Posts by tom dial

Privacy warriors haul NSA into court, demand swift end to mass call snooping

Re: Can we haul GCHQ into court?

@Wowfood: Do you really believe everything you read on the Internet and in newspapers and hear on the TV and radio?

Snowden: Hey fellow NSA worker, mind if I copy your PASSWORD?

Re: But I don't need their passwords...

"Alternatively, I could provision a smartcard with their certificate on ..."

I am not sure that is possible in a USDoD agency for a lone administrator to do this. In the agency that employed me Common Access Cards are issued only in the security office, and programmable by equipment located there and online with a remote database that probably is used to verify the identity of both the issuing agent and the applicant; the processing would cancel the existing card and provision the new one with a new certificate. I believe the equipment used is physically inaccessible from the agency LAN. It is conceivable, however, that the old certificate revocation could be delayed for a short period, during which the authorized user would not be aware of the compromise. I am pretty sure that there was a hard line between those who could administer system and those who could issue CACs.

It seems doubtful that an SA would be able to generate a certificate, with the proper signatures, and install it properly to the network.

Berners-Lee: 'Appalling and foolish' NSA spying HELPS CRIMINALS

The problem with Dual_EC_DRBG in BSAFE was public knowledge (in Wired) in 2007, including the possibility it was inserted by NSA. Shame on RSA if they left it the default for 6 years, but one would have hoped professional users of cryptographic libraries would have taken notice and avoided it.

Criminals and terrorists may find the techniques of Stuxnet somewhat useful, but (a) lack of such knowledge didn't, as such, appear to impede them much before it became available, and (b) the authors, whoever they might be, might well have prepared to defend against it.

Spying on UK citizens by UK agencies certainly should be done in accord with UK law. It is quite silly, though, to expect a foreign intelligence agency to follow local laws. They're spies, after all.

As for relative access by foreigh/home grown security services to UK citizens' private data: that could be taken two ways, the likelier of which in practice would be to give the UK security agencies unfettered access, because that's what the foreigners have, constrained only by their consciences and the probability of being caught.

Jack Dorsey in IPO talks over payment platform Square - report

Square, unlike Twitter, has a real product/provides a useful commercial service. On the other hand, they would appear to be quite vulnerable to direct competition from the credit card services on which they depend.

Crowdfunded audit of 'NSA-proof' encryption suite TrueCrypt is GO

Re: Still not "secure"

Nobody should have been using RSA-1024 (or less) any time recently, and I seem to recall that RSA-2048 becomes standard at the end of this year. RSA-768 was reported broken in 2009 - in about 2.5 years - and the authors projected that RSA-1024 might be solvable by their methods around 2020. RSA-2048 or larger should be good as long as I care about keeping my secrets.

RSA-1024 was reported cracked by a server attack based on creation of controlled power faults. Feasibility of a brute force attack is doubtful.

Apple: How we slip YOUR data to govts – but, hey, we're not Google

Re: Who's freaking who?

Theft of mobile devices is not terrorism, and the article does not describe it as such. Apple describes the device requests as arising from accidental loss or the perfectly ordinary criminal activity, both of which can lead to perfectly ordinary and legitimate police inquiries. Trash Apple and the governments for the things they did that were wrong, not those they did right.

Re: Who's freaking who?

Corrections:

"If it was democratic everybody would have a vote". Generally, only citizen are allowed to vote, and I expect that is the general rule in all democratic regimes; children, however defined, also are not generally eligible to vote, and those adjudicated mentally incompetent or convicted of serious crimes often are ineligible. Contrary to the unstated accusation, essentially all others in the US are eligible to vote, and around half of them actually do so. The present flaps over registration, voter ID laws, and gerrymandering are largely political theater on both sides aimed at gaming the system for partisan advantage.

While I think the facts favor manual pen ballot completion over voting machines of any type, and it has been established that the Diebold and other electronic voting machines have vulnerabilities, there is little or no evidence Diebold or orther manufacturers such as Election Systems and Software have acted to affect election outcomes. It's worth noting, too, that the now-preferred optically scanned ballots are, in the implementations I have dealt with, as dependent on uncorrupted software as the touchscreen voting stations.

