5 ms·

Does anyone honestly believe that the government doesn't collect every single email, phone call, message, credit card transaction, etc. or have the capability t

by seibelj 11y ago

Does anyone honestly believe that the government doesn't collect every single email, phone call, message, credit card transaction, etc. or have the capability to query a database to get it if needed? You need to accept that the war is already lost. When you are doing something that needs to be protected, use end to end crypto. And buy things in cash

zaroth 11y ago
Still waiting for someone to admit Stellarwind didn't just collect US meta-data. Yeah, like Google forgetting to drop the packet after the BSSID, right? Except NSA is data-mining every last drop of it. Why fuck the Constitution just a little, if you've got the packet, might as well go all the way.
- jkestner 11y ago
  Well, their definition of "collect" is only when agents actually search everything they've vacuumed up. https://www.eff.org/nsa-spying/wordgames#collect https://www.eff.org/nsa-spying/wordgames#collect
CyberDildonics 11y ago
I'm amazed that when I mention asymmetric encryption by default on the IP level people seem to flip out. Why we are sending all our data in the clear and letting anyone siphon it off so easily is beyond me, but people just don't seem to care.
- andreyf 11y ago
  Why do people flip out? Could it be that there are hard sub-problems to implementing it that might not be worth the cost or increased risk? A lot of connections are encrypted with https now, why is that not enough? How do you imagine it being implemented? Would it replace the need for https?
  - CyberDildonics 11y ago
    What are those hard sub problems? There has been an encrypted IP standard since the early 90s. Https is not enough. Not everything goes through http, not all http is https, and there is a lot questionable about certificate based encryption schemes.
    - andreyf 11y ago
      I'm no expert, but one hard sub-problem seems to be authentication, the thing that certificate authorities aim to solve. Which encrypted IP standard are you thinking of, and how does it provide authentication? Not everything needs encryption and there is a real cost to maintaining encryption infrastructure. As those costs decrease, we get more encryption, and perhaps we'll get to a place where everything is encrypted, but I don't think it's especially outrageous that we're not there now.
      - CyberDildonics 11y ago
        Public private encryption doesn't need authentication. > Not everything needs encryption Fair enough, but the attitude of opt-in/insecure by default is an enormous problem. Countries are running undersea fiber lines to avoid the NSA. This could be avoided by encryption by default. > there is a real cost to maintaining encryption infrastructure I would like to see the numbers. Dealing with network traffic is generally lightweight and encryption is generally lightweight. It could be done, it just isn't for some reason.
        andreyf 11y ago
        Could you expound on what the use of asymmetric crypto if not for authentication? https actually uses symmetric encryption for content and public/private for authentication, iirc. I don't think undersea fiber lines alone would stop a nation state like the US from intercepting them. Undersea fibers need maintenance and repairs done on them, and I imagine putting in a prism to splice off a connection during a maintenance window is within most nation state's capabilities. I don't think the exact numbers are all that important, just that it's non-negligible. When the implementation and maintenance costs become negligible, turning it on by default makes sense. Until then, opt-in makes sense. Authentication is the toughest part that I don't think is yet solved in a mass deployable way.
akshatpradhan 11y ago
>When you are doing something that needs to be protected, use end to end crypto. And buy things in cash. This isn't the solution. The push for usable experiences has made the internet in all devices a reality. Let's just accept that people want Slick Apps for their refrigerator and instead of sticking to old school security doctrine, let's take a stab at implementing a security compliance regimen in our applications. Security controls like Code Review and Unit Testing is just thorough hygiene that helps with ensuring data (e.g. email, phone call, message, credit card transaction) are private.
techdragon 11y ago
The thing is, it can get worse, at the moment the USA isn't "bad by default" unlike the UK, Egypt, Iran, China, New Zealand. The constitution of the United States still hampers the progress towards the totalitarian surveillance state some people seem to want to create. China, UK, etc, all lack any "protection" from government simply saying "it's legal because we say it is". GCHQ don't need permission because the UK government was able to simply say "we have the right, because we're the government", the same is true in most countries. As for end to end crypto, all that does in the age of PRISM, is flag everything you do as "possible target" and increase the level of attention you receive from such mass surveillance machinery. Sad but true. Your communication may be protected but you are not.
enqk 11y ago
Without a fight even encryption and things like paying in cash will be danger. I take an european example: France recently banned paying sums of cash above 1000EUR in a commercial transaction. Ref: http://www.connexionfrance.com/1000-euro-cash-payment-limit-france-september-money-laundering-17068-view-article.html http://www.connexionfrance.com/1000-euro-cash-payment-limit-...
- redblacktree 11y ago
  What the hell? How does a Frenchman sell a personal vehicle then? I wouldn't trust a check... I just recently sold a vehicle for $7,800 in cash. It's insane to me that that could be considered illegal.
  - enqk 11y ago
    I saw in some official reference that the limit applies to business transactions with a professional. For a person to person transaction they say there is no limit, as long as a bill is recorded if amounts > 1500e. In France, there's a special kind of certified check that persons can use for large transactions where the amount is pre-debited and the check comes directly from the Bank itself.
    - redblacktree 11y ago
      I think you're talking about a "cashier's check" which we have in the US too; the problem is that these can be forged, and the bank will still accept it as a deposit. What many people don't know, is that when the check fails to clear, the depositor is liable for the missing funds, not the forger.
ionised 11y ago
> You need to accept that the war is already lost. This isn't true. Things can get a lot worse than they are now if we allow them too.

