4 ms·

My post is about people who signed the pledge. I didn't sign it. It was too simplistic & unrealistic once I factored in surveillance companies with their massiv

My post is about people who signed the pledge. I didn't sign it. It was too simplistic & unrealistic once I factored in surveillance companies with their massive, user base. I might actually have to work from within up the management track, in the Android/Chrome team, etc to get improvements. In the process, I'd have contributed to the surveillance tech to make possible the privacy-enhancing improvements to it. I try not to promise what I can't deliver working in moral spaces so complex. Far as Gmail, I use it as an untrusted drop for potentially-malicious traffic with spam filtering and high-availability. Such a setup burdens them more than helps given free email is a loss leader. Dissidents can send me email from anonymous accounts or set up GPG exchanges where I just know them by a key and alias. I also have a private, Swiss-hosted email for users I've vetted to a degree. I pay for that under vote with my wallet concept. Thinking about moving drop address to Fastmail under same concept since I've heard enough feedback about it basically being as good as Gmail. Altogether, Google currently loses money to host my risky emails with anonymous, GPG-protected email available to those that want privacy. Looks morally neutral.

pmoriarty 10y ago
When you use Gmail, Google will try to identify you and identify the people who email you, and draw connections between you and inferences from your communication. I really don't understand why someone like you who is evidently seriously against surveillance and who values privacy would give Google more ammunition to do that.
- nickpsecurity 10y ago
  It's more complex than that. Almost everyone that emails me uses a surveillance-oriented email system since it's free, works well, and uses years of contact information. All of the providers in Five Eyes are currently under mass surveillance at the backbone level by the organizations that are the threat in this discussion. Many are also cooperating with the government in secret per the Snowden leaks. Those that run their own servers usually send the email openly over such backbones to surveillance-oriented providers. The default assumption should be that all free email is being analyzed as you describe by the NSA with a portion handed off to FBI, DHS, IRS, INS, etc. So, we start there. I'm currently quite poor with a need for reliable email for business leads. Of the free ones, Gmail is the most reliable. Of the evil companies, Google does more beneficial things than most like with Android & Chrome which we can modify for privacy. My tradeoff, based on pragmatism, is to support the lesser evil to get what I need while going out of my way to ensure people worried about their safety can contact me anonymously & encrypted. This is until I find a Gmail equivalent. Fastmail is best alternative in terms of uptime & performance per comments I've read but also in Five Eyes territory under mass surveillance. I've gotten to the point, esp seeing turn of events in Switzerland past year, that it's best to assume all email is under mass surveillance by governments, that many cooperate on persons of interest, and possibly with any encryption keys compelled out of them. And we work from there with or without email as the medium with focus on anonymization or end-to-end crypto.
  - pmoriarty 10y ago
    There's a difference between protecting yourself from government surveillance (good luck) and protecting yourself from Google's surveillance (possible, to a great extent).
    - nickpsecurity 10y ago
      There is. I just doubt it matters a lot in terms of NeverAgain pledge if the organizations they're concerned about still likely see the traffic anyway. Real concern should go further to make sure that's impossible with right choice of software and services like other organizations (esp Tor and EFF) promote. It all has to be encrypted, anonymized, and immune to FISA orders to be trusted. Leads to rational conclusion to not trust it. Like I said, I'm currently evaluating better options that preserve Gmail's benefits without the surveillance aspects. I've seen a lot of inexpensive, private products (including email) disappear over time with trouble for their users. The recent DDOS attacks also factor into my decision where only the groups with the biggest pipes can take it. Hence, using one such provider as a temporary storage/relay for overall email process. I'm curious what providers you know of have long track record for great uptime, great privacy policies, low cost, and mitigate DDOS attacks we've seen recently. No startups because they disappear all the time.
      - pmoriarty 10y ago
        I've used Fastmail for a long time and I like it. It's only had a couple of brief downtimes in the many years I've used it, and no spam has ever gotten through. But I don't get a lot of email, and I'm not super paranoid about privacy or security (or I'd just run my own mail servers and use anonymous remailers, at the very least). I just try to avoid the huge dragnets that are Google, Facebook, Twitter, and other "social media". I've heard good things about ProtonMail, but have not looked deeply in to it. I'm not sure if there are many good, truly privacy-respecting means of communication on the internet, that aren't a gigantic pain in the ass and don't severely limit who you can securely communicate with (such as, for example, using GPG with a fully vetted web of trust). I also don't have much faith in encryption in the long run. As long as there's a record of your communication, it could be cracked at some point by someone. So I wouldn't place much trust in even the most paranoid digital communication, unless I was forced to. For anything really sensitive, I'd prefer non-electronic, more traditional and primitive means of communication.

