6 ms·

Metadata is the real data

221 points by mobitar 9y ago

neom 9y ago
Anyone using Standard Notes? Might give it a shot if it comes recommended.
- simplehuman 9y ago
  Not using standard notes but I love the idea behind it. I personally use a selfhosted meemo for my notes (https://meemo.minimal-space.de https://meemo.minimal-space.de).
- jordanmoconnor 9y ago
  I've been using the free version for the past several weeks and have been enjoying it. I am an avid Keep user, and StandardNotes has all but replaced that. I find it refreshing writing in markdown for minimal formatting, and the interface gets out of your way to let you write. I'd give it a try if you're wondering!
  - StavrosK 9y ago
    Does it support Markdown? I wrote a list with asterisks and it didn't get "rich" formatting.
    - mobitar 9y ago
      Markdown is supported through editor extensions: https://standardnotes.org/extensions https://standardnotes.org/extensions
atemerev 9y ago
The right to encrypt is the right to privacy. Communications on the Internet are public by default; this is something that human civilization never experienced before. If you want to make your conversation or your behavior private, you have to encrypt it. But there were many other things that human civilization never experienced before, and we adapted. Right to encryption is, indeed, an essential natural right. People who deny it are the same people who think that everybody should have a government-supplied monitoring camera in every room of every home, and fail to understand what's wrong with it.
- macspoofing 9y ago
  >The right to encrypt is the right to privacy. Is there no right to encrypt? Because no government can actually prevent you from encrypting anything and the maths behind cryptography are openly taught and researched in all modern states. So are you saying that governments should never have the right to compel you to decrypt what you encrypted (by, for example, a fine or a prison term)?
  - atemerev 9y ago
    In the same vein, there is no right to life, there's right of not being killed.
    - Santosh83 9y ago
      And despite centuries of civilisation, this is actually true, under the surface of civility and sophistication. Human beings understand what they ought NOT to do better than what they ought. We're wired that way.
  - JBReefer 9y ago
    The right to encrypt - unlike the current debate over a right to healthcare - is a negative right: All men are born able to encrypt (given the math), it can only be taken away. Positive rights, like healthcare or Social Security, are a thing that you are not born with that is given to you. The government does not have to provide you with encryption software in order for you to encrypt. That is to say, I think you are correct and that right does exist.
    - rileymat2 9y ago
      With respect to healthcare isn't it more complicated? As regulations/laws can interfere with a negative right like the ability to self medicate?
  - giobox 9y ago
    While encryption is of course just maths, governments have done a surprisingly effective job in the past controlling access to research and implementation. Granted this is significantly harder now with much wider proliferation of the internet. While this may not deter those with a technical interest much, it definitely does affect 'average users'. As one concrete example, Netscape's SSL implementation was originally shipped in two versions - the 'secure' US version, and a severely compromised international download version, due to export controls on the encryption method used. I'd also argue it's still not fully 'open' in the US - there's still a legal requirement to notify the government of any open source release of new cryptographic technologies, and some restrictions on distribution still exist. I also don't think it's a major stretch