14 ms·

Edward Snowden: The Internet Is Broken

350 points by doctorshady 11y ago

lolidaisuki 11y ago
>hello, >You are receiving this error message because your ip (89.234.157.254) is listed in the StopForumSpam.com database. >You can check the status of your IP and have it removed by visiting http://www.stopforumspam.com/removal http://www.stopforumspam.com/removal. Thank you. It's kind of ironical that they are quoting Snowden and their own site blocks Tor. E: didn't HN used to have markdown quoting?
- krapp 11y ago
  It's not really ironic - Tor is used for spam all the time.
  - jakobdabo 11y ago
    Just like VPNs, proxies and abuse tolerant networks. If you can't prevent the spam by other means than IP blocking then maybe you should make your website read-only.
    - nickpsecurity 11y ago
      Or just block the sources of abuse while everyone else enjoys and can act on the content. Or just block comments from anonymous nets so they can at least read. Comment sections that are Wild West hurt branding too much for it to be an option.
      - Jordrok 11y ago
        Ah yes, we can't sacrifice the all-important branding!
        nickpsecurity 11y ago
        If you're a business, you can't. There's a decision to make: 1. Focus on benefiting anonymous people who either don't contribute shit back to the business or barely do. Freeloaders. 2. Focus on benefiting the founders, customers, and employees (in that order). If you loose some freeloaders, then so be it. If it's their design decision, then so be it time 10. They can always set up an unrestricted forum for people like them to discuss the article and deal with security headaches they bring in. Wait, No 2 seems to work as most readers and the company are benefiting except for the few that choose not to.
      - AnthonyMouse 11y ago
        It seems like we know how to solve this. Put a CAPTCHA on account creation, then allow users to flag posts and auto-ban fresh accounts with high flag rates. I'm honestly kind of surprised that there isn't more spam from attackers who compromise something close enough to a backbone provider that they can spoof arbitrary IP addresses and still see the return traffic.
        nickpsecurity 11y ago
        Those are possibilities. As is Disqus-style moderation. Nonetheless, it's a lot of extra work with nothing to show for it and possibly dangerous to site experience. That's the problem Tor poses.
        AnthonyMouse 11y ago
        The problem isn't unique to Tor. It's anything that allows a spammer to use the same IP address as innocent people, including things that aren't exactly legal, like compromised PCs and routers. Which means blocking Tor blocks the people who follow the law but not the people who break the law. And the problem is going to get worse as a result of IPv4 address exhaustion because some ISPs are going to have to start using carrier grade NAT (and some already are). The answer to that is IPv6 as ever, but that has the opposite problem. IPv6 addresses are too cheap to meter and using a thing for proof of stake requires the thing to be scarce. So the thing to show for it is that you can field test your solution prior to the day of Spam Armageddon when a spammer realizes they have a botnet with access to a million billion IPv6 addresses.
        nickpsecurity 11y ago
        "The problem isn't unique to Tor. It's anything that allows a spammer to use the same IP address as innocent people, including things that aren't exactly legal, like compromised PCs and routers. " That's sort of true. It's technically true that any I.P. address might be the source of malice. Yet, Tor's I.P. addresses will steadily be the source of a ton of malice with no resolution of that problem. Quite different than what happens when someone's ISP tells them there's malware on their machine. There's also economics involved where people have to pay for those machines and are therefore more likely to use them for other, profitable activities. Probably why we see less spam from those accounts. What remains are WiFi hotspots, libraries, etc. Apparently, they're not drowning services in hatemail and spam because they're still allowed. They could but few are complaining about them. "And the problem is going to get worse as a result of IPv4 address exhaustion because some ISPs are going to have to start using carrier grade NAT (and some already are). " Good call. I saw this coming. There were already talks by Ross Anderson IIRC about how critical it was for forensics to get the port number and time-stamp since CG-NAT would make I.P.'s useless. Already is in some areas. "So the thing to show for it is that you can field test your solution prior to the day of Spam Armageddon when a spammer realizes they have a botnet with access to a million billion IPv6 addresses." Haha. Interesting way of looking at it. I'm more worried about the routing tables, though, if IPv6 got massive surge of traffic. Never looked to see if they fixed early concerns about how well Tier 1-3 HW would handle it vs IPv4.
    - krapp 11y ago
      It's not exactly difficult to find another IP if the one you're on is blacklisted.
- hellbanner 11y ago
  Case in point for the article title..
- maxerickson 11y ago
  There's only been https://news.ycombinator.com/formatdoc https://news.ycombinator.com/formatdoc
  - lolidaisuki 11y ago
    Hmm. I could have sworn there has been some way to make the quotes more distinguishable but maybe I was wrong... Hacker news post limits for shadowbanned people really suck as well. Especially when the ban was for no good reason. Even worse is that HN only has perma bans. Oh wel...
deleted 11y ago
[deleted]
known 11y ago
Broken for whom?
- voidz 11y ago
  The Dutch for one, whose major ISP Ziggo still does not provide IPv6.
  - jason46 11y ago
    The only cable provider(charter) in northern MI doesn't support IPV6.
    - api 11y ago
      The largest provider where I live in Southern California does not support IPv6. The largest cloud providers don't either. Amazon, Google, and Microsoft all lack any IPv6 support at all.
      - DanielDent 11y ago
        Large cloud providers may have poor IPv6 support, but they do have some support. For instance, do a DNS lookup on netflix.com. You'll find IPv6 records pointing to Amazon AWS IP space.
  - d215 11y ago
    They do provide IPv6. RIPE Atlas features at least 6 probes that are in Ziggo's AS (ASN9143): See https://atlas.ripe.net/api/v2/probes/?asn_v6=9143 https://atlas.ripe.net/api/v2/probes/?asn_v6=9143 Thing is it only works in non-bridged mode latest generation Technicolor modems. If you need bridge mode, they will switch you back to IPv4.
andrewvijay 11y ago
Omfg that's looooong!
partycoder 11y ago