The Electoral College was established because the electorate as a whole was thought likely to be ill informed and unduly swayed by emotion (see Federalist # 68 for a discussion). While this intent has been undermined by legal and technological changes, some might consider the rise of Tea Party Republicans as clear evidence the framers were quite correct. As an aside, "it's the electoral collage that really decides things" overstates the President's importance in the overall structure of government, an understandable error when the legislators have allowed or encouraged growth of the executive branch to the size it has reached.

The Schmidt hits the Man: NSA spying on Google servers? 'OUTRAGEOUS!'

Re: Ha ha ha

While I am not a fan of some of NSA's undertakings, I also am not aware of any instance of police turning up at someone's door because their web browsing activity was referred by the NSA. The story to that effect that turned up early in the current series of revelations turned out to have been referred by a former employer. Indeed, there was a noticeable amount of blathering after the Boston Marathon bombing to the general effect that the Tsarnaevs' activities ought to have been caught by network surveillance but were not.

BitTorrent seeks patent on distributed storage technology

Re: is this novel..?

It appears, perhaps unfortunately, that the original claim was filed February 3, 2009, preceding the dates for both Net::OnlineCode and Crypt::IDA. Superficially, that would seem to preclude their use as prior art, but perhaps they would be useful to dispute the Bittorrent's claim that the invention was non-obvious and was produced independently by one normally skilled in the applicable arts.

Here's what YOU WON'T be able to do with your PlayStation 4

Re: Storefront Technology

Perhaps companies with management focus on the next quarter and next fiscal year bottom line tend more than they rationally ought to treat the enterprise as "manufacturing" process in which consumers are an input resource. This would lead naturally to vertical integration actions intended to ensure that the resource is is kept available for continued exploitation using such things as manufacturer specific hardware and software standards, and now locked down software stores. This is not materially different from vendor lock in as practiced, for instance, by document management system vendors who store the metadata using proprietary database schemas and thereby raise the cost to purchasers of switching to a competing product. Apple began it in the PC environment, I think, with or shortly after the Apple II, with longer run result of helping IBM, and the clone makers enabled by the open standards, to dominate the desktop market ever after. Based on sales figures, the same may be happening now with Apple/iOS v. Google/Android.

Sony and Microsoft seem to be trying the same approach. We've seen what happened to the Surface RT; it was not good, and I haven't seen reports of impressive Surface 2 sales. Apple seems still to be enjoying a healthy revenue stream, but from a declining fraction of the cell phone and tablet markets. Treating customers as cattle to be milked may have limitations.

SR-71 Blackbird follow-up: A new TERRIFYING Mach 6 spy-drone bomber

Re: As an intellectual and technological excercise...

You forgot to mention the digital computer.

iPad Air peels off in racy pics for wide-eyed geeks, reveals 'worst battery ever

Re: Is there anybody who approves of this?

Company planned UNupgradability: Apple, and some other vendors design these devices to be difficult or impossible to upgrade to ensure a market for the new devices to be issued in a year or two.

NSA, UK hacked Yahoo! and Google data center interconnects – report

Re: different how?

1. Government officials, in their official capacity, often are allowed to do things that citizens acting privately (including government officials when acting privately) are not. Today's New York Times published a story this morning about the Putnam County District Attorney who participated actively in a friend's criminal defense, which was being handled by the DA in Westchester County. The participation appears not to be turning out well for him.

2. The NSA and GCHQ have not, as far as I have seen reported, actually published the data they collected or even looked at most of it, while those being prosecuted seem to have done so.

Re: You Missed The Real Story

It occurs to me on further reflection how astonishing it is that designers who presumably are technologically competent failed to encrypt all links that were not within their direct physical control. The DoD, often and often incorrectly written off as technological boobs, has been encrypting transfers among its data centers for years - and that's on the unclassified network.

