EFF’s Game Plan for Ending Global Mass Surveillance
An organized, carefully executed plan to thwart global surveillance is a good thing. But EFF laid its plan out, and critiques of that plan are fair game.<p>So: our industry has largely Google to thank for:<p>* The development and deployment of TLS forward secrecy, a technology that has very little operational importance to big companies but that is critically important for increasing the cost of NSA surveillance.<p>* The development and adoption of strong, modern elliptic curve cryptography in browsers (the Curve25519 CFRG recommendation has Adam Langley's name on it).<p>* TLS certificate pinning, which Google pioneered in Chrome, which not only drastically reduces browser susceptibility to CA-based attacks on TLS but also transforms the Firefox and Chrome installed base into a worldwide anti-spoofing surveillance system.<p>* EndToEnd, the Chrome Javascript implementation of PGP, the team for which includes Thai Duong, of BEAST, CRIME, and POODLE fame, who Google was smart enough to snap up.<p>* Years and years of the Chrome sandbox and runtime hardening, which has significantly driven up the cost of viable browser clientsides, which are probably the most important software security weapon in NSA's arsenal.<p>* Years and years and years of Chrome browser security work from people like Michel Zalewsky --- see things like "Notes On A Post-XSS World" for a taste of the security ideas that will be banal and commonplace 10 years from now but that people will forget Google funded.<p>* One of the industry's best organized large-scale fuzzing and bughunting operations, shaking out hundreds and hundreds of bugs in things like video and image codecs.<p>I think that first section in this plan could have been written more carefully. I do not see how it could have been written carefully and retain the sense of urgency that the rest of the document has. And that bothers and worries me.<p>Hey: on the other hand, maybe Google is just as happy with it as EFF is. After all, if they're setting a high bar for themselves, all the better if a bunch of other companies are required to clear that same bar. I know a fair bit about the technical work Google is doing, but virtually nothing about EFF's motives for phrasing things they way they do.