7 ms·

I've argued here at HN before that I don't think this is a technological problem, but a social one. There is nothing that stops a powerful enough actor from bre

I've argued here at HN before that I don't think this is a technological problem, but a social one. There is nothing that stops a powerful enough actor from breaking encryption with a rubber hose, except for a strong stigma against that kind of behavior. We need to give digital privacy the same social protection. The other problem with making a purely technical solution is that you leave out people who are not capable of using that solution because they do not have the resources, education or capability.

fiatjaf 9y ago
Solving the problem with technology is 1000000 times easier than solving it from the "social" side.
- confounded 9y ago
  Is it? For who? Do you think people's data would be more secure at the border if - You kernal-hacked iOS so that it booted into a vanilla account upon entry of a certain passcode, and encouraged people to install your hack from GitHub, potentially borking their phones - People couldn't be compelled (or face being denied entry) to allow search of their electronic devices ? What about trying to do everything via a VPN and spoofed UA strings vs. PII being banned from sale, heavily taxed, or a meaningful opt