Re: The curtain raises.

Indeed, this seems much the same, in principle, as was the case when a good deal of communication was sent by radio and microwave links or a handful of undersea cables, and governments (and other interested parties) could, and doubtless did, capture and analyze the traffic. Much of the difference is that both the traffic and the capability to grab and analyze it have increased by 6 -9 orders of magnitude (maybe more).

Re: You Missed The Real Story

It seems fairly evident from the diagram that Google is adding and removing the SSL at its "premise" routers. If NSA/GCHQ have access to those through a split fiber in the carrier's territory, they have access to the plaintexts. I thing Occam's razor applies here. It may be possible that they "borrowed" Google's private certificate, or deduced it from the the public parts, but the simplest answer also is the most plausible. It also is supported by Google's statement that they will be encrypting internal transfers as soon as possible.

Ohh! The PRECIOUS! Give it to uss. We WANTS it: Shiny iThings coming in 2014

" However, we have devices made of the best (mostly) and we have customer service second to none."

Both of my children, I think. would say that not only is not true, but that Apple design, build, and support all are far less than the prices would warrant and in fact grossly unsatisfactory, and that they have Apple computers only because they want to use specific software for which an alternative-OS version is deficient or does not exist.

Google rivals GAGGED from exposing ad giant's EU search peace offering

Every month or two I run a test using the exact same query in Google, Bing, and usually Yahoo. In every case over the last few years Google has provided the most useful results. In a few, Bing has been as good. Yahoo always has been at the back, and noticeably so. I avoid price comparison sites, having found them not very useful, and increased my aversion to them after one managed to become my browser startup page.

Distinguishing Google's ads from others and from genuine search results can only be a problem for the terminally inattentive. Constraints based on the pleas of rent-seeking whiners can only cause its utility to deteriorate. If, as I suspect, others can ignore the ads easily, it will not help them greatly in the end anyhow.

My suggestion to Google is that they flag entries that result from dictated algorithm changes as they identify paid content now.

Why Bletchley Park could never happen today

Re: No war

For the sake of argument, does that lack of much terrorist activity indicate that NSA et al. activities are unneeded, or does it follow from their success? It is worth noting also that whether there is "much of a terrorist problem" is location and situation dependent. Perceptions in Iraq, Afghanistan, or Pakistan might well differ from those in the US or UK.

That said, the type of data collection being done cannot prevent all terrorist attacks or even the worst. At best it can improve the ability to identify, track, and capture those who have committed terrorist acts or are planning them, but only if carried out a scale like that being reported. And it is most likely to succeed against terrorists who are not very bright, not very careful, or not very skilled at their chosen occupation. We are correct to doubt that marginal gains in the ability to track and catch terrorists (and other criminals) warrants the expense, and the general creepiness, of these programs, as well as their potential for serious misuse. Our elected officials, eyes fixed firmly on the daily news cycle and whose long term concern is the next election, have done a rather poor job representing us.

Apple handed Samsung-busting nuke after Steve Jobs patent U-turn

Re: God not again.......

Upvoted. But I have to take exception to this:

"Software only copyrightable again and then only what is not open...."

Copyright, at bottom, is what protects the GPL and its successors and derivatives. So copyright needs to apply to open equally with closed source.

Apple, and a great herd of other rent seekers, great and small, would fight such a thing first in the legislatures, then in the courts, and then in the fields and streets... The will never surrender.

Internet Explorer 11 BREAKS Google, Outlook Web Access

Re: Junk is

Why would you think they found out about it after release?

I had a search yesterday and found that Bing's results were MUCH superior to Google's - until I noticed that either Microsoft or Firefox had replaced my default search engine with ask.com. Fixing that put the world back in order with Bing giving very good results but Google's slightly, but noticeably, better.

