5 ms·

This was a great article OP. But I think the author misses two critical points. Privacy and secrecy, in my mind, are questions of agency. In this context we're

by nbadg 11y ago

This was a great article OP. But I think the author misses two critical points. Privacy and secrecy, in my mind, are questions of agency. In this context we're talking about information. You can, broadly speaking, only do three things with information: create it, retain it, and share it. If you're to have agency -- that is, the ability to independently control your own existence -- in a digital sense, that implies that you must be able to control those three things. And if you think about it in terms of actual physical speech, it seems so intuitive: it would be an extraordinary day indeed if there were widespread physical manipulation of the very words coming out of our mouths, if somehow some third party could magically eavesdrop at will over anything we speak. But we've acclimated ourselves to thinking of digital spaces as somehow separate, as if the perceived triviality of, say, instagramming food pics might also imply that there is any less of a violation of our personal agency. That, for me, is why "private-by-default" is and always has been so vital: without it, you're incapable of exercising any meaningful control over the digital world around you. I'm always sad to see this framing left out, because I think it's a very important perspective to have. The second, and likely more appropriate point (given that this is HN), is that this isn't just economics and geopolitics. It is a technical failure that allowed third parties to have any control over it in the first place. HTTP doesn't even protect security, much less privacy. HTTPS is a step forward, but if you think it's sufficient in protecting privacy, I would offer Facebook as a counterexample. Protection of data in transit is an insufficient condition for privacy, and therefore an insufficient condition for agency. It's perfectly possible to create a protocol to address this, to afford not just security but agency, and I am absolutely positive that there are people out there working on this (I know, because I'm one of them: https://github.com/Muterra/doc-muse https://github.com/Muterra/doc-muse). But the hard part is overcoming the inertia we already have, and on that front, we are indeed back to economics and politics.

nickff 11y ago
Your narrative fails to explain what happened to Skype. Skype was a fully encrypted means of communication, and the only way to listen in on the parties talking to each other was to hack one of their computers. Then the NSA (and possibly other agencies) forced Skype to install a backdoor; this is one of many examples. There is no technological solution to the government compelling cooperation from any developers who venture to protect privacy. What would you do if someone held a gun to your head and ordered you to either give them a backdoor, go to jail, or be shot? The US government (for example,) has used many rationales to justify this behavior, including third party doctrine, and despite the obvious lack of any enumerated power to spy on citizens and residents at-will. Most other governments never pretended to provide privacy protections for their populations, these people were largely kept safe because of the sheer volume of traffic communications and the high cost of surveillance (before powerful computers and huge national governments). It seems that the problem is entirely political, as the government(s) will go to any lengths necessary to preserve their ability to look in on citizens. Powers that were once viewed as abhorrent and inherently totalitarian have become accepted through the collective passivity of an ever-more risk-averse populace.
- nbadg 11y ago
  I don't buy framing that as a purely political issue; it's exceptionally rare that anything fits so neatly into a box like that. Furthermore, boiling down the deprecation of the original Skype protocol at the hands of post-acquisition Microsoft is pretty far removed by what I'm saying; there's just too much to account for. Your characterization of a coercive state just isn't how the US political world works. Black suits don't show up at a developer's door with a gun and tell them "you must introduce technical vulnerabilities in your protocol and/or implementation or we're going to kill you". That's Hollywood. In reality, the government puts indirect economic pressure on Microsoft, and this has a measurable impact on the command chain there, and eventually a "favorable" outcome (from the government's perspective) is reached. This may even be internally justified for "performance reasons" (and it was). The plain fact of the matter is that at the end of the day, a technical vulnerability was implemented somewhere in the Skype protocol + implementation + system chain. That is still a technical deficiency, even if, as I said in my original reply, it is influenced by economic and political factors.
  - Retric 11y ago
    Lavabit was ordered to provide the SSL key in machine readable format by noon, August 5 or face a fine of $5000 per day. A phone call which from the IRS is defiantly backed up by people with guns even if nobody is directly in your face about it. Suggesting people in Black suits need to show up when I wish that I could legally share with you the events that led to my decision. I cannot. http://www.dailydot.com/news/email-anonymous-hushmail-lavabit-nsa/ http://www.dailydot.com/news/email-anonymous-hushmail-lavabi... PS: https://en.wikipedia.org/wiki/Lavabit https://en.wikipedia.org/wiki/Lavabit The service suspended its operations on August 8, 2013 after US government ordered it to turn over its Secure Sockets Layer (SSL) private keys. Levison also stated he has even been banned from sharing some information with his lawyer. Levison and his lawyer made two requests to Judge Claude M. Hilton to unseal the records, both of which were denied.
    - nbadg 11y ago
      > Suggesting people in Black suits need to show up when But that's exactly what I'm trying to say. I was responding to: > What would you do if someone held a gun to your head and ordered you to either give them a backdoor, go to jail, or be shot? Which is not reality. That's not the kind of coercion you experience. The government applied (in this case direct) economic pressure, and Lavabit made a business decision that a fine of $5000 per day (and potential future legal problems) was an unacceptable operating expense. Goodbye, Lavabit. And once again, a protocol (like SMTP) that doesn't inherently protect agency is, in my opinion, a technical problem. That email requires SSL for confidentiality is a security vulnerability. You don't fix that by taking on the political system (I mean you could, but good luck). You fix it by engineering a protocol that isn't vulnerable in the first place. My point is that we need to stop waiting for the politics to change, and solve the problem ourselves. That's going to mean questioning some very entrenched protocols, like SMTP. So be it.
zaroth 11y ago
I just read the whitepaper, and Muse sounds incredibly interesting [1]. Thanks for working on this, I definitely want to spend more time looking at it! [1] - https://github.com/Muterra/doc-muse/blob/master/whitepaper.md https://github.com/Muterra/doc-muse/blob/master/whitepaper.m...