to imagine we are just one more San Bernadino style tragedy away from the first western government legislating to ban/compromise cellphone storage encryption, especially with the current US and UK political climates. One can only hope after San Bernadino that Apple has began preparing in earnest for that fight - I can't see any other big players having the moral conviction. https://www.apache.org/dev/crypto.html https://www.apache.org/dev/crypto.html https://en.wikipedia.org/wiki/Crypto_Wars https://en.wikipedia.org/wiki/Crypto_Wars https://en.wikipedia.org/wiki/Export_of_cryptography_from_the_United_States https://en.wikipedia.org/wiki/Export_of_cryptography_from_th...
theprop 9y ago
Correct & important to grow awareness about! Sadly many so-called private email or other services claim just encrypting your content brings you privacy...while ignoring/failing to discuss the metadata.
cryptonector 9y ago
You can encrypt all you like. It won't help. Suppose you encrypt all your SMTP/SUBMIT traffic. If your upstream is a commercial provider, then they will be subject to subpoenas. If you run your own upstream, then watching who it connects to will often be sufficient to gather metadata of interest. Consider TLS. Before you can use it you must have used DNS. Today all DNS resolution goes in the clear. So game over right there. Eventually your client's DNS communication with a shared recursive resolver will not be in the clear, but the operator of that resolver will be subject to subpoenas, so game still over. Let's say we did deploy DJB's encrypted DNS solution. Well, you can still see which domains people are talking to, roughly, at least as long as they don't share nameservers, and if they do... You can see where this is going. Now let's say you did get DNS resolution securely anyways, well, now you have to connect to some IP address, and if it's not hosting many services, then game over, and if it is hosting many services, then SNI will be game over anyways (TLS 1.3 requires SNI). SNI cannot be encrypted. The problem really is that metadata can't really be encrypted. Mind you, criminals are defeated by data encryption -- mostly anyways. And forcing governments to use subpoenas does mean increasing the cost of metadata gathering. Plus there won't be infinite retention requirements, perhaps. So, encryption does help somewhat, which means we must do it -- it's just not a complete solution.
- amelius 9y ago
  > Today all DNS resolution goes in the clear. Yes, but I suppose you could decrease the signal-to-noise ratio by doing random DNS searches.
  - tgragnato 9y ago
    Setting up unbound to use dnssec and tor is super-easy too. And once you set up the router, the cost of configuration is zero.
    - fulafel 9y ago
      Dnssec still has your data in the clear, it just signs the data. (And is not supported by most domains)
yawnbox 9y ago
Concerning encryption, privacy, and the U.S. Constitution: Confidentiality - First, Fourth, and Fifth Amendments Integrity - First and Fourth Amendments Availability - First and Fourth Amendments
legostormtroopr 9y ago
Descriptive metadata - please, please stop misusing a term thats existed since the 1970's - https://www.youtube.com/watch?v=L0vOg18ncWE https://www.youtube.com/watch?v=L0vOg18ncWE Conflating the term "metadata" with "descriptive metadata" and "metadata retention" makes it harder for data archives to get people to provide "structural metadata" (aka. the real metadata), that effectively describes the schemas and data structures of academic and open government data. Yes, descriptive metadata retention is a huge problem, but say that instead of abbreviating terms in a way that obfuscates the issue use the full term.
bshoemaker 9y ago
Are there any companies that sell something like privacy as a service? It seems sorely needed that someone work on this