But I will be upgrading to Windows 8.x when I replace the laptop with a new one that doesn't come with Windows 7 downgrade rights and a factory installed Windows 7. I never have understood those who fork up good money to Microsoft (or Apple) to upgrade a perfectly usable and currently maintained OS; or, for that matter, the businesses who, even if the new OS is covered by an enterprise license subscription, incur the internal expense and user pushback.

NSA reporter leaves paper for eBay billionaire backed media biz

Re: One is left to wonder whether he'll share any with Snowden.

I wonder who is paying his room and board right now. Booz Allen probably not, and I would guess he has trouble making savings withdrawals. Who better than Glenn Greenwald, who appears to be the big winner here for not a lot of work and little risk?

Greenwald seems to have feathered his nest rather nicely. One is left to wonder whether he'll share any with Snowden.

MPs to review laws on UK spy-snoopery after GCHQ Tempora leaks

Re: Why didn't he answer the question?

Assuming MPs are similar to US Senators or Representatives:

- almost all of them can plausibly (for the constituents) deny knowledge at no real cost, as the programs are classified;

- a "yes" answer would be equivalent to admitting outright that they didn't look after their constituents' interests.

The correct answer is obvious, and has no truth value at all.

Re: Синий зеленый SundogUK Hmmm... not sure where to begin with this...

In the US (and I think also the UK) companies, like natural persons, are entitled to a presumption of innocence in any criminal proceeding.

Although violence associated with Occupy * groups was uncommon, it was not entirely absent, and not all of it was initiated by the police. It also is not unknown for subgroups in a mainly peaceful large group to have discrepant motives and intent to guide the larger group in ways that not all members would favor, so classification of the Occupy groups as peaceful, while still considering them to be a threat. From a police perspective, every crowd presents a threat of possible violence, even if because of a potential mass panic.

Re: @ Matt Bryant Hmmm... not sure where to begin with this...

Benjamin Franklin surely was wise enough to recognize that between individuals rights might come into conflict, and for the same individual, different rights might occasionally be in competition, and that whether a particular liberty is "essential" might depend some on circumstances.

In all of the discussion about collection of communication data by the NSA and (occasionally by other SigInt agencies) the connection between collection and analysis of the data and sacrifice of liberty is left extremely vague, perhaps intentionally so as to avoid the need to think hard. There is an enormous difference between collecting, storing, and analyzing communication metadata, most of it not personally identifiable, and constructing individual dossiers on the whole of the population for use at convenience in controlling them. For all the yelling there is little or no evidence that the NSA or other SigInt agencies engage in the latter or, for that matter, assist internal police type agencies in doing so. Passing information to the FBI or DEA, as has been reported, would be inappropriate under the NSA authorization if it came from a purely domestic communication, but might be OK otherwise. Whether the evidence obtained thereby would be admissible in a criminal trial would be for the trial court to decide if it were questioned. I suspect DEA were told to find alternative explanations primarily to sidestep a possible need to expose classified programs in open court proceedings.

Re: SundogUK Hmmm... not sure where to begin with this...

Police being police (and the FBI is a kind of police), they will keep an eye on activities they think might lead to disorder. That will include, in the normal course of events, planting undercover agents, if they can, in what appear to be organized groups that they think might bring about disorder. And they may pass warnings to those they discover are targets of such activities or groups. They also will attempt to prevent disorder, although the comment fails to mention it, e. g., if it appears inflamed opinions may lead to violence or property damage. That is, after all, why we hire them.

To prevent abuse, there are internal controls, and when those fail there are prosecutors and courts.

It's not a perfect system, and likely is improvable, but there is no news here except in some of the details.

Re: AC @Matt Bryant

There is a logical problem here: success cannot be proved, but failure can. If a planned attack is identified based on analysis of collected data but did not occur, it may not be possible to prove that it did not occur "because of" the data analysis. In addition, if such analysis identifies potential attackers, and consequent police activities alarm or divert them, there is likely no way to claim reasonably that the snooping was beneficial. On the other hand, if an attack occurs, and indications of the preparation later are found in the collected data, that constitutes proof of failure.