pmoriarty 10y ago

When you use Gmail, Google will try to identify you and identify the people who email you, and draw connections between you and inferences from your communication. I really don't understand why someone like you who is evidently seriously against surveillance and who values privacy would give Google more ammunition to do that.

nickpsecurity 10y ago
It's more complex than that. Almost everyone that emails me uses a surveillance-oriented email system since it's free, works well, and uses years of contact information. All of the providers in Five Eyes are currently under mass surveillance at the backbone level by the organizations that are the threat in this discussion. Many are also cooperating with the government in secret per the Snowden leaks. Those that run their own servers usually send the email openly over such backbones to surveillance-oriented providers. The default assumption should be that all free email is being analyzed as you describe by the NSA with a portion handed off to FBI, DHS, IRS, INS, etc. So, we start there. I'm currently quite poor with a need for reliable email for business leads. Of the free ones, Gmail is the most reliable. Of the evil companies, Google does more beneficial things than most like with Android & Chrome which we can modify for privacy. My tradeoff, based on pragmatism, is to support the lesser evil to get what I need while going out of my way to ensure people worried about their safety can contact me anonymously & encrypted. This is until I find a Gmail equivalent. Fastmail is best alternative in terms of uptime & performance per comments I've read but also in Five Eyes territory under mass surveillance. I've gotten to the point, esp seeing turn of events in Switzerland past year, that it's best to assume all email is under mass surveillance by governments, that many cooperate on persons of interest, and possibly with any encryption keys compelled out of them. And we work from there with or without email as the medium with focus on anonymization or end-to-end crypto.
- pmoriarty 10y ago
  There's a difference between protecting yourself from government surveillance (good luck) and protecting yourself from Google's surveillance (possible, to a great extent).
  - nickpsecurity 10y ago
    There is. I just doubt it matters a lot in terms of NeverAgain pledge if the organizations they're concerned about still likely see the traffic anyway. Real concern should go further to make sure that's impossible with right choice of software and services like other organizations (esp Tor and EFF) promote. It all has to be encrypted, anonymized, and immune to FISA orders to be trusted. Leads to rational conclusion to not trust it. Like I said, I'm currently evaluating better options that preserve Gmail's benefits without the surveillance aspects. I've seen a lot of inexpensive, private products (including email) disappear over time with trouble for their users. The recent DDOS attacks also factor into my decision where only the groups with the biggest pipes can take it. Hence, using one such provider as a temporary storage/relay for overall email process. I'm curious what providers you know of have long track record for great uptime, great privacy policies, low cost, and mitigate DDOS attacks we've seen recently. No startups because they disappear all the time.
    - pmoriarty 10y ago
      I've used Fastmail for a long time and I like it. It's only had a couple of brief downtimes in the many years I've used it, and no spam has ever gotten through. But I don't get a lot of email, and I'm not super paranoid about privacy or security (or I'd just run my own mail servers and use anonymous remailers, at the very least). I just try to avoid the huge dragnets that are Google, Facebook, Twitter, and other "social media". I've heard good things about ProtonMail, but have not looked deeply in to it. I'm not sure if there are many good, truly privacy-respecting means of communication on the internet, that aren't a gigantic pain in the ass and don't severely limit who you can securely communicate with (such as, for example, using GPG with a fully vetted web of trust). I also don't have much faith in encryption in the long run. As long as there's a record of your communication, it could be cracked at some point by someone. So I wouldn't place much trust in even the most paranoid digital communication, unless I was forced to. For anything really sensitive, I'd prefer non-electronic, more traditional and primitive means of communication.