by seibelj 11y ago

zaroth 11y ago

Still waiting for someone to admit Stellarwind didn't just collect US meta-data. Yeah, like Google forgetting to drop the packet after the BSSID, right? Except NSA is data-mining every last drop of it. Why fuck the Constitution just a little, if you've got the packet, might as well go all the way.

jkestner 11y ago
Well, their definition of "collect" is only when agents actually search everything they've vacuumed up. https://www.eff.org/nsa-spying/wordgames#collect https://www.eff.org/nsa-spying/wordgames#collect

CyberDildonics 11y ago

I'm amazed that when I mention asymmetric encryption by default on the IP level people seem to flip out. Why we are sending all our data in the clear and letting anyone siphon it off so easily is beyond me, but people just don't seem to care.

andreyf 11y ago
Why do people flip out? Could it be that there are hard sub-problems to implementing it that might not be worth the cost or increased risk? A lot of connections are encrypted with https now, why is that not enough? How do you imagine it being implemented? Would it replace the need for https?
- CyberDildonics 11y ago
  What are those hard sub problems? There has been an encrypted IP standard since the early 90s. Https is not enough. Not everything goes through http, not all http is https, and there is a lot questionable about certificate based encryption schemes.
  - andreyf 11y ago
    I'm no expert, but one hard sub-problem seems to be authentication, the thing that certificate authorities aim to solve. Which encrypted IP standard are you thinking of, and how does it provide authentication? Not everything needs encryption and there is a real cost to maintaining encryption infrastructure. As those costs decrease, we get more encryption, and perhaps we'll get to a place where everything is encrypted, but I don't think it's especially outrageous that we're not there now.
    - CyberDildonics 11y ago
      Public private encryption doesn't need authentication. > Not everything needs encryption Fair enough, but the attitude of opt-in/insecure by default is an enormous problem. Countries are running undersea fiber lines to avoid the NSA. This could be avoided by encryption by default. > there is a real cost to maintaining encryption infrastructure I would like to see the numbers. Dealing with network traffic is generally lightweight and encryption is generally lightweight. It could be done, it just isn't for some reason.
      - andreyf 11y ago
        Could you expound on what the use of asymmetric crypto if not for authentication? https actually uses symmetric encryption for content and public/private for authentication, iirc. I don't think undersea fiber lines alone would stop a nation state like the US from intercepting them. Undersea fibers need maintenance and repairs done on them, and I imagine putting in a prism to splice off a connection during a maintenance window is within most nation state's capabilities. I don't think the exact numbers are all that important, just that it's non-negligible. When the implementation and maintenance costs become negligible, turning it on by default makes sense. Until then, opt-in makes sense. Authentication is the toughest part that I don't think is yet solved in a mass deployable way.

akshatpradhan 11y ago

>When you are doing something that needs to be protected, use end to end crypto. And buy things in cash. This isn't the solution. The push for usable experiences has made the internet in all devices a reality. Let's just accept that people want Slick Apps for their refrigerator and instead of sticking to old school security doctrine, let's take a stab at implementing a security compliance regimen in our applications. Security controls like Code Review and Unit Testing is just thorough hygiene that helps with ensuring data (e.g. email, phone call, message, credit card transaction) are private.

techdragon 11y ago

The thing is, it can get worse, at the moment the USA isn't "bad by default" unlike the UK, Egypt, Iran, China, New Zealand. The constitution of the United States still hampers the progress towards the totalitarian surveillance state some people seem to want to create. China, UK, etc, all lack any "protection" from government simply saying "it's legal because we say it is". GCHQ don't need permission because the UK government was able to simply say "we have the right, because we're the government", the same is true in most countries. As for end to end crypto, all that does in the age of PRISM, is flag everything you do as "possible target" and increase the level of attention you receive from such mass surveillance machinery. Sad but true. Your communication may be protected but you are not.

enqk 11y ago

Without a fight even encryption and things like paying in cash will be danger. I take an european example: France recently banned paying sums of cash above 1000EUR in a commercial transaction. Ref: http://www.connexionfrance.com/1000-euro-cash-payment-limit-france-september-money-laundering-17068-view-article.html http://www.connexionfrance.com/1000-euro-cash-payment-limit-...

redblacktree 11y ago
What the hell? How does a Frenchman sell a personal vehicle then? I wouldn't trust a check... I just recently sold a vehicle for $7,800 in cash. It's insane to me that that could be considered illegal.
- enqk 11y ago
  I saw in some official reference that the limit applies to business transactions with a professional. For a person to person transaction they say there is no limit, as long as a bill is recorded if amounts > 1500e. In France, there's a special kind of certified check that persons can use for large transactions where the amount is pre-debited and the check comes directly from the Bank itself.
  - redblacktree 11y ago
    I think you're talking about a "cashier's check" which we have in the US too; the problem is that these can be forged, and the bank will still accept it as a deposit. What many people don't know, is that when the check fails to clear, the depositor is liable for the missing funds, not the forger.

ionised 11y ago

> You need to accept that the war is already lost. This isn't true. Things can get a lot worse than they are now if we allow them too.