As for the Boston bombers, your point is not clear. The FBI investigated Russian warnings, and the investigators concluded, incorrectly as it happened, that they had no basis for further action and no justification for surveillance - thus respecting the Tsarnaevs' civil rights. Similarly, there would have been no reason for the NSA to target their communications, and while absence of evidence is not evidence of absence, no indication that they did so.

My recollection is that the Afghanistan and Iraq wars followed after the 9/11/2001 terrorist attacks in the US.

Re: The words of Thomas Jefferson come to mind...

Those words, apparently widely current in the English colonies during the lead in to the American Revolution, generally are attributed to Benjamin Franklin. However, both Franklin and Jefferson thought too subtly to allow a single brief quotation to state their full belief about anything.

Another Franklin quote that, in the context, might be relevant: "For having lived long, I have experienced many instances of being obliged, by better information or fuller consideration, to change opinions, even on important subjects, which I once thought right but found to be otherwise."

Re: Hmmm... not sure where to begin with this...

Your individual right to privacy may be paramount. Would you have said the same about the individual right to privacy of those who left backpacks full of explosives in the London subway on 7/7/2005 or those who carried out the recent attack on the Westgate Mall in Kenya, the Spanish train bombings in March, 2004, or the Beslan school massacre in September of the same year?

I make no claim that these atrocities could have been prevented but for inadequate surveillance and insufficient sifting of inadequate data. Such claims are mostly rubbish. However, the claim that your privacy (or other) rights, and, by extension, mine and everyone else's, are not subject to limits is equally rubbish.

We establish (US) or allow (UK) governments partly to establish and enforce those limits. That they do not always do so to everyone's satisfaction is certain. That they begin to act like rulers more than agents of the electorate is, to a large extent our fault in choosing those who represent our interests, watching them to ensure that they continue to do so, and electing their successors when they fail. As a wise 'possum once was quoted "we have met the enemy and he is us." I suspect that part of the anger about intelligence agency data collection derives from the unmentioned recognition of this fact.

NSA boss Alexander and deputy to take a hike next year

Re: No going back

Too much of what is put out as analysis, and too much of the commentary assumes as obvious that which is untrue: that the intelligence agencies operate in a vacuum independent of external controls and keep their activities secret from other parts of the government. It surely is true that there is some of this, and that there is jockeying among the agencies for funding and status. But in the main, it is untrue, now with the NSA as it was since the '50s with the Iranian and other coups, the Bay of Pigs invasion, the Gulf of Tonkin incident, and other similar matters. The activities were known to the responsible Cabinet officials, legislators on responsible committees, and, many times, to the President. They might not have been known in all their gory detail, partly due to agency inclination to shelter bosses, maintain flexibility, or avoid appearing pessimistic or bearing bad news; and partly due to supervisory reluctance to know too much, or to hear opinions that were either negative or differed from their preconceptions.

The NSA operations were governed by laws Congresses passed and Presidents signed, were subject to the authority of the Secretary of Defense, detailed rules from the Attorney General, supervised by Senate and House committees and the FISC. The published leaks suggest they were at least moderately forthcoming to the FISC, and they took some chastisement for misinterpreting and exceeding the rules under which they were authorized to operate. Discussing the NSA as a rogue agency operating on its own usurped authority both misstates the problem and does injustice to the NSA and its employees. Any solution will have to take into account that it is widely dispersed, that there is plenty of blame to assign, and that landing on the NSA (or FBI) is a lazy cop-out.

Re: Rearranging Deck Chairs

To dismiss as "semi-literate thugs" the men and women, both civilian and military, who staff NSA and like agencies would be a serious error. On average they probably are well above the mean in intelligence and do not differ from a cross section of Americans in matters of ethics. To assume further that they do not understand networks and network security also would be an error (although they seem to have been somewhat lax personnel security matters).

Another gross error is to assume that dispersing governance of the logical structure of the internet will somehow make it more robust and secure. It will not. Dispersed governance will have little effect on the physical internet which, in fact, is quite robust and has security that is heavily dependent on who has physcal access to the hardware components.

