5 ms·

> ve has lots of vis personas Are those typos? You touched on the cyperpunk fantasy: using multiple online identities, all kept carefully separate from each o

by dcposch 10y ago

> ve has lots of vis personas Are those typos? You touched on the cyperpunk fantasy: using multiple online identities, all kept carefully separate from each other and from your real identity. (There's an excellent short story called True Names that explores this idea.) For the majority of ordinary, nontechnical people, there are lots of simpler solutions. * Use cash. In Berlin, many ordinary people have an awareness of and distaste for government surveillance. People remember East Germany. One result is that lots of people will just pay for everything in cash. In most other western countries, the norm is to leave an electronic trail of every single shop you visit. * Use Signal or WhatsApp. WhatsApp rolled out strong end to end encryption to a billion people--most of whom have no idea what a "key" is and only the faintest sense of what "encryption" means. The lesson I take from those projects is that whenever we can ship transparent, easy to use encryption that our users dont have to worry about, its a massive win. If your app allows users to talk to each other privately, consider adding E2E encryption. It's the future. If your app has some kind of cloud backup, like a password manager or a photo app, make sure that it's encrypted with a key that you don't have access to. E2E comes with product tradeoffs. You may have to charge your users money, because you cant target ads against data you cant access. You'll need to make an installed app rather than a webapp. But its worth it -- and I think someday, hopefully soon, users will demand it.

1stop 10y ago
You can't E2E with a web app?
- MichaelGG 10y ago
  No, not really. Until there's a standard that allows doing crypto in the browser, enforcing a higher security level for the page, and somehow verifying the hash of contents (so sites can "publish" an app) then web apps are basically useless for security. I know this is as pathetic as "why aren't scientists working on cancer instead of X", but we have WebXXX including Bluetooth and USB, you'd think we'd have "WebVerifiedApps" or something. Even content-addressable URIs aren't being allowed. It's funny, given the rise of things like Tutanota, which provide basically zero security over Gmail. (In fact, probably worse, since Google's sec team is way better.)
- losteric 10y ago
  To some degree yes, for example you could use something like https://github.com/openpgpjs/openpgpjs https://github.com/openpgpjs/openpgpjs to encrypt from one customer to another across even your own infrastructure, but (afaik) the browser VM is an incredibly insecure platform to run a "secure" application.
- detaro 10y ago
  It's even harder than with a normal application for a user to verify that you didn't change the code to one with a backdoor.
- happyslobro 10y ago
  I wonder, would it be possible to build a secure P2P client using encrypted Media Extensions and WebRTC? Going to check to see if EME supports encryption as well as decryption... update No. EME is only intended to be used by content consumers; even if it could be hacked to encrypt uploads / outgoing transfers, that use case wouldn't even be considered important as the spec evolves. Super lame.
mirimir 10y ago
No, they're gender-neutral pronouns: ve = she/he ver = him/her vis = hers/his I encountered them in Greg Egan's Diaspora. And yes, True Names :) An inspiration. With a decent host machine, one can run numerous Whonix instances, each with one or more personas. They can be long-term or throwaway. I do nothing at all private on smartphones. Signal and WhatsApp are cool and all, but radios are untrustable black boxes. Even if the data is secured at rest. Edit: In Egan's Diaspora, one of the protagonists is a software-generated entity, which literally has no gender. In my case, I'm referring to invented personas, which have whatever gender I fancy.
- AckSyn 10y ago
  sigh more of that sjw crap. Hope it doesn't infest this place like it has a significant portion of the net. It's utterly detestable.
  - roywiggins 10y ago
    Languages do exist with gender-neutral pronouns. Is Hungarian full of "sjw" crap? Adding a gender neutral pronoun to English isn't a crazy idea- "sibling" is a gender-neutral 20th Century invention and it fits in fine. I'm partial to "they" as the easiest option (it has a long history of being used in the singular) but constructed pronouns would work too.
    - komali2 10y ago
      They is the easiest, and already fully adopted, option. Why bother trying to add another?
      - ajkjk 10y ago
        Are you unable to think of an argument? It's not hard to list some ways in which using 'they' as a singular pronoun when gender is ambiguous is confusing and undesirable. It's not a stretch to then argue we should have a better alternative.
ashitlerferad 10y ago
Most cash is easily surveilled as it has serial numbers on it. Only coins are a safe form of cash but have a huge disadvantage of being exceptionally bulky.
- shabble 10y ago
  That would assume a comprehensive system of serial number scanning at point-of-sale in order to track the movements and actually connect it with people/purchases. The technology is probably available, and it's entirely possible that ATMs could be recording serial numbers of dispensed cash and tying them to the account used, but it's (presently) deeply unrealistic that every possible (or even most) places that accept paper money have the ability or desire to record serial numbers of incoming & outgoing bills.
  - sievebrain 10y ago
    You're falling victim to the same trap as what Snowden is talking about. Serial numbers on bills are routinely scanned and tracked. There's a discussion here: https://www.reddit.com/r/explainlikeimfive/comments/3ou4h4/eli5_how_are_the_serial_numbers_on_banknotes/ https://www.reddit.com/r/explainlikeimfive/comments/3ou4h4/e... It's not done at the point of sale. It's done when the money is returned to the banks themselves, and when they're dispensed at ATMs. Cash doesn't circulate for long and anti-money laundering laws prevent payment for many expensive items in cash, so this can provide important clues about where the money goes. For instance, withdraw money from an ATM, pay for food at your local grocery shop, and the bank/govt can see "withdrawal from account Herr Schmidt at 7:03pm Thursday, deposited by a grocery store down the road the next day" and conclude the money was used to buy food ... or at least had at most one hop in between.
    - mirimir 10y ago
      Yes, and that's problematic for mailing cash anonymously. It's not so easy to accumulate large denominations, and may attract attention. When possible, I like to mail gold. It's easy to clean, too.

by dcposch 10y ago

1stop 10y ago

You can't E2E with a web app?