221 points by mobitar 9y ago

neom 9y ago

Anyone using Standard Notes? Might give it a shot if it comes recommended.

simplehuman 9y ago
Not using standard notes but I love the idea behind it. I personally use a selfhosted meemo for my notes (https://meemo.minimal-space.de https://meemo.minimal-space.de).
jordanmoconnor 9y ago
I've been using the free version for the past several weeks and have been enjoying it. I am an avid Keep user, and StandardNotes has all but replaced that. I find it refreshing writing in markdown for minimal formatting, and the interface gets out of your way to let you write. I'd give it a try if you're wondering!
- StavrosK 9y ago
  Does it support Markdown? I wrote a list with asterisks and it didn't get "rich" formatting.
  - mobitar 9y ago
    Markdown is supported through editor extensions: https://standardnotes.org/extensions https://standardnotes.org/extensions

atemerev 9y ago

The right to encrypt is the right to privacy. Communications on the Internet are public by default; this is something that human civilization never experienced before. If you want to make your conversation or your behavior private, you have to encrypt it. But there were many other things that human civilization never experienced before, and we adapted. Right to encryption is, indeed, an essential natural right. People who deny it are the same people who think that everybody should have a government-supplied monitoring camera in every room of every home, and fail to understand what's wrong with it.

macspoofing 9y ago
>The right to encrypt is the right to privacy. Is there no right to encrypt? Because no government can actually prevent you from encrypting anything and the maths behind cryptography are openly taught and researched in all modern states. So are you saying that governments should never have the right to compel you to decrypt what you encrypted (by, for example, a fine or a prison term)?
- atemerev 9y ago
  In the same vein, there is no right to life, there's right of not being killed.
  - Santosh83 9y ago
    And despite centuries of civilisation, this is actually true, under the surface of civility and sophistication. Human beings understand what they ought NOT to do better than what they ought. We're wired that way.
- JBReefer 9y ago
  The right to encrypt - unlike the current debate over a right to healthcare - is a negative right: All men are born able to encrypt (given the math), it can only be taken away. Positive rights, like healthcare or Social Security, are a thing that you are not born with that is given to you. The government does not have to provide you with encryption software in order for you to encrypt. That is to say, I think you are correct and that right does exist.
  - rileymat2 9y ago
    With respect to healthcare isn't it more complicated? As regulations/laws can interfere with a negative right like the ability to self medicate?
- giobox 9y ago
  While encryption is of course just maths, governments have done a surprisingly effective job in the past controlling access to research and implementation. Granted this is significantly harder now with much wider proliferation of the internet. While this may not deter those with a technical interest much, it definitely does affect 'average users'. As one concrete example, Netscape's SSL implementation was originally shipped in two versions - the 'secure' US version, and a severely compromised international download version, due to export controls on the encryption method used. I'd also argue it's still not fully 'open' in the US - there's still a legal requirement to notify the government of any open source release of new cryptographic technologies, and some restrictions on distribution still exist. I also don't think it's a major stretch to imagine we are just one more San Bernadino style tragedy away from the first western government legislating to ban/compromise cellphone storage encryption, especially with the current US and UK political climates. One can only hope after San Bernadino that Apple has began preparing in earnest for that fight - I can't see any other big players having the moral conviction. https://www.apache.org/dev/crypto.html https://www.apache.org/dev/crypto.html https://en.wikipedia.org/wiki/Crypto_Wars https://en.wikipedia.org/wiki/Crypto_Wars https://en.wikipedia.org/wiki/Export_of_cryptography_from_the_United_States https://en.wikipedia.org/wiki/Export_of_cryptography_from_th...

theprop 9y ago

Correct & important to grow awareness about! Sadly many so-called private email or other services claim just encrypting your content brings you privacy...while ignoring/failing to discuss the metadata.

cryptonector 9y ago

You can encrypt all you like. It won't help. Suppose you encrypt all your SMTP/SUBMIT traffic. If your upstream is a commercial provider, then they will be subject to subpoenas. If you run your own upstream, then watching who it connects to will often be sufficient to gather metadata of interest. Consider TLS. Before you can use it you must have used DNS. Today all DNS resolution goes in the clear. So game over right there. Eventually your client's DNS communication with a shared recursive resolver will not be in the clear, but the operator of that resolver will be subject to subpoenas, so game still over. Let's say we did deploy DJB's encrypted DNS solution. Well, you can still see which domains people are talking to, roughly, at least as long as they don't share nameservers, and if they do... You can see where this is going. Now let's say you did get DNS resolution securely anyways, well, now you have to connect to some IP address, and if it's not hosting many services, then game over, and if it is hosting many services, then SNI will be game over anyways (TLS 1.3 requires SNI). SNI cannot be encrypted. The problem really is that metadata can't really be encrypted. Mind you, criminals are defeated by data encryption -- mostly anyways. And forcing governments to use subpoenas does mean increasing the cost of metadata gathering. Plus there won't be infinite retention requirements, perhaps. So, encryption does help somewhat, which means we must do it -- it's just not a complete solution.

amelius 9y ago
> Today all DNS resolution goes in the clear. Yes, but I suppose you could decrease the signal-to-noise ratio by doing random DNS searches.
- tgragnato 9y ago
  Setting up unbound to use dnssec and tor is super-easy too. And once you set up the router, the cost of configuration is zero.
  - fulafel 9y ago
    Dnssec still has your data in the clear, it just signs the data. (And is not supported by most domains)

yawnbox 9y ago

Concerning encryption, privacy, and the U.S. Constitution: Confidentiality - First, Fourth, and Fifth Amendments Integrity - First and Fourth Amendments Availability - First and Fourth Amendments

legostormtroopr 9y ago

Descriptive metadata - please, please stop misusing a term thats existed since the 1970's - https://www.youtube.com/watch?v=L0vOg18ncWE https://www.youtube.com/watch?v=L0vOg18ncWE Conflating the term "metadata" with "descriptive metadata" and "metadata retention" makes it harder for data archives to get people to provide "structural metadata" (aka. the real metadata), that effectively describes the schemas and data structures of academic and open government data. Yes, descriptive metadata retention is a huge problem, but say that instead of abbreviating terms in a way that obfuscates the issue use the full term.

bshoemaker 9y ago

Are there any companies that sell something like privacy as a service? It seems sorely needed that someone work on this