Twitter Takes Steps To Frustrate NSA, Other Government Snoops

TwitterTwitterTwitter announced Friday that it's joining other tech companies in implementing "perfect forward secrecy." While many online services already encrypt user comunications and other data, this form of encryption ensures that snoops—we're looking at you, National Security Agency—who break through the encryption get access to only a snippet of data, rather than everything belonging to a user. Even where a warrant is involved, perfect forward secrecy has the potential to limit intrusions, rather than acting as an open-ended skeleton key.

From Twitter's Jacob Hoffman-Andrews:

As part of our continuing effort to keep our users’ information as secure as possible, we’re happy to announce that we recently enabled forward secrecy for traffic on twitter.com, api.twitter.com, and mobile.twitter.com. On top of the usual confidentiality and integrity properties of HTTPS, forward secrecy adds a new property. If an adversary is currently recording all Twitter users’ encrypted traffic, and they later crack or steal Twitter’s private keys, they should not be able to use those keys to decrypt the recorded traffic.

The Electronic Frontier Foundation's Parker Higgins describes how perfect forward secrecy works:

How can perfect forward secrecy help protect user privacy against that kind of threat? In order to understand that, it's helpful to have a basic idea of how HTTPS works in general. Every Web server that uses HTTPS has its own secret key that it uses to encrypt data that it sends to users. Specifically, it uses that secret key to generate a new "session key" that only the server and the browser know. Without that secret key, the traffic traveling back and forth between the user and the server is incomprehensible, to the NSA and to any other eavesdroppers.

But imagine that some of that incomprehensible data is being recorded anyway—as leaked NSA documents confirm the agency is doing. An eavesdropper who gets the secret key at any time in the future—even years later—can use it to decrypt all of the stored data! That means that the encrypted data, once stored, is only as secure as the secret key, which may be vulnerable to compromised server security or disclosure by the service provider.

That's where perfect forward secrecy comes in. When an encrypted connection uses perfect forward secrecy, that means that the session keys the server generates are truly ephemeral, and even somebody with access to the secret key can't later derive the relevant session key that would allow her to decrypt any particular HTTPS session. So intercepted encrypted data is protected from prying eyes long into the future, even if the website's secret key is later compromised.

Facebook also plans to implement perfect forward secrecy, and Google has had it in place since 2011. Google points out that "not even the server operator will be able to retroactively decrypt HTTPS sessions," meaning that companies that implement the security can't turn users' lives into open books, no matter the pressure they face.

As fuck-yous to the surveillance state go, this is both welcome, and effective.

Editor's Note: We invite comments and request that they be civil and on-topic. We do not moderate or assume any responsibility for comments, which are owned by the readers who post them. Comments do not represent the views of Reason.com or Reason Foundation. We reserve the right to delete any comment for any reason at any time. Report abuses.

  • Ken Shultz||

    This doesn't make any sense.

    The dystopian future we're hurling towards is built and maintained by corporations because of the profit motive. ...it only leads to oppression.

    Everybody knows that, so your facts must be wrong.

    This isn't really happening.

  • Lord Humungus||

    Call me Mr. Skeptical, but I can easily imagine Twitter giving NSA the keys to the kingdom - a backdoor view of the data traffic before encryption.

  • IDPNDNT||

    I wouldn't be so sure.

    Twitter has a solid record on protecting its users.

  • JD the elder||

    I'm not buying that. They may have that kind of technical culture, but ultimately things are in the hands of upper management. And if the Feds come to upper management with a court order that says "give us access to everything, or else", the management will bend.

  • Brett L||

    Nah, I think the core IT developer community is coalescing around the Google engineers, "fuck these guys!" manifesto. The idea that a bunch of incompetent blundercrats get back doors into their stuff seems to have sparked some genuine anger. Also, this is a requirement to maintain an international presence. People outside the US are genuinely seeking alternative out-of-US-based solutions.

  • Ken Shultz||

    I think they're afraid of competitors outside the U.S. exploiting the lack of privacy to make users switch to their service.

    If you're a foreign user and privacy is important to you, why would you continue to use a service that's an open book to the NSA?

