XKeyscore: NSA program collects 'nearly everything a user does on the internet'
This is overwhelming. Even when you always hear the claims about we knew this was going on, somehow it is still shocking when you see it all laid out infront of you with screenshots and the capabilities described.<p>I can see how they get HTTP information, since they would intercept at transit hubs - but how are they getting all Facebook private messages and Gmail?<p>I was also looking for another unique ID that users are identified by - perhaps a machine or browser fingerprint or some form of intel that can 'glue' different browsers together and make a best guess if they are the same person (Facebook does this with device and user cookies) but couldn't find anything. It seems they rely solely on email addresses, IP addresses, cookies and HTTP headers.<p>So if you are browsing via 16 tor circuits and a browser that defaults to incognito with session histories being wiped, they couldn't reconstruct your history.<p>Users of PGP/encryption products being singled out is terrifying. The sooner we have the whole world using decent encryption tools, the better.<p>Edit: Gmail messages must only be captured when they leave the Google network. They are the only provider to support server-to-server TLS: <a href="https://twitter.com/ashk4n/status/346807239002169344/photo/1" rel="nofollow">https://twitter.com/ashk4n/status/346807239002169344/photo/1</a><p>They must only be getting a slice of the Facebook chat data, since the transport there is also https.<p>Facebook Messenger, on the other hand, uses MQTT, so it transmits and stores in plaintext. It has support for encrypted + signed messages with OTR if you are using an alternate client such as Adium or Pidgin.<p>Really need to go out an audit all of these services and let users know which are better.