Eyes
http://www.securityweek.com/microsoft-makes-big-moves-protect-customers-government-eyes
45 comments
Has anyone coined 'crypto theater' yet? Telling us you use SSL between web requests is nice and all, but if various government agencies have PRISM-like access to unencrypted data then you're really not protecting anyone. I imagine all these recent "we're using stronger keys and ssl now" PR stunts are to keep foreign customers happy and to help kill the Snowden story.
"PRISM-like access to unencrypted data"? The notion that PRISM was literally a technological back door into servers and storage clusters at providers is a conspiracy theory.
Here, it's being deployed in the service of a dismissal of one of those providers improving their encryption --- of them making it harder for the USG to monitor comms.
Here, it's being deployed in the service of a dismissal of one of those providers improving their encryption --- of them making it harder for the USG to monitor comms.
Access is access. Regardless of whether it's enabled by real time interception, SSH, remote desktop, FTP, a rich web app UI, or snail-mail based optical disk exchanges.
And besides, whatever PRISM may or may not be, it's pretty clear MUSCULAR would fill in any gaps, and dispel your claim of mere theories, in favor of reality.
https://news.ycombinator.com/item?id=6641378
NSA infiltrates links to Yahoo, Google data centers worldwide (washingtonpost.com)
http://www.washingtonpost.com/world/national-security/nsa-in...
I mean, you gave the top comment on that thread, after all.
And besides, whatever PRISM may or may not be, it's pretty clear MUSCULAR would fill in any gaps, and dispel your claim of mere theories, in favor of reality.
https://news.ycombinator.com/item?id=6641378
NSA infiltrates links to Yahoo, Google data centers worldwide (washingtonpost.com)
http://www.washingtonpost.com/world/national-security/nsa-in...
I mean, you gave the top comment on that thread, after all.
Now you're changing your story. PRISM was widely reported not to provide automated/unauthorized access to data; it is now believed to be a submission/management system for FISA requests, which are reviewed by providers before the providers own personnel locate the data. The Guardian silently (to their shame) retracted the claims that PRISM was anything more than that.
Meanwhile, illegal direct access to intra-provider communications can be cured by improving operational security at providers, which is exactly what the story we're commenting on is an instance of.
No, I don't think your argument is valid.
Meanwhile, illegal direct access to intra-provider communications can be cured by improving operational security at providers, which is exactly what the story we're commenting on is an instance of.
No, I don't think your argument is valid.
IIRC, they were/are pulling tons of data with just a single FISA request. While the system you described is certainly much better than having a backdoor installed, I'm not sure whether that'll protect your data from being "accidentally" collected.
Dropbox. They use stronger than usual language to assure you that nobody can ever read your data. Unless there's a "glitch" that lets anyone login with no password at all.
Bug-based backdoors offer full deniability as part of an ass-covering strategy. All software has bugs, all software therefore has backdoors.
Not to mention the data is just sitting right on Amazon's platters. If I were the NSA & Dropbox wouldn't comply, I'd just pop over to Amazon
even if the encryption used was really secure, the government could request the keys. Unless company executives are no longer afraid to go to jail, they would give them out.
They were also paid a bunch of money to buy Skype and rearchitect it to enable wiretapping. It's not like they've "seen the light", depending on their incentives their actions change.
Do you have a link for that, or is it still speculation?
It's still speculation, and one of Skype's lead engineers wrote a completely sane explanation of how the centralization had to happen if Skype was going to work well on mobile, since you're not exactly going to be getting tons of supernodes on iPhones. You're welcome to believe that they also did it for government reasons, but there are definitely sane technological reasons, too. I'll update this comment with a link in a few minutes if I find it.
Something like this:
http://www.zdnet.com/skype-ditched-peer-to-peer-supernodes-f...
Internet: ZOMG there's so much spam and malware being transmitted via Skype. You have to do something!
MS: We have enabled URL filtering on Skype messages.
Internet: ZOMG you're reading my private messages. You monsters!
MS: We have enabled URL filtering on Skype messages.
Internet: ZOMG you're reading my private messages. You monsters!
"While we have no direct evidence that customer data has been breached by unauthorized government access, we don't want to take any chances and are addressing this issue head on."
Technically, he didn't lie. He did say "unauthorized", after all!
Technically, he didn't lie. He did say "unauthorized", after all!
also didn't say authorized by who I guess...
tl;dr pr piece:
> · Customer content moving between customers and Microsoft will be encrypted by default.
> · All of Microsoft’s key platform, productivity and communications services will encrypt customer content as it moves between Microsoft data centers.
> · Strong cryptography to protect these channels, including Perfect Forward Secrecy and 2048-bit key lengths.
Microsoft already does each of these today (for sure Exchange and SQL, which I know the best), and they have done them for years now. Nothing changes. The more important question is how Microsoft manages the keys for this encryption, because when I was there the keys were still based on NSA-approved root keys...