  • SweatingGin||

    And even if the NSA gets the data or keys and doesn't misuse it (big if), who says they don't accidentally leak it? They just lost gigs of power points explicitly showing all the things they tap. Think they can keep your SSL private key safe? Unlikely.

  • Mongo||

    Those IT companies like to talk tough: I remember around 2000 when the military requested names of teh gayz from online chats and AOL (?) handed over a fuckin' list.

  • datcv||

    AOL HQ in Northern Virginia was too close to the heart of the beast. They never did seem like a very ethical company so... here's hoping that todays tech firms are better?

  • Fist of Etiquette||

    It's good to know that the NSA won't know in October 2014 what I tweeted about Miley Cyrus a year prior.

  • Brett L||

    You laugh, but Twitter has been used in foreign countries to schedule protest, meetings, and anonymously (well, to foreign governments) forward information. I guess you can still tweet: "The Eagle flies at dawn", or whatever your go-code is, too.

  • SweatingGin||

    f7826242aa63ff3e1da63fee2044626e

  • Brett L||

    All I see is blonde, brunette, redhead...

  • Ken Shultz||

    Yeah, and foreign governments have found it easy to identify protestors--and everyone in their family--by tracking Twitter and Facebook, too.

    I wish Twitter all the luck in the world in encrypting their data, but social media, by its very nature, gives authoritarians a framework to trace--that they never had before.

    http://www.amazon.com/The-Net-.....t+delusion

  • Brett L||

    Looks interesting. Thanks for sharing.

  • Fist of Etiquette||

    The chair is against the wall. The chair is against the wall.

    John has a long mustache. John has a long mustache.

  • ||

    The chair is against the wall. The chair is against the wall.

    That's an absolutely filthy thing to say, FoE, even if it is about Epi's mom.

  • Brett L||

    I was going to make a similar joke about SweatingGin's comment above and lost my nerve. I already have a duel with SugarFree using Wartys as the weapon of choice.

  • ||

    I already have a duel with SugarFree using Wartys as the weapon of choice.

    Might I suggest that you go into that duel having taken a fairly high dose of muscle relaxers?

  • db||

    Look, all the gov't needs is a regulation, law, or court ruling saying that ephemeral encyption keys are illegal and that any provider of comm services must retain the keys used in any encrypted session.

    Isn't this the basis of why they're going after lavabit for deleting all its data? Destruction of evidence? Just get a law declaring all encryption keys to be potential evidence and requiring long term storage of them, just as financial records are required to be retained for a time period.

  • Andrew S.||

    Yep. That's exactly what I see coming as a result of this.

  • 0x90||

    "all the gov't needs is a secret regulation, law, or court ruling..."

  • Jerryskids||

    all the gov't needs is a regulation, law, or court ruling saying that ephemeral encyption keys are illegal

    I'm pretty sure they already have such a law - hell, these guys would use some obscure provision of the Smoot-Hawley Tariff Act of 1930 to argue that point - but the use of it and the arguments for the use of it are going to be secret. Who knows what sort of pressure is being put on Twitter and Facebook and Google - not to mention Bank of America, MasterCard, GECapital, and so many other information processors - and what sorts of threats of charges for violating secret laws and secret interpretations of laws they face?

  • andarm16||

    Or they can let us win on the encryption front, and just mandate that all actions that users take must be logged as a an anti cyber-bullying measure.

  • thorax232||

    I love Silicon Valley. :)

  • estrauss||

    Here's the thing. I think privacy is probably bad. What needs to happen is not that we better hide our shit from the government, but rather that we force the government to be transparent.

    Transparancy, ultimately, is the mechanism that produces the best society. We shouldn't try to act more like them. They should have to act more like us - independent agents engaging in peaceable, free and open exchanges.

GET REASON MAGAZINE

Get Reason's print or digital edition before it’s posted online

  • Video Game Nation: How gaming is making America freer – and more fun.
  • Matt Welch: How the left turned against free speech.
  • Nothing Left to Cut? Congress can’t live within their means.
  • And much more.

SUBSCRIBE

advertisement