MichaelGG 10y ago
No, not really. Until there's a standard that allows doing crypto in the browser, enforcing a higher security level for the page, and somehow verifying the hash of contents (so sites can "publish" an app) then web apps are basically useless for security. I know this is as pathetic as "why aren't scientists working on cancer instead of X", but we have WebXXX including Bluetooth and USB, you'd think we'd have "WebVerifiedApps" or something. Even content-addressable URIs aren't being allowed. It's funny, given the rise of things like Tutanota, which provide basically zero security over Gmail. (In fact, probably worse, since Google's sec team is way better.)
losteric 10y ago
To some degree yes, for example you could use something like https://github.com/openpgpjs/openpgpjs https://github.com/openpgpjs/openpgpjs to encrypt from one customer to another across even your own infrastructure, but (afaik) the browser VM is an incredibly insecure platform to run a "secure" application.
detaro 10y ago
It's even harder than with a normal application for a user to verify that you didn't change the code to one with a backdoor.
happyslobro 10y ago
I wonder, would it be possible to build a secure P2P client using encrypted Media Extensions and WebRTC? Going to check to see if EME supports encryption as well as decryption... update No. EME is only intended to be used by content consumers; even if it could be hacked to encrypt uploads / outgoing transfers, that use case wouldn't even be considered important as the spec evolves. Super lame.

mirimir 10y ago

No, they're gender-neutral pronouns: ve = she/he ver = him/her vis = hers/his I encountered them in Greg Egan's Diaspora. And yes, True Names :) An inspiration. With a decent host machine, one can run numerous Whonix instances, each with one or more personas. They can be long-term or throwaway. I do nothing at all private on smartphones. Signal and WhatsApp are cool and all, but radios are untrustable black boxes. Even if the data is secured at rest. Edit: In Egan's Diaspora, one of the protagonists is a software-generated entity, which literally has no gender. In my case, I'm referring to invented personas, which have whatever gender I fancy.

AckSyn 10y ago
sigh more of that sjw crap. Hope it doesn't infest this place like it has a significant portion of the net. It's utterly detestable.
- roywiggins 10y ago
  Languages do exist with gender-neutral pronouns. Is Hungarian full of "sjw" crap? Adding a gender neutral pronoun to English isn't a crazy idea- "sibling" is a gender-neutral 20th Century invention and it fits in fine. I'm partial to "they" as the easiest option (it has a long history of being used in the singular) but constructed pronouns would work too.
  - komali2 10y ago
    They is the easiest, and already fully adopted, option. Why bother trying to add another?
    - ajkjk 10y ago
      Are you unable to think of an argument? It's not hard to list some ways in which using 'they' as a singular pronoun when gender is ambiguous is confusing and undesirable. It's not a stretch to then argue we should have a better alternative.

ashitlerferad 10y ago

Most cash is easily surveilled as it has serial numbers on it. Only coins are a safe form of cash but have a huge disadvantage of being exceptionally bulky.

shabble 10y ago
That would assume a comprehensive system of serial number scanning at point-of-sale in order to track the movements and actually connect it with people/purchases. The technology is probably available, and it's entirely possible that ATMs could be recording serial numbers of dispensed cash and tying them to the account used, but it's (presently) deeply unrealistic that every possible (or even most) places that accept paper money have the ability or desire to record serial numbers of incoming & outgoing bills.
- sievebrain 10y ago
  You're falling victim to the same trap as what Snowden is talking about. Serial numbers on bills are routinely scanned and tracked. There's a discussion here: https://www.reddit.com/r/explainlikeimfive/comments/3ou4h4/eli5_how_are_the_serial_numbers_on_banknotes/ https://www.reddit.com/r/explainlikeimfive/comments/3ou4h4/e... It's not done at the point of sale. It's done when the money is returned to the banks themselves, and when they're dispensed at ATMs. Cash doesn't circulate for long and anti-money laundering laws prevent payment for many expensive items in cash, so this can provide important clues about where the money goes. For instance, withdraw money from an ATM, pay for food at your local grocery shop, and the bank/govt can see "withdrawal from account Herr Schmidt at 7:03pm Thursday, deposited by a grocery store down the road the next day" and conclude the money was used to buy food ... or at least had at most one hop in between.
  - mirimir 10y ago
    Yes, and that's problematic for mailing cash anonymously. It's not so easy to accumulate large denominations, and may attract attention. When possible, I like to mail gold. It's easy to clean, too.