The EFF warned long ago something was going on when AT&T was putting beam splitters on Internet backbones to feed the NSA. Then Snowden revealed how everything is tapped. Then, be sure all mainstream encryption is "NOBUS". Nothing is truly random. Someone somewhere has the master key: elliptic curve cryptography using magic numbers from NIST? "Secure boot" by Intel? OpenSSL? Microsoft software? All backdoored. Trust no one.
- abandonliberty 11y ago
  Just possibly old versions of truecrypt. This author's conclusions seem quite sound to me. They collapsed it in a way to comply with a gag order while silently sounding an alarm. https://forum.truecrypt.ch/t/my-analysis-of-what-really-happened-to-truecrypt/387/3 https://forum.truecrypt.ch/t/my-analysis-of-what-really-happ... Anyone operating in this space is eventually going to get the same option as Lavabit's founder: compromise or collapse.
  - depingus 11y ago
    If you're super paranoid you shouldn't trust any version of truecrypt. Read the fascinating story of Paul Le Roux... https://mastermind.atavist.com/ https://mastermind.atavist.com/ He created E4M (which truecrypt was based on) and is rumored to have been one of the creators of truecrypt. Apparently he's also been a US government asset for a while.
    - nickpsecurity 11y ago
      If you're superparanoid, you should trust that because a superparanoid seemed to build it for himself and open-source it to stick it to the man in his mind. And then built a criminal empire that, if he was still financing it, depended on it for his survival. That's the kind of incentives that get results.
    - dublinben 11y ago
      TrueCrypt has been subjected to an independent security audit. As have successors like VeraCrypt. Any alternatives likely haven't.
mirimir 11y ago
Excellect! It's the most cogent analysis that I've seen from him. Damn, what a fucking hero! A few comments, however ... > ... we had to go to the dark side to be able to confront the threat posed by bad guys. We had to adopt their methods for ourselves. He's using "we" there in reference to the government. But it can also be read with "we" as you and me, and "bad guys" as the government ;) But then, I claim a broad "right to be left alone", one that doesn't concede any state monopoly on power. > ... you can’t opt out of governmental mass surveillance that watches everybody in the world without regard to any suspicious criminal activity or any kind of wrong doing. Well, sure you can ... as he goes on to explain ... > You would need to act like a spy to pursue a career in a field like journalism because you are always being watched. ... and ... > Instead of changing your phone to change your persona — divorcing your journalist phone from your personal phone — you can use the systems that are surrounding us all of the time to move between personas. Right! Compartmentalization is for sure the way to go. There are numerous personas like Mirimir. Maybe I make it too distinctive. But I have no meatspace identity that goes on like Mirimir does. And Mirimir, ve has lots of vis personas. So hey, let's create a tangled morass of overlapping personas ;)
- toomanythings2 11y ago
  I guess all he needs is to grow his hair long and a beard and HNers would genuflect at his picture in their hallway. Funny how this guy, at age 29 three years ago, is an expert in all worldly things nowadays.
  - eggy 11y ago
    I would say making a move like be did brought him into laser focus, and into more contact with like-minded individuals that only amplified his knowledge and commitment. We can all grow our minds if we apply ourselves.
    - toomanythings2 11y ago
      First, understand that he did not make a movie. Someone else did. Second, if someone makes a movie about you, that does not expand your knowledge into wide areas or into depths of world knowledge. Third, no one individual can become an expert on all things based on knowing other like-minded individuals. My point was, it seems too many of his worshipers now come to his altar asking for his opinion on all things ... and forgiveness.
0xCMP 11y ago
> But at the same time, we technologists as a class knew academically that these capabilities could be abused, but nobody actually believed they would be abused. Because why would you do that? It seemed so antisocial as a basic concept. I guess so? Not me though. Snowden literally only proved what I had learned on my own. > But we were confronted with documented evidence in 2013 that even what most people would consider to be a fairly forthright upstanding government was abusing these capabilities in the most indiscriminate way. Um. Who thought this? Ever? Since the 90s.
- sp332 11y ago
  You knew GCHQ tapped Google's datacenter-to-datacenter links?
  - lubujackson 11y ago
    http://archive.wired.com/science/discoveries/news/2006/05/70908 http://archive.wired.com/science/discoveries/news/2006/05/70... This stuff has been going on, and widely discussed, for over a decade. But no one really cared or understood the full scope until Snowden's slapped everyone across the face with it.
    - sp332 11y ago
      Yeah I know about the AT&T splitters mentioned in the footnotes. But the Snowden leak was a lot bigger than that. Did 0xCMP know that the NSA was recording the full contents of every cell phone call in the Bahamas and keeping them around for at least 30 days?
      - nickpsecurity 11y ago
        We didn't know but it wasn't paranoid to assume it. The reason was the Echelon leaks and what was done about those. The answer: nothing.
        setpatchaddress 11y ago
brokenforwhom 11y ago
Isn't this article laced with sordid propaganda? Stopped reading after "The now-infamous... " and noticed the comment "Broken for whom?" posted below by a user almost immediately after the article was posted on HN. I wonder who this individual is?, who feels happy about our dragnet/mass surveillance programs. And what he thinks about "hack open just this phone" to "does not scale" statements recently?
yoz-y 11y ago
Soo... roll out your own crypto?
awqrre 11y ago
Computers are also broken, and the Internet makes it more obvious.
nickpsecurity 11y ago