> · Customer content moving between customers and Microsoft will be encrypted by default.
> · All of Microsoft’s key platform, productivity and communications services will encrypt customer content as it moves between Microsoft data centers.
> · Strong cryptography to protect these channels, including Perfect Forward Secrecy and 2048-bit key lengths.
Microsoft already does each of these today (for sure Exchange and SQL, which I know the best), and they have done them for years now. Nothing changes. The more important question is how Microsoft manages the keys for this encryption, because when I was there the keys were still based on NSA-approved root keys...
I'm not a security guy, but isn't this just "cryptowashing" if there's a man from the NSA on the inside?
Yup. I'm trying to figure out if this PR move is for the sake of people like you and I, or if it is so salespeople have something they can point at when trying to sell licenses to foreign companies and governments.
Not necessarily - if you do the encryption on the client and only ever transmit encrypted data, then even an insider can not learn much about your data. But this may be difficult and/or impractical. You can not easily search your emails if Microsoft only stores an encrypted copy. It might work better for storing your files on SkyDrive. What we really need is practical fully homomorphic encryption [1].
[1] http://en.wikipedia.org/wiki/Homomorphic_encryption
[1] http://en.wikipedia.org/wiki/Homomorphic_encryption
As long as the source is closed, you'd never know if the private key is transmitted or not to the server.
yeah thats why this stuff is all questionable... supposed good intentions.
there was a good article recently that addresses this a bit better https://news.ycombinator.com/item?id=6833267
after a bit of reading about the topic you get more of a sense of how the PR machine is working since many big companies go the "no comment" route or just flat-out lie until they are finally caught red-handed. a statement from Microsoft (or anyone for that matter) doesn't really mean much unless they outline a technical methodology that can be thoroughly tested and verified by crypto experts/community.
Some might argue that it weakens the system by open sourcing it, but that's sortof the only way IMHO to get to a system that is based on actual crypto and information transmission theory and not just companies obscuring data with methods that will eventually be cracked.
there was a good article recently that addresses this a bit better https://news.ycombinator.com/item?id=6833267
after a bit of reading about the topic you get more of a sense of how the PR machine is working since many big companies go the "no comment" route or just flat-out lie until they are finally caught red-handed. a statement from Microsoft (or anyone for that matter) doesn't really mean much unless they outline a technical methodology that can be thoroughly tested and verified by crypto experts/community.
Some might argue that it weakens the system by open sourcing it, but that's sortof the only way IMHO to get to a system that is based on actual crypto and information transmission theory and not just companies obscuring data with methods that will eventually be cracked.
The NSA needs to put people back at ease, to make the Snowden story go away. What better way than to have Microsoft, Google and others make a statement like this?
Before using any Microsssoft product again, remember the parable of the Indian and the Snake: http://instereo92087.tripod.com/indiansnake.html
Before using any Microsssoft product again, remember the parable of the Indian and the Snake: http://instereo92087.tripod.com/indiansnake.html
good parable.
btw. oh wow, tripod is still around, nice to see some old websites
btw. oh wow, tripod is still around, nice to see some old websites
Microsoft is like the cheating boyfriend/girlfriend that always come back saying "I'm different now, I've changed!"
This is a good move - it increases overall security from illegal and quasilegal actors. "A rising tide lifts all boats". While it might prevent certain kinds of switcharoo ("let's exchange data on each other's citizens since we can't legally spy on our own citizens" maneuvers might be hampered), it still doesn't deal with an overly broad court order (c.f. Third Party doctrine). This does nothing against a duly authorized order from a legal entity. Those are threats that are very hard to deal with, in general. In order to ensure that privacy is maintained against overly broad and unreasonable legal searches, a non-technical (that is, political/legal) solution must be implemented.
edit: Microsoft has been one of the voices calling for legal reform. I respect that. It might be a PR move, but still... I'll take it. :-)
edit: Microsoft has been one of the voices calling for legal reform. I respect that. It might be a PR move, but still... I'll take it. :-)
"Code Transparency
In addition, Microsoft said it would enhance the transparency of its software code, helping to convince customers its products do not contain back doors. The company said it would go as far as opening a network of “transparency centers” designed to provide customers with greater ability to assure themselves of the integrity of Microsoft’s products. The centers will be opened across Europe, the Americas and Asia, Microsoft said."
Transparency centers, eh? Is that like a Microsoftian Ministry of Truth where inquisitors go to be reeducated?
In addition, Microsoft said it would enhance the transparency of its software code, helping to convince customers its products do not contain back doors. The company said it would go as far as opening a network of “transparency centers” designed to provide customers with greater ability to assure themselves of the integrity of Microsoft’s products. The centers will be opened across Europe, the Americas and Asia, Microsoft said."
Transparency centers, eh? Is that like a Microsoftian Ministry of Truth where inquisitors go to be reeducated?
What is a "transparency center", and what does it do?
Is that an office where you can sign an NDA and then read source code all day?