Those wishing to control the internet, including through such devices as DNS and root certificate subversion, are more the politicians, free enterprise criminals, anti porn militants, and the likes of MPAA and RIAA than they are intelligence agencies which mainly want unfettered access to the physical internet. The instance of internet control that come readily to my mind are Iran, Egypt (during the Arab Spring) and the seizure of the Megaupload servers on dodgy warrants, none related in any way to NSA activities.

The management goofs that allowed Snowden to probe and copy widely, and remove the material, are justification enough for the departures. Others, at lower levels, will retire or be reassigned or have done so already. For a variety of reasons, the last few weeks of December and the first week of January are popular for civil service retirements.

"The departure of General Keith Alexander, the former US Army officer who has served as the NSA's director for that last eight years, and his civilian deputy would potentially allow the Obama administration to introduce reforms of the NSA ..." This from the administration under which the alleged abuses were greatly expanded and extended? Stunningly naive.

Divorcing ICANN and the US won't break the 'net nor stop the spooks

To put it bluntly, whether or not ICANN and IANA operate within the US will have little or no effect on snooping by the NSA, the other Five Eyes participants, Russia, China, Israel, Iran or,indeed, quite a few others. Agitation to remove them from US "control" is pretty meaningless posturing.

Those who are so fired up about the awfulness of what the NSA is doing should know by now that it is replicated by GCHQ, CSEC, DSD, and GCSB; and they might wish to consider, at least, whether they would have more privacy in Russia (Spetssvyaz), China (Third Department of the General Staff), or even Switzerland (NDB). I don't like it, any more than I like taxes or getting old, but doubt that any of them will go away except that eventually I will stop getting old, and like that prospect less. In the meantime I will know that the authorities and quite a number of commercial entities can watch me if they like and I will use available technical and nontechnical means to limit their intrusion as seems worthwhile.

Brazil's anti-NSA prez urged to SNATCH keys to the internet from America

I find it difficult to see how globalization of ICANN or IANA will noticeably affect any of the activities of which the NSA is accused, or for that matter those of GCHQ, DSD, GCSB, or (yes, Mr. Pott) CSEC. Neither will it much affect similar activities of the great multitude of other signal intelligence agencies across the world. Such agencies operate on the signalling infrastructure at a level where addressing and routing are information to be processed and control over who assigns the numbers probably is not especially necessary. The globalization might have the salutary effect, as someone noted earlier, of making it more difficult for US rent seekers to inconvenience those they claim promote copyright infringement.

Anyone who thinks taking down the NSA is likely, that doing so would have much affect on internet snooping by government agencies, or that it would be noticeable by many people is seriously mistaken. Ms. Rousseff, while justly angry, might find it more beneficial to look into what is happening to the Brazilian economy and on the streets of Rio de Janiero.

Electronic Frontier Foundation bails from Global Network Initiative

I call BS on "It has become clear that affected companies are unable even to talk about secretorders they have received from the US government." That has been common knowledge since the PATRIOT Act was passed in 2001 or 2002, and the EFF itself filed a lawsuit in 2011 against National Security Letters (which it won last March). Recent events may have caused them to feel embarrassed, but EFF's pretending any degree of surprise or shock is disingenuous, at least, and decreases my respect for them.

NSA tactics no better than a CYBERCRIME GANG, says infosec'er

Re: Continuous manipulation

"Moscow are less of a threat to freedom than the NSA these days."

That is naive, gullible, dreaming; it is no more (or less) true now than it was six months or a year ago. You are, of course, entitled to choose who you must assume to be reading your mail, but you have no guarantee that the NSA or GCHQ are not also doing so.

Re: Sir

All totalitarian regimes act much the same way; the ideology, whether Communist, Fascist, or Islamist, mainly provides a framework for deciding which activities to monitor and suppress.

There is no reasonable basis to classify as totalitarian the regimes in the US, Great Britain (and the other EU countries), Canada, Australia, and New Zealand, among others.

