zlacker

>>Fabian+(OP)
THESE DOCUMENTS CONTAIN EVIDENCE OF ATTACKS ON VPN, SSL, TLS, SSH, TOR. What do we do now? No seriously, what do we do?

The full list of documents: http://www.spiegel.de/international/world/nsa-documents-atta...

The accompanying lecture: http://streaming.media.ccc.de/relive/6258/

Also, obligatory: https://eff.org/donate

>>diafyg+S1
Earlier this year at goto copenhagen I heard a good talk by Tim bray:

http://gotocon.com/cph-2014/presentation/Privacy%20and%20Sec...

Where he argues that even though we can not achieve complete security there is great value in raising the bar. If we continuously make it increasingly harder for NSA, MOSAD, GCHQ and the rest of them to spy on us, we can achieve good enough privacy. Where most communication will be secure. But he also argues that if one of these agencies really wants to target YOU specifically they will get to the information. By breaking into your house and installing cameras, if necessary.

>>freedu+z4
>If we continuously make it increasingly harder for NSA, MOSAD, GCHQ and the rest of them to spy on us, we can achieve good enough privacy

Good enough privacy is no privacy.

Anyway, this is completely the wrong mindset. This is a legal problem which requires, not pretty good tech, but clear, strict laws, with whistle-blower protection. We have to stop ceding that this is legal or should be legal.

Otherwise, we've already lost.

>>uncleb+9f
Why would laws be sufficient? There are plenty of people who would like to do the same things the NSA would like to do who are not concerned with laws. As Schneier says, "today's top-secret NSA programs become tomorrow's PhD theses and the next day's hacker tools."

Changing economics by deploying more PFS ciphersuites and shifting to technology which requires active attacks instead of passive ones can give real, practical improvements in privacy, even against state actors.