by nbadg 11y ago

nickff 11y ago

Your narrative fails to explain what happened to Skype. Skype was a fully encrypted means of communication, and the only way to listen in on the parties talking to each other was to hack one of their computers. Then the NSA (and possibly other agencies) forced Skype to install a backdoor; this is one of many examples. There is no technological solution to the government compelling cooperation from any developers who venture to protect privacy. What would you do if someone held a gun to your head and ordered you to either give them a backdoor, go to jail, or be shot? The US government (for example,) has used many rationales to justify this behavior, including third party doctrine, and despite the obvious lack of any enumerated power to spy on citizens and residents at-will. Most other governments never pretended to provide privacy protections for their populations, these people were largely kept safe because of the sheer volume of traffic communications and the high cost of surveillance (before powerful computers and huge national governments). It seems that the problem is entirely political, as the government(s) will go to any lengths necessary to preserve their ability to look in on citizens. Powers that were once viewed as abhorrent and inherently totalitarian have become accepted through the collective passivity of an ever-more risk-averse populace.

nbadg 11y ago
I don't buy framing that as a purely political issue; it's exceptionally rare that anything fits so neatly into a box like that. Furthermore, boiling down the deprecation of the original Skype protocol at the hands of post-acquisition Microsoft is pretty far removed by what I'm saying; there's just too much to account for. Your characterization of a coercive state just isn't how the US political world works. Black suits don't show up at a developer's door with a gun and tell them "you must introduce technical vulnerabilities in your protocol and/or implementation or we're going to kill you". That's Hollywood. In reality, the government puts indirect economic pressure on Microsoft, and this has a measurable impact on the command chain there, and eventually a "favorable" outcome (from the government's perspective) is reached. This may even be internally justified for "performance reasons" (and it was). The plain fact of the matter is that at the end of the day, a technical vulnerability was implemented somewhere in the Skype protocol + implementation + system chain. That is still a technical deficiency, even if, as I said in my original reply, it is influenced by economic and political factors.
- Retric 11y ago
  Lavabit was ordered to provide the SSL key in machine readable format by noon, August 5 or face a fine of $5000 per day. A phone call which from the IRS is defiantly backed up by people with guns even if nobody is directly in your face about it. Suggesting people in Black suits need to show up when I wish that I could legally share with you the events that led to my decision. I cannot. http://www.dailydot.com/news/email-anonymous-hushmail-lavabit-nsa/ http://www.dailydot.com/news/email-anonymous-hushmail-lavabi... PS: https://en.wikipedia.org/wiki/Lavabit https://en.wikipedia.org/wiki/Lavabit The service suspended its operations on August 8, 2013 after US government ordered it to turn over its Secure Sockets Layer (SSL) private keys. Levison also stated he has even been banned from sharing some information with his lawyer. Levison and his lawyer made two requests to Judge Claude M. Hilton to unseal the records, both of which were denied.
  - nbadg 11y ago
    > Suggesting people in Black suits need to show up when But that's exactly what I'm trying to say. I was responding to: > What would you do if someone held a gun to your head and ordered you to either give them a backdoor, go to jail, or be shot? Which is not reality. That's not the kind of coercion you experience. The government applied (in this case direct) economic pressure, and Lavabit made a business decision that a fine of $5000 per day (and potential future legal problems) was an unacceptable operating expense. Goodbye, Lavabit. And once again, a protocol (like SMTP) that doesn't inherently protect agency is, in my opinion, a technical problem. That email requires SSL for confidentiality is a security vulnerability. You don't fix that by taking on the political system (I mean you could, but good luck). You fix it by engineering a protocol that isn't vulnerable in the first place. My point is that we need to stop waiting for the politics to change, and solve the problem ourselves. That's going to mean questioning some very entrenched protocols, like SMTP. So be it.

zaroth 11y ago

I just read the whitepaper, and Muse sounds incredibly interesting [1]. Thanks for working on this, I definitely want to spend more time looking at it! [1] - https://github.com/Muterra/doc-muse/blob/master/whitepaper.md https://github.com/Muterra/doc-muse/blob/master/whitepaper.m...