The NSA and its Five Eyes associates are military intelligence agencies, generally doing what such organizations do. The US NSA (and CIA and DIA), at least, are foreign intelligence agencies. Like such agencies in all countries they operate mostly in secret and must do so to be effective. We should not be surprised that their methods sometimes are unsavory and would be criminal if used domestically; many are criminal in foreign jurisdictions where US law permits their use. Oversight by agency management, courts, and congressional committees may have been inadequate, and need to be reviewed and probably improved. But individual actions of civilian and military employees of the agencies are not "public" any more than those of employees in any other government agency. It is the elected officials, in both the executive and legislative branches who are accountable to the electorate, not the individual agency employees or even the appointed government officers.

Re: Finding terrorists

It is a bit hypocritical to attack a government agency for doing something it should not be doing, and then whine that something bad happened that could have been prevented if only they had been doing the thing that they should not be doing.

Stallman's GNU at 30: The hippie OS that foresaw the rise of Apple - and is now trying to take it on

Re: Now if only they'd clone a decent operating system

Another possibility is that keeping other OS alternatives proprietary has held them back even though they might have been better by some widely agreed standard. Plan 9, for instance, from the Bell Labs CSRG that developed Unix, might have gained a larger following if it had not been encumbered by a restrictive license through the first two or three editions.

In practice, though, I think the real answer lies elsewhere. CP/M80 and MSDOS did not win share because of technical merit or licensing, nor did Windows. ZCPR was undeniably superior to CP/M, and probably CPM86 was superior to the initial MSDOS. Windows before NT was trash next to either Unix or OS/2. But CP/M80, MSDOS, and Windows ran on available (and affordable) equipment, and did it well enough to meet the demands of those who paid the bills.

Web Daddy Berners-Lee DRMs HTML5 into 2016

HTML & DRM

Although I loathe DRM, that won't likely prevent it; there will be media distribution with various kinds of DRM attached. It may be that the question worth answering in the context is whether there should be a standard agreed on way to stream DRMd medial. Given a choice between having to manage a number of extensions produced by the media vendors individually and a coherent framework, maybe with the extensions from the browser developers, I have no trouble deciding. The EFF is a fine organization, but they aren't going to win on this one, whether or not HTML5 has EME. And as little as I trust Google, Microsoft or Apple, I trust them much more than the RIAA, MPAA and their ilk, which I assume would include Sony, purveyor of rootkits.

Hollywood: How do we secure high-def 4K content? Easy. Just BRAND the pirates

I find it interesting that of the first 50 or so comments, all those favorable to newer and harsher DRM are posted anonymously.

It appears to me that the consortium is trying to bridge a gap between actually selling something concrete, as a DVD or BD disk, for instance, and a restrictive license to use, like Microsoft. However, the last I looked, Microsoft would sell a copy of Windows that could be transferred to another machine, at least. I don't use the product and didn't have the stomach to read the EULA to see if you could transfer the software to another user. It would be interesting to know what provisions the DRM has for evaporating in the unlikely case of copyright expiration or rationalization of the copyright laws, or for the much more likely case where the device with the TPM fails.

You don't really own something you can't transfer freely, including the cases where a captive "store" exercises monopoly control over selling/reselling or you may not use it as you wish. The producers should be able to protect "their" content as a contract matter in whatever way they wish, including encryption and watermarking, and to enforce their contracts in civil actions, but it is not at all clear that they should be able to enlist the government's ability to use force and imprisonment to do so. They are few and we are many, and in a democratic regime that ought to count for something. And if the proposed methods approach the effectiveness the producers wish, there may no longer be any need for government granted copyright on this material - the technical means would allow the studios to prevent most unauthorized copying and identify successful contract violators so as to bring them into civil court. There would not be a need for governments to allocate public money for the private benefit of the private organizations that might (or might not) have been damaged by unauthorized copying of digital data.