He's still not getting it or fully recommending it any more than most have. The funny thing is that I recently read a 150 page interview with one of founders of INFOSEC, Dr Schell, that showed his employer was the same way: ignored "COMPUSEC" as useless in favor of "COMSEC" solutions to all security problems. Schell, Karger, and Anderson's tiger teams smashed every mainframe and crypto using system put in front of them due to hardware and software bugs. They bypassed it. Like Schell and Karger said for 30 years, what we need is to start deploying high-assurance security practices, protocols, systems, methods... everything that's proven to get the job done in various ways. We need them deployed pervasively. More private protocols and encryption by default, too, but who gives a shit if it runs on systems so insecure it doesn't need backdoors? Let's go back to 1960's moving toward the 70's and 80's on hardware stuff. Burroughs stuff was tagged so everything in memory was code or data, pointers protected, arrays bounds-checked, arguments checked on function calls, and OS tried to isolate apps from each other. Some LISP machines had GC's for memory management. System/38 had capability-security & built-in database. Solo had safe concurrency at OS level. One had read-only firmware you couldn't change without physically moving it with a nucleus that handle protected functions that OS's built on. Two implemented a secure, Ada runtime that enforced the language's safety properties. SAFE (crash-safe.org), Cambridge's CHERI, and Sandia's SSP/Score processors follow these traditions. Now let's look at how Schell et al said to do assurance. Precise, math/flowcharts/whatever description of functional and security requirements to avoid ambiguities & resulting vulnerabilities. Similar for design with attention to simplicity. Implementation in safest language you can with simpler subset and style easy to analyze. Every module proven to match a requirement/spec so no subversion (well, a start on it...). Strict modularity, layering, and interface checks all over the place. Success and failure states modeled then shown to follow a precise, security policy. If you can't state it precisely, then you can't secure it because you don't know what security means for you. Code review, tests of each function, formal proofs if possible, static analysis if possible, covert channel analysis of info flows, configuration management that assumes malicious developers, source to object code verification, trusted distribution of HW/SW to customers, onsite verification/generation from source, and configuration guidance. All of this independently verified by at least one set of professionals that know what they're doing. That was security in 1970's-1980's. Far from red tape some here claim, every method above was proven by researchers, field users, and pentesters to catch serious problems. The only dispute was what caught most and where to spend most money. Even those questions had decent answers. Well, plus specific design and modeling decisions but INFOSEC was in infancy & that was evolving. I'm talking assurance activities: getting it done right whatever it is. Fast forward today to find that all the problems Schell, Karger, etc predicted have happened and consistently in systems that don't use those methods whereas systems that do avoid many more problems. So, here's the solution: raise assurance of our systems across the board using methods that go back to 1961. That's right, Burroughs engineers were doing a better job on security before that was even a thing just trying to improve reliability. This is 2016. We have better specs, better languages, better static analysis, easier formal tools, automated test generation, tons of sample code, fast dev machines... you name it. There's no excuse, outside willful ignorance or apathy, for security-focused developers (esp in FOSS) to not use everything at their disposal that's proven to work at reducing risk. Even less excuse for the stuff they make to still be less secure than tech from the friggin 60's and 70's. Shout out to the exceptions that are trying to do it right. Groups like GenodeOS, Dresden, NICTA/OKL4, Carlisle's IRONSIDES DNS, Bernstein's stuff, Galois, JX OS, ETH, INRIA, Secure64, Sentinel HYDRA (minus bodacion crap lol), Combex, and even NativeClient since they knocked off OP browser. Enough stuff like this and NSA will be begging us to ban INFOSEC books and shit since their info will dry up haha.
matchagaucho 11y ago
"police and the government then have the authority to search through your entire life in your pocket just because you are pulled over for a broken taillight" This is the classic Snowden formula. Establish a false premise that has no faith in the government or constitutional rights, then continue to paint a picture of a dystopian future. This guy should be writing sci-fi novels... [edit: I predicted at least 5 down votes as I typed this. Don't disappoint me ;-) ]
- pyre 11y ago
  If authority figures that broke laws were appropriately punished, then it would be easier to trust in the rule of law. When police officers, politicians, judges, etc can all get away with things that "regular" people would not get away with, then the system is broken.
- whiskers08xmt 11y ago
  We should always look at how laws and institutions may abuse their power, and establish the proper safeguards.
- crpatino 11y ago
  What is the false premise? Why do you think 'faith' is required in a logical argument? What future?
  - soared 11y ago
    "police and the government then have the authority to search through your entire life in your pocket just because you are pulled over for a broken taillight: " Is false.
    - ashitlerferad 11y ago
      Isn't it routine?
  - matchagaucho 11y ago
    "Cops Need a Warrant Event Just To Look At The Screen" http://motherboard.vice.com/read/court-cops-need-a-warrant-to-open-your-phone-even-just-to-look-at-the-screen http://motherboard.vice.com/read/court-cops-need-a-warrant-t... Seriously.... don't fall prey to Snowden's scare tactics. US law enforcement cannot physically take your smartphone without cause, much less even look at it.
educar 11y ago
Excellent points. I think the other part which he hasn't discussed is the rise of Cloud companies like Google, Facebook. We should really be working towards an internet where people can keep the data to themselves and decide how it gets used. But now, the default is for these corporations to own all the data. Of course, govt can still access the data (which is what snowden is talking about) but that is a different problem.
tmptmp 11y ago
I guess, the Snowden incidence is being used to hurl undue venom towards USA. But these people are ignoring or deliberately misleading other people to ignore the real dangers posed by extremists (including Islamists, communists, the far right Christians and so on). These ideologically driven criminals (called terrorists) live hidden in the general public. Their identification is a main problem. This "identification" problem is what requires mass surveillance. The terrorists are significantly different than many other criminals. In the sense that terrorists are not mainly driven by personal and earthly goals but they are driven by the goals set by their ideologies. Thus terrorism (inspired by hate ideology or religion) is significantly different in a very important respect from other crimes; that is, the terrorist(s) generally find support and shelter amongst large number of otherwise normal citizens inspired/driven by the hate ideology or religion whereas a murderer or a pedophile generally doesn't find such shelter. Tell this Snowden to do (or at least talk) a little bit about the dire situation of people's freedom in the country he has chosen to flee to, namely, Russia. And the people who are criticizing US way too much should do themselves a favor by looking at countries run by tyrants like China, North Korea, most Islamist countries and Cuba. The way the Chinese government does the mass surveillance of its citizens on the Internet and the way the communists have installed the reward/punishment system based on it will make you realize that what is happening in US is hardly even annoying. I am not to say that US is innocent person but it has been receiving criticism way too much. Edit: typo
