Delete comment from: Google Online Security Blog
This week we learnt that intelligence agencies are blanket capturing internet traffic (in the UK, GCHQ's Mastering the Internet program takes 20 petabytes per day [1]), and archiving some of it. Meanwhile, spooks are trying to get their hands on providers' private keys (overtly by law, and presumably covertly by hacking). If this hasn't already happened, it will.
Thus, encryption algorithms with perfect forward secrecy are a must. Compromise of a provider's house key shouldn't bring the house down. Encryption should fail gracefully, old conversations should stay private.
Thanks Google for implementing forward secrecy on your servers. But adoption has been snail's pace slow elsewhere [3].
Google, you drafted the upcoming HTTP 2 specification [2] to mandate encryption. That's the web every citizen wants. And you've already argued to protect that clause against parties more naive. Thanks again.
Now, I implore you Google, to strengthen the specification to mandate algorithms with forward secrecy. Your influence can help them be adopted widely. Privacy shouldn't be an option. Privacy should be universal.
[1] http://www.guardian.co.uk/uk/2013/jun/21/gchq-cables-secret-world-communications-nsa
[2] http://datatracker.ietf.org/wg/httpbis/charter/
[3] http://news.netcraft.com/wp-content/uploads/2013/08/heatmap2.png
Jun 26, 2013, 3:43:26 PM
Posted to Protecting data for the long term with forward secrecy