NSA using Firefox flaw to snoop on Tor users

Re: Dreddful situation

"'WE ARE THE LAW!!!' The NSA said."

This is quite untrue and seriously misstates the problem, to the extent there is one. NSA activities, in the main, are authorized by numerous laws passed by US congresses, signed by US presidents, and subject to supervision, in the area of data collection, by US courts composed of Federal judges nominated by presidents and confirmed by the Senate. The Senators and Representatives on the responsible committees were privy to most of it (or would have been had they taken the trouble) and mostly approved it without comment, at least until it became a bit of an embarrassment. And the overwhelming majority of voters are so uninformed or care so little that all of this has gone on for over half a century with little objection.

Most of the outrage about alleged NSA unlawful and unconstitutional actions is mere opinion, and much of it is not very well informed and contributes little to a reasonable discussion of the proper limits of government power. In the world as it is, as opposed to the way we might wish it, there is a clear need for police and military agencies and with them intelligence agencies. That need is not going away anytime soon, and we need to arrive at a reasonable agreement about what they are to be allowed to do and what controls are to be emplaced to try to prevent misbehavior. The Patriot Act, the FISA and FISC, and various NSA internal controls that have been revealed by Snowden's leaks or declassification represent one possibility, but only one. Those who disagree need to address alternatives rather than simply whining about the evil intelligence agencies.

The authority probably is to be found in the defense authorization acts, as NSA is, after all, a component of the US DoD. Their mission includes both developing and breaking cryptographic systems, and the latter activity historically has included subverting them as well as developing technical attacks on the ciphers. Lack of authorization is not a problem here.

'The NSA set me up,' ex-con Qwest exec claims

Re: 100% true

I've served on a few (US) juries, and doubt very much that an average jury would return a guilty verdict on this story. Mr. Naccio's refusal to authorize Qwest participation in the post 9/11 Bush administration wiretapping is commendable, but his sales of Qwest stock in early 2001 probably had little to do with wiretapping that the New York Times reported to have been started after 9/11.

The Times articles, though, are interesting to read in the present context of agitation over the NSA: much of what is Simply Shocking now was, in fact, reported fairly explicitly in late 2005 and 2006. Also reported was significant concern by FISC judges, and one resignation, over whether the actions then were lawful or in compliance with the Constitution. And then, as now, the President "welcomed" discussion.

NSA in new SHOCK 'can see public data' SCANDAL!

Re: With all due respect this started under Bush

With due respect, this started well before "Dubya's watch", probably before 1950.

Google FAILS in attempt to nix Gmail data-mining lawsuit

Re: Oh the expections of the 'customer'

In the US, the USPS photographs every letter. I believe this may be followup on the anthrax letters in 2001. And, as others have noted, anything you put on a postcard may be read by a number of people you don't even know on its way to delivery, just as an unencrypted email may be scanned by a number of systems (and read, possibly, by the administrators of those machines and others with less authorization.

The analogy I prefer is "a sender of a postcard cannot be surprised if the postman has a little read on the way to putting it in your mailbox." Google, with probability not significantly different from 1, does not read through encrypted email (the equivalent, more or less, of a letter in a sealed envelope), and even the NSA and friends probably almost never try to do so unless it is to or from a specific intelligence target.

Plain text email messages are open to scanning by many others than the email service providers, and most or all of those others are more to be concerned about than Google. How many routers pass along the average email message? Almost all of them have management ports available to administrators (not all of them possessed of high ethical standards), and potentially accessible by law enforcement officers, hackers of varying motive, and spies of various origins. Jumping on Google, which openly admits to scanning the email it processes, does nothing meaningful about the real problem.

Re: @BiscuitBoy Whatever happened to the concept of

My ISP's spam filter handles mail for a large number of customers. Yours likely does the same. Not being a Google (or Yahoo?) user I don't know the implementation of their database, but I question whether they trouble themselves to maintain a database targeting ads to non-customers.

They probably also don't succeed very well scanning PGP or GPG encrypted email, so that's an option, although it might interfere with web access.