- specialist 11y ago
  "...people's freedom in the country he has chosen to flee to, namely, Russia." Snowden got stuck in a Russian airport when his US visa got revoked. He then applied to many countries for asylum. Russia granted it. I've read that Snowden is still trying to find another host country.
- mercurial 11y ago
  > I guess, the Snowden incidence is being used to hurl undue venom towards USA. But these people are ignoring or deliberately misleading other people to ignore the real dangers posed by extremists (including Islamists, communists, the far right Christians and so on). Yeah, well, I don't think Cuban or North Korean spies are really at the forefront of anyone's concerns (apart from South Korea and Japan). > Thus terrorism (inspired by hate ideology or religion) is significantly different in a very important respect from other crimes; that is, the terrorist(s) generally find support and shelter amongst large number of otherwise normal citizens inspired/driven by the hate ideology or religion whereas a murderer or a pedophile generally doesn't find such shelter. Funny how pedophile rings are regularly dismantled (and made of "otherwise normal citizens" in majority). As for the "wolf in sheep's clothing" thing, it's not necessarily true (look at the profile of the attackers in France and Belgian, most of whom were linked to petty criminality - not to mention the guy who actually went to Syria). > Tell this Snowden to do (or at least talk) a little bit about the dire situation of people's freedom in the country he has chosen to flee to, namely, Russia. It was only a choice in the sense that the alternative was "kidnapping by the CIA". Russia was way down in Snowden's list of countries to flee to. What you don't seem to realize is that even if it's not abused now, it could very well be abused tomorrow. You want a Donald Trump nominating one of his cronies at the head of the US intelligence services and starting to dig into untold amounts of already-recorded communications? And it's not only the US. Us Europeans are doing exactly the same thing, just with less money. The potential of it being abused by organizations which by their very nature have little to no external oversight (or by their political masters) is absolutely frightening. And that's compounded by the panopticon effect: if you're never sure of how much you're being watched, you will self-censor.
Daneel_ 11y ago
I'd love to be able to read this article, however popsci, in their infinite wisdom, redirect all Australian users to the .com.au site...which doesn't have the same articles. Sigh US proxy it is then!
tmnvix 11y ago
Well yes, the internet is broken. That article is inaccessible to me. I am redirected from popsci.com to popsci.com.au which, it appears, doesn't have the article in question. I just get a message telling me "Oops! Something went wrong. Please scroll down to find your content." The content isn't there and there is no way to select the non-au site. Very broken.
mouzogu 11y ago
I have absolutely no faith in any government that gives the impression that they will add tighter controls or a reduction on the collection of personal data. They've been doing this for many years before Snowden and will continue long after any new laws are passed to give us the impression of an improvement.
stevetrewick 11y ago
>But at the same time, we technologists as a class knew academically that these capabilities could be abused, but nobody actually believed they would be abused. Because why would you do that? It seemed so antisocial as a basic concept. What's with 'we?' The various classes of technologists that I've been a member of - from the teen hax0r BBS days thru the crypto lists and Usenet groups to actual working professionals have absolutely believed this. It takes a truly spectacular amount of naivety to believe the contrary. I have a deep and profound respect for Snowden, who has certainly sacrificed any possible semblance of a normal life in his native culture and likely narrowly escaped a worse fate, something he must certainly have known was a risk. It is his very naivety that made him such a perfect whistleblower : he's in there looking around and he's like "Holy crap! These guys are into some profoundly bad shit! I have to tell everyone!" There's probably a hiring policy moral for black ops shops in there somewhere.
- sievebrain 11y ago
  I think he's right. His statement is carefully phrased. Yes, of course, all sorts of intelligent people have argued that the tools of mass surveillance could be developed and could be abused. But only a very small number of people picked up on AT&T Room 101 and Echelon and so on, and saw their significance. Unfortunately those things were more like news stories than events that redefined people's thinking. Mass surveillance simply wasn't a part of the conversation for the vast majority of technologists who mattered, i.e. the ones building the products we all use. The NSA leaks changed all that. Now you have the guys running WhatsApp and Apple talking about this stuff. And even though for politeness reasons they sometimes talk in hypotheticals, "if we don't encrypt it could be abused by bad governments", it's as clear as day that what they really mean is "because we don't encrypt it is being abused by our governments".
  - stevetrewick 11y ago
    Not could. Had been and were, for which there was growing evidence culminating with the Snowden files. I don't disagree that they had a considerably larger impact than what went before. You're absolutely right in the sense that once the stories of GCHQ's black boxes, the EUP's documented disclosure of Echelon [0], room 101 and so on and so forth got outside the circle of people who were familiar with them they became FOAF stories and conspiracy theories and weren't part of any mainstream discourse, but there was a bit more to [it] than abstract hypotheticals and general 'power corrupts' cynicism. [0] An Appraisal of Technologies of Political Control. http://www.europarl.europa.eu/pdf/jadis/2013_12/8.PE4_AP_PV!LIBE.1994_LIBE-199801260050EN.pdf http://www.europarl.europa.eu/pdf/jadis/2013_12/8.PE4_AP_PV!... [edit]
tahirtaous 11y ago
Edward don't like to use iPhone.

