Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

It honestly wouldn't surprise me if the gov't has issued a secret subpoena for every PRISM provider's SSL key (e.g. Google/Facebook/Yahoo/etc). That way they get to claim "hey, we're not giving them full access" and the government gets what they want anyway.


Me neither. Thing is, using PFS modes (like, DHE or ECDHE), even a server key compromise won't let you decrypt passive intercepts.

Google started using these for their TLS setup about a year ago, and it's smart. They blogged about it, hoping others would follow suit.

I wonder if perhaps that change, and blog post, were their way of saying without saying.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: