2 ms·

I was thinking of how to use it to de-cloak anonymous sources for journalists. Many of them are going to use anonymous email addresses, potentially VPNs/tor to

I was thinking of how to use it to de-cloak anonymous sources for journalists. Many of them are going to use anonymous email addresses, potentially VPNs/tor to further protect that but that's not the weak part. Before you choose to share information, you're going to find out who will actually use it effectively which implies research. Then once you share the information, you're going to pay attention to what they write with it. In both cases, since you're not doing the actual leak then, you're unlikely to take any countermeasures, let alone effective ones. For example, odds are Snowden researched Greenwald before he released anything to him. He probably read a ton of his pieces, looked at his wikipedia, and dug into his professional, etc profiles. And then after the leak, he probably continued to check Greenwald's regularly keeping an eye out for the new pieces. Even if we didn't know who Snowden was, a program like this would uncloak* him relatively quickly. * Or at least narrow down the suspects.

pdkl95 11y ago
All it takes is metadata. The "digital exhaust" we leave behind is extremely revealing. I usually use COTRAVELER as my example of how just a few data points (without any PII) can reveal a LOT about your social interactions, but browser history is another powerful data source. I believe this is why Dan Geer, in his incredible talk last year[1], suggested that "privacy" should now be defined as "the effective capacity to misrepresent yourself". To avoid exactly the type of analysis, you need the capability to misrepresent yourself, and you need to regularly be in the habit of use use that capability. Misrepresentation is using disinformation to frustrate data fusion on the part of whomever it is that is watching you. Some of it can be low-tech, such as misrepresentation by paying your therapist in cash under an assumed name. Misrepresentation means arming yourself not at Walmart but in living rooms. Misrepresentation means swapping affinity cards at random with like-minded folks. Misrepresentation means keeping an inventory of misconfigured webservers to proxy through. Misrepresentation means putting a motor-generator between you and the Smart Grid. Misrepresentation means using Tor for no reason at all. Misrepresentation means hiding in plain sight when there is nowhere else to hide. Misrepresentation means having not one digital identity that you cherish, burnish, and protect, but having as many as you can. [1] https://www.youtube.com/watch?v=nT-TGvYOBpI https://www.youtube.com/watch?v=nT-TGvYOBpI http://geer.tinho.net/geer.blackhat.6viii14.txt http://geer.tinho.net/geer.blackhat.6viii14.txt

pdkl95 11y ago

All it takes is metadata. The "digital exhaust" we leave behind is extremely revealing. I usually use COTRAVELER as my example of how just a few data points (without any PII) can reveal a LOT about your social interactions, but browser history is another powerful data source. I believe this is why Dan Geer, in his incredible talk last year[1], suggested that "privacy" should now be defined as "the effective capacity to misrepresent yourself". To avoid exactly the type of analysis, you need the capability to misrepresent yourself, and you need to regularly be in the habit of use use that capability. Misrepresentation is using disinformation to frustrate data fusion on the part of whomever it is that is watching you. Some of it can be low-tech, such as misrepresentation by paying your therapist in cash under an assumed name. Misrepresentation means arming yourself not at Walmart but in living rooms. Misrepresentation means swapping affinity cards at random with like-minded folks. Misrepresentation means keeping an inventory of misconfigured webservers to proxy through. Misrepresentation means putting a motor-generator between you and the Smart Grid. Misrepresentation means using Tor for no reason at all. Misrepresentation means hiding in plain sight when there is nowhere else to hide. Misrepresentation means having not one digital identity that you cherish, burnish, and protect, but having as many as you can. [1] https://www.youtube.com/watch?v=nT-TGvYOBpI https://www.youtube.com/watch?v=nT-TGvYOBpI http://geer.tinho.net/geer.blackhat.6viii14.txt http://geer.tinho.net/geer.blackhat.6viii14.txt