350 points by doctorshady 11y ago

>hello, >You are receiving this error message because your ip (89.234.157.254) is listed in the StopForumSpam.com database. >You can check the status of your IP and have it removed by visiting http://www.stopforumspam.com/removal http://www.stopforumspam.com/removal. Thank you. It's kind of ironical that they are quoting Snowden and their own site blocks Tor. E: didn't HN used to have markdown quoting?

krapp 11y ago
It's not really ironic - Tor is used for spam all the time.
- jakobdabo 11y ago
  Just like VPNs, proxies and abuse tolerant networks. If you can't prevent the spam by other means than IP blocking then maybe you should make your website read-only.
  - nickpsecurity 11y ago
    Or just block the sources of abuse while everyone else enjoys and can act on the content. Or just block comments from anonymous nets so they can at least read. Comment sections that are Wild West hurt branding too much for it to be an option.
    - Jordrok 11y ago
      Ah yes, we can't sacrifice the all-important branding!
      - nickpsecurity 11y ago
        If you're a business, you can't. There's a decision to make: 1. Focus on benefiting anonymous people who either don't contribute shit back to the business or barely do. Freeloaders. 2. Focus on benefiting the founders, customers, and employees (in that order). If you loose some freeloaders, then so be it. If it's their design decision, then so be it time 10. They can always set up an unrestricted forum for people like them to discuss the article and deal with security headaches they bring in. Wait, No 2 seems to work as most readers and the company are benefiting except for the few that choose not to.
    - AnthonyMouse 11y ago
      It seems like we know how to solve this. Put a CAPTCHA on account creation, then allow users to flag posts and auto-ban fresh accounts with high flag rates. I'm honestly kind of surprised that there isn't more spam from attackers who compromise something close enough to a backbone provider that they can spoof arbitrary IP addresses and still see the return traffic.
      - nickpsecurity 11y ago
        Those are possibilities. As is Disqus-style moderation. Nonetheless, it's a lot of extra work with nothing to show for it and possibly dangerous to site experience. That's the problem Tor poses.
        AnthonyMouse 11y ago
        The problem isn't unique to Tor. It's anything that allows a spammer to use the same IP address as innocent people, including things that aren't exactly legal, like compromised PCs and routers. Which means blocking Tor blocks the people who follow the law but not the people who break the law. And the problem is going to get worse as a result of IPv4 address exhaustion because some ISPs are going to have to start using carrier grade NAT (and some already are). The answer to that is IPv6 as ever, but that has the opposite problem. IPv6 addresses are too cheap to meter and using a thing for proof of stake requires the thing to be scarce. So the thing to show for it is that you can field test your solution prior to the day of Spam Armageddon when a spammer realizes they have a botnet with access to a million billion IPv6 addresses.
        nickpsecurity 11y ago
        "The problem isn't unique to Tor. It's anything that allows a spammer to use the same IP address as innocent people, including things that aren't exactly legal, like compromised PCs and routers. " That's sort of true. It's technically true that any I.P. address might be the source of malice. Yet, Tor's I.P. addresses will steadily be the source of a ton of malice with no resolution of that problem. Quite different than what happens when someone's ISP tells them there's malware on their machine. There's also economics involved where people have to pay for those machines and are therefore more likely to use them for other, profitable activities. Probably why we see less spam from those accounts. What remains are WiFi hotspots, libraries, etc. Apparently, they're not drowning services in hatemail and spam because they're still allowed. They could but few are complaining about them. "And the problem is going to get worse as a result of IPv4 address exhaustion because some ISPs are going to have to start using carrier grade NAT (and some already are). " Good call. I saw this coming. There were already talks by Ross Anderson IIRC about how critical it was for forensics to get the port number and time-stamp since CG-NAT would make I.P.'s useless. Already is in some areas. "So the thing to show for it is that you can field test your solution prior to the day of Spam Armageddon when a spammer realizes they have a botnet with access to a million billion IPv6 addresses." Haha. Interesting way of looking at it. I'm more worried about the routing tables, though, if IPv6 got massive surge of traffic. Never looked to see if they fixed early concerns about how well Tier 1-3 HW would handle it vs IPv4.
  - krapp 11y ago
    It's not exactly difficult to find another IP if the one you're on is blacklisted.
hellbanner 11y ago
Case in point for the article title..
maxerickson 11y ago
There's only been https://news.ycombinator.com/formatdoc https://news.ycombinator.com/formatdoc
- lolidaisuki 11y ago
  Hmm. I could have sworn there has been some way to make the quotes more distinguishable but maybe I was wrong... Hacker news post limits for shadowbanned people really suck as well. Especially when the ban was for no good reason. Even worse is that HN only has perma bans. Oh wel...

deleted 11y ago

[deleted]

known 11y ago

Broken for whom?

voidz 11y ago
The Dutch for one, whose major ISP Ziggo still does not provide IPv6.
- jason46 11y ago
  The only cable provider(charter) in northern MI doesn't support IPV6.
  - api 11y ago
    The largest provider where I live in Southern California does not support IPv6. The largest cloud providers don't either. Amazon, Google, and Microsoft all lack any IPv6 support at all.
    - DanielDent 11y ago
      Large cloud providers may have poor IPv6 support, but they do have some support. For instance, do a DNS lookup on netflix.com. You'll find IPv6 records pointing to Amazon AWS IP space.
- d215 11y ago
  They do provide IPv6. RIPE Atlas features at least 6 probes that are in Ziggo's AS (ASN9143): See https://atlas.ripe.net/api/v2/probes/?asn_v6=9143 https://atlas.ripe.net/api/v2/probes/?asn_v6=9143 Thing is it only works in non-bridged mode latest generation Technicolor modems. If you need bridge mode, they will switch you back to IPv4.