Is there a way that a company with closed source and proprietary infrastructure can prove that it's not up to any funny business?
Spideroak can, but only by opening up the client-side source code.
Is that an office where you can sign an NDA and then read source code all day?
Is there a way that a company with closed source and proprietary infrastructure can prove that it's not up to any funny business?
Spideroak can, but only by opening up the client-side source code.
"Is there a way that a company with closed source and proprietary infrastructure can prove that it's not up to any funny business?"
No.
No.
Anytime Microsoft comes up with their fake privacy promises one particular case always comes to mind: Mordechai Vanunu
http://en.wikipedia.org/wiki/Mordechai_Vanunu#cite_note-55
Microsoft is running an anti-Gmail campaign blasting Google for snooping on emails in order to serve ads. http://betanews.com/2013/11/05/microsoft-is-at-it-again-new-...
Microsoft is running an anti-Gmail campaign blasting Google for snooping on emails in order to serve ads. http://betanews.com/2013/11/05/microsoft-is-at-it-again-new-...
Microsoft first should make Bing to support, not even use by default, HTTPS.
Increase your security by trusting proprietary software to protect your data! Don't worry about the big, bad government. We'll make sure that we are the only ones spying on you.
words, just words.
It is not that complex, it is called "End the Patriot Act" or lobby for that. Until just telling your customer that they are being watched is against the law and they could go to jail for that, nobody should trust ANY American corporation.
And no, not all countries in the world have this kind of totalitarian laws. Yes, companies could give info about you to the government, but under court order, and those are public or private only for a small amount of time.
It is not that complex, it is called "End the Patriot Act" or lobby for that. Until just telling your customer that they are being watched is against the law and they could go to jail for that, nobody should trust ANY American corporation.
And no, not all countries in the world have this kind of totalitarian laws. Yes, companies could give info about you to the government, but under court order, and those are public or private only for a small amount of time.
Any word on when outlook.com will send/receive encrypted emails? Currently any time an email passes to/from the outlook.com domain it's in plaintext.
I don't know why Microsoft are bothering with this. The 'I have nothing to hide' crowd could not care less and those that are quite fascinated by everything NSA are not going to ever believe that Microsoft are anything but evil.
The funniest Microsoft story for me was the one regarding their former security chief. Nowadays he won't use Microsoft products or anything else where he can't see the source code. Until such time as Microsoft open source the stuff they churn out then all one can do is 'believe' them to be good and, after finding out how in bed they are with the military-industrial-complex, I just do not trust them.
The funniest Microsoft story for me was the one regarding their former security chief. Nowadays he won't use Microsoft products or anything else where he can't see the source code. Until such time as Microsoft open source the stuff they churn out then all one can do is 'believe' them to be good and, after finding out how in bed they are with the military-industrial-complex, I just do not trust them.
This may be a marketing campaign to reassure their international customers, in particular governments and other large organizations.
But those are exactly the customers who won't believe you anyway???
I'm not saying that these customers don't have justification for their paranoia... just saying that there is an extremely high probability that Brazil, or Indonesia, or Statoil are planning to phase out use of American software over time in any case. In fact, it's so plainly evident that surely American tech companies should already be factoring it into their strategic planning???
Why not try to create some new customers? Or do something that doesn't rely on foreign organizations to trust, or use your software?
I don't know what that would look like... but that's why they get paid the big bucks.
I'm not saying that these customers don't have justification for their paranoia... just saying that there is an extremely high probability that Brazil, or Indonesia, or Statoil are planning to phase out use of American software over time in any case. In fact, it's so plainly evident that surely American tech companies should already be factoring it into their strategic planning???
Why not try to create some new customers? Or do something that doesn't rely on foreign organizations to trust, or use your software?
I don't know what that would look like... but that's why they get paid the big bucks.
I wouldn't trust them either. I've seen the source via Shared Source and the CSP stuff is missing from it. If it wasn't missing they wouldn't have something to hide.
Ok...more protection against breaches, but what about the stuff they are giving willingly? Until any of these big companies start getting serious about end to end encryption, I can't take them seriously. It's just PR at this point - or rather PR damage control, after the leaks.
Another big change for me would be if Microsoft announced that they stopped giving NSA lists of fresh Windows vulnerabilities before they even start working on them. Until they stop doing that, this is all pointless.
Their policy should be: "either everyone knows about the vulnerability, or nobody does.". Whatever argument they had before about "responsible" disclosure, is all moot now that we know they're disclosing those bugs to NSA in secret anyway.
Another big change for me would be if Microsoft announced that they stopped giving NSA lists of fresh Windows vulnerabilities before they even start working on them. Until they stop doing that, this is all pointless.
Their policy should be: "either everyone knows about the vulnerability, or nobody does.". Whatever argument they had before about "responsible" disclosure, is all moot now that we know they're disclosing those bugs to NSA in secret anyway.
Encryption does not mean anything until you reign-in law enforcement powers.
[deleted]