andrewvijay 11y ago

Omfg that's looooong!

partycoder 11y ago

The EFF warned long ago something was going on when AT&T was putting beam splitters on Internet backbones to feed the NSA. Then Snowden revealed how everything is tapped. Then, be sure all mainstream encryption is "NOBUS". Nothing is truly random. Someone somewhere has the master key: elliptic curve cryptography using magic numbers from NIST? "Secure boot" by Intel? OpenSSL? Microsoft software? All backdoored. Trust no one.

abandonliberty 11y ago
Just possibly old versions of truecrypt. This author's conclusions seem quite sound to me. They collapsed it in a way to comply with a gag order while silently sounding an alarm. https://forum.truecrypt.ch/t/my-analysis-of-what-really-happened-to-truecrypt/387/3 https://forum.truecrypt.ch/t/my-analysis-of-what-really-happ... Anyone operating in this space is eventually going to get the same option as Lavabit's founder: compromise or collapse.
- depingus 11y ago
  If you're super paranoid you shouldn't trust any version of truecrypt. Read the fascinating story of Paul Le Roux... https://mastermind.atavist.com/ https://mastermind.atavist.com/ He created E4M (which truecrypt was based on) and is rumored to have been one of the creators of truecrypt. Apparently he's also been a US government asset for a while.
  - nickpsecurity 11y ago
    If you're superparanoid, you should trust that because a superparanoid seemed to build it for himself and open-source it to stick it to the man in his mind. And then built a criminal empire that, if he was still financing it, depended on it for his survival. That's the kind of incentives that get results.
  - dublinben 11y ago
    TrueCrypt has been subjected to an independent security audit. As have successors like VeraCrypt. Any alternatives likely haven't.

mirimir 11y ago

Excellect! It's the most cogent analysis that I've seen from him. Damn, what a fucking hero! A few comments, however ... > ... we had to go to the dark side to be able to confront the threat posed by bad guys. We had to adopt their methods for ourselves. He's using "we" there in reference to the government. But it can also be read with "we" as you and me, and "bad guys" as the government ;) But then, I claim a broad "right to be left alone", one that doesn't concede any state monopoly on power. > ... you can’t opt out of governmental mass surveillance that watches everybody in the world without regard to any suspicious criminal activity or any kind of wrong doing. Well, sure you can ... as he goes on to explain ... > You would need to act like a spy to pursue a career in a field like journalism because you are always being watched. ... and ... > Instead of changing your phone to change your persona — divorcing your journalist phone from your personal phone — you can use the systems that are surrounding us all of the time to move between personas. Right! Compartmentalization is for sure the way to go. There are numerous personas like Mirimir. Maybe I make it too distinctive. But I have no meatspace identity that goes on like Mirimir does. And Mirimir, ve has lots of vis personas. So hey, let's create a tangled morass of overlapping personas ;)

toomanythings2 11y ago
I guess all he needs is to grow his hair long and a beard and HNers would genuflect at his picture in their hallway. Funny how this guy, at age 29 three years ago, is an expert in all worldly things nowadays.
- eggy 11y ago
  I would say making a move like be did brought him into laser focus, and into more contact with like-minded individuals that only amplified his knowledge and commitment. We can all grow our minds if we apply ourselves.
  - toomanythings2 11y ago
    First, understand that he did not make a movie. Someone else did. Second, if someone makes a movie about you, that does not expand your knowledge into wide areas or into depths of world knowledge. Third, no one individual can become an expert on all things based on knowing other like-minded individuals. My point was, it seems too many of his worshipers now come to his altar asking for his opinion on all things ... and forgiveness.

0xCMP 11y ago

> But at the same time, we technologists as a class knew academically that these capabilities could be abused, but nobody actually believed they would be abused. Because why would you do that? It seemed so antisocial as a basic concept. I guess so? Not me though. Snowden literally only proved what I had learned on my own. > But we were confronted with documented evidence in 2013 that even what most people would consider to be a fairly forthright upstanding government was abusing these capabilities in the most indiscriminate way. Um. Who thought this? Ever? Since the 90s.

sp332 11y ago
You knew GCHQ tapped Google's datacenter-to-datacenter links?
- lubujackson 11y ago
  http://archive.wired.com/science/discoveries/news/2006/05/70908 http://archive.wired.com/science/discoveries/news/2006/05/70... This stuff has been going on, and widely discussed, for over a decade. But no one really cared or understood the full scope until Snowden's slapped everyone across the face with it.
  - sp332 11y ago
    Yeah I know about the AT&T splitters mentioned in the footnotes. But the Snowden leak was a lot bigger than that. Did 0xCMP know that the NSA was recording the full contents of every cell phone call in the Bahamas and keeping them around for at least 30 days?
    - nickpsecurity 11y ago
      We didn't know but it wasn't paranoid to assume it. The reason was the Echelon leaks and what was done about those. The answer: nothing.
      - setpatchaddress 11y ago

brokenforwhom 11y ago

Isn't this article laced with sordid propaganda? Stopped reading after "The now-infamous... " and noticed the comment "Broken for whom?" posted below by a user almost immediately after the article was posted on HN. I wonder who this individual is?, who feels happy about our dragnet/mass surveillance programs. And what he thinks about "hack open just this phone" to "does not scale" statements recently?

yoz-y 11y ago

Soo... roll out your own crypto?

awqrre 11y ago

Computers are also broken, and the Internet makes it more obvious.

nickpsecurity 11y ago

He's still not getting it or fully recommending it any more than most have. The funny thing is that I recently read a 150 page interview with one of founders of INFOSEC, Dr Schell, that showed his employer was the same way: ignored "COMPUSEC" as useless in favor of "COMSEC" solutions to all security problems. Schell, Karger, and Anderson's tiger teams smashed every mainframe and crypto using system put in front of them due to hardware and software bugs. They bypassed it. Like Schell and Karger said for 30 years, what we need is to start deploying high-assurance security practices, protocols, systems, methods... everything that's proven to get the job done in various ways. We need them deployed pervasively. More private protocols and encryption by default, too, but who gives a shit if it runs on systems so insecure it doesn't need backdoors? Let's go back to 1960's moving toward the 70's and 80's on hardware stuff. Burroughs stuff was tagged so everything in memory was code or data, pointers protected, arrays bounds-checked, arguments checked on function calls, and OS tried to isolate apps from each other. Some LISP machines had GC's for memory management. System/38 had capability-security & built-in database. Solo had safe concurrency at OS level. One had read-only firmware you couldn't change without physically moving it with a nucleus that handle protected functions that OS's built on. Two implemented a secure, Ada runtime that enforced the language's safety properties. SAFE (crash-safe.org), Cambridge's CHERI, and Sandia's SSP/Score processors follow these traditions. Now let's look at how Schell et al said to do assurance. Precise, math/flowcharts/whatever description of functional and security requirements to avoid ambiguities & resulting vulnerabilities. Similar for design with attention to simplicity. Implementation in safest language you can with simpler subset and style easy to analyze. Every module proven to match a requirement/spec so no subversion (well, a start on it...). Strict modularity, layering, and interface checks all over the place. Success and failure states modeled then shown to follow a precise, security policy. If you can't state it precisely, then you can't secure it because you don't know what security means for you. Code review, tests of each function, formal proofs if possible, static analysis if possible, covert channel analysis of info flows, configuration management that assumes malicious developers, source to object code verification, trusted distribution of HW/SW to customers, onsite verification/generation from source, and configuration guidance. All of this independently verified by at least one set of professionals that know what they're doing. That was security in 1970's-1980's. Far from red tape some here claim, every method above was proven by researchers, field users, and pentesters to catch serious problems. The only dispute was what caught most and where to spend most money. Even those questions had decent answers. Well, plus specific design and modeling decisions but INFOSEC was in infancy & that was evolving. I'm talking assurance activities: getting it done right whatever it is. Fast forward today to find that all the problems Schell, Karger, etc predicted have happened and consistently in systems that don't use those methods whereas systems that do avoid many more problems. So, here's the solution: raise assurance of our systems across the board using methods that go back to 1961. That's right, Burroughs engineers were doing a better job on security before that was even a thing just trying to improve reliability. This is 2016. We have better specs, better languages, better static analysis, easier formal tools, automated test generation, tons of sample code, fast dev machines... you name it. There's no excuse, outside willful ignorance or apathy, for security-focused developers (esp in FOSS) to not use everything at their disposal that's proven to work at reducing risk. Even less excuse for the stuff they make to still be less secure than tech from the friggin 60's and 70's. Shout out to the exceptions that are trying to do it right. Groups like GenodeOS, Dresden, NICTA/OKL4, Carlisle's IRONSIDES DNS, Bernstein's stuff, Galois, JX OS, ETH, INRIA, Secure64, Sentinel HYDRA (minus bodacion crap lol), Combex, and even NativeClient since they knocked off OP browser. Enough stuff like this and NSA will be begging us to ban INFOSEC books and shit since their info will dry up haha.

matchagaucho 11y ago

"police and the government then have the authority to search through your entire life in your pocket just because you are pulled over for a broken taillight" This is the classic Snowden formula. Establish a false premise that has no faith in the government or constitutional rights, then continue to paint a picture of a dystopian future. This guy should be writing sci-fi novels... [edit: I predicted at least 5 down votes as I typed this. Don't disappoint me ;-) ]

pyre 11y ago
If authority figures that broke laws were appropriately punished, then it would be easier to trust in the rule of law. When police officers, politicians, judges, etc can all get away with things that "regular" people would not get away with, then the system is broken.
whiskers08xmt 11y ago
We should always look at how laws and institutions may abuse their power, and establish the proper safeguards.
crpatino 11y ago
What is the false premise? Why do you think 'faith' is required in a logical argument? What future?
- soared 11y ago
  "police and the government then have the authority to search through your entire life in your pocket just because you are pulled over for a broken taillight: " Is false.
  - ashitlerferad 11y ago
    Isn't it routine?
- matchagaucho 11y ago
  "Cops Need a Warrant Event Just To Look At The Screen" http://motherboard.vice.com/read/court-cops-need-a-warrant-to-open-your-phone-even-just-to-look-at-the-screen http://motherboard.vice.com/read/court-cops-need-a-warrant-t... Seriously.... don't fall prey to Snowden's scare tactics. US law enforcement cannot physically take your smartphone without cause, much less even look at it.

educar 11y ago

Excellent points. I think the other part which he hasn't discussed is the rise of Cloud companies like Google, Facebook. We should really be working towards an internet where people can keep the data to themselves and decide how it gets used. But now, the default is for these corporations to own all the data. Of course, govt can still access the data (which is what snowden is talking about) but that is a different problem.

tmptmp 11y ago

I guess, the Snowden incidence is being used to hurl undue venom towards USA. But these people are ignoring or deliberately misleading other people to ignore the real dangers posed by extremists (including Islamists, communists, the far right Christians and so on). These ideologically driven criminals (called terrorists) live hidden in the general public. Their identification is a main problem. This "identification" problem is what requires mass surveillance. The terrorists are significantly different than many other criminals. In the sense that terrorists are not mainly driven by personal and earthly goals but they are driven by the goals set by their ideologies. Thus terrorism (inspired by hate ideology or religion) is significantly different in a very important respect from other crimes; that is, the terrorist(s) generally find support and shelter amongst large number of otherwise normal citizens inspired/driven by the hate ideology or religion whereas a murderer or a pedophile generally doesn't find such shelter. Tell this Snowden to do (or at least talk) a little bit about the dire situation of people's freedom in the country he has chosen to flee to, namely, Russia. And the people who are criticizing US way too much should do themselves a favor by looking at countries run by tyrants like China, North Korea, most Islamist countries and Cuba. The way the Chinese government does the mass surveillance of its citizens on the Internet and the way the communists have installed the reward/punishment system based on it will make you realize that what is happening in US is hardly even annoying. I am not to say that US is innocent person but it has been receiving criticism way too much. Edit: typo

specialist 11y ago
"...people's freedom in the country he has chosen to flee to, namely, Russia." Snowden got stuck in a Russian airport when his US visa got revoked. He then applied to many countries for asylum. Russia granted it. I've read that Snowden is still trying to find another host country.
mercurial 11y ago
> I guess, the Snowden incidence is being used to hurl undue venom towards USA. But these people are ignoring or deliberately misleading other people to ignore the real dangers posed by extremists (including Islamists, communists, the far right Christians and so on). Yeah, well, I don't think Cuban or North Korean spies are really at the forefront of anyone's concerns (apart from South Korea and Japan). > Thus terrorism (inspired by hate ideology or religion) is significantly different in a very important respect from other crimes; that is, the terrorist(s) generally find support and shelter amongst large number of otherwise normal citizens inspired/driven by the hate ideology or religion whereas a murderer or a pedophile generally doesn't find such shelter. Funny how pedophile rings are regularly dismantled (and made of "otherwise normal citizens" in majority). As for the "wolf in sheep's clothing" thing, it's not necessarily true (look at the profile of the attackers in France and Belgian, most of whom were linked to petty criminality - not to mention the guy who actually went to Syria). > Tell this Snowden to do (or at least talk) a little bit about the dire situation of people's freedom in the country he has chosen to flee to, namely, Russia. It was only a choice in the sense that the alternative was "kidnapping by the CIA". Russia was way down in Snowden's list of countries to flee to. What you don't seem to realize is that even if it's not abused now, it could very well be abused tomorrow. You want a Donald Trump nominating one of his cronies at the head of the US intelligence services and starting to dig into untold amounts of already-recorded communications? And it's not only the US. Us Europeans are doing exactly the same thing, just with less money. The potential of it being abused by organizations which by their very nature have little to no external oversight (or by their political masters) is absolutely frightening. And that's compounded by the panopticon effect: if you're never sure of how much you're being watched, you will self-censor.

Daneel_ 11y ago

I'd love to be able to read this article, however popsci, in their infinite wisdom, redirect all Australian users to the .com.au site...which doesn't have the same articles. Sigh US proxy it is then!

tmnvix 11y ago

Well yes, the internet is broken. That article is inaccessible to me. I am redirected from popsci.com to popsci.com.au which, it appears, doesn't have the article in question. I just get a message telling me "Oops! Something went wrong. Please scroll down to find your content." The content isn't there and there is no way to select the non-au site. Very broken.

mouzogu 11y ago

I have absolutely no faith in any government that gives the impression that they will add tighter controls or a reduction on the collection of personal data. They've been doing this for many years before Snowden and will continue long after any new laws are passed to give us the impression of an improvement.

stevetrewick 11y ago

>But at the same time, we technologists as a class knew academically that these capabilities could be abused, but nobody actually believed they would be abused. Because why would you do that? It seemed so antisocial as a basic concept. What's with 'we?' The various classes of technologists that I've been a member of - from the teen hax0r BBS days thru the crypto lists and Usenet groups to actual working professionals have absolutely believed this. It takes a truly spectacular amount of naivety to believe the contrary. I have a deep and profound respect for Snowden, who has certainly sacrificed any possible semblance of a normal life in his native culture and likely narrowly escaped a worse fate, something he must certainly have known was a risk. It is his very naivety that made him such a perfect whistleblower : he's in there looking around and he's like "Holy crap! These guys are into some profoundly bad shit! I have to tell everyone!" There's probably a hiring policy moral for black ops shops in there somewhere.

sievebrain 11y ago
I think he's right. His statement is carefully phrased. Yes, of course, all sorts of intelligent people have argued that the tools of mass surveillance could be developed and could be abused. But only a very small number of people picked up on AT&T Room 101 and Echelon and so on, and saw their significance. Unfortunately those things were more like news stories than events that redefined people's thinking. Mass surveillance simply wasn't a part of the conversation for the vast majority of technologists who mattered, i.e. the ones building the products we all use. The NSA leaks changed all that. Now you have the guys running WhatsApp and Apple talking about this stuff. And even though for politeness reasons they sometimes talk in hypotheticals, "if we don't encrypt it could be abused by bad governments", it's as clear as day that what they really mean is "because we don't encrypt it is being abused by our governments".
- stevetrewick 11y ago
  Not could. Had been and were, for which there was growing evidence culminating with the Snowden files. I don't disagree that they had a considerably larger impact than what went before. You're absolutely right in the sense that once the stories of GCHQ's black boxes, the EUP's documented disclosure of Echelon [0], room 101 and so on and so forth got outside the circle of people who were familiar with them they became FOAF stories and conspiracy theories and weren't part of any mainstream discourse, but there was a bit more to [it] than abstract hypotheticals and general 'power corrupts' cynicism. [0] An Appraisal of Technologies of Political Control. http://www.europarl.europa.eu/pdf/jadis/2013_12/8.PE4_AP_PV!LIBE.1994_LIBE-199801260050EN.pdf http://www.europarl.europa.eu/pdf/jadis/2013_12/8.PE4_AP_PV!... [edit]

tahirtaous 11y ago

Edward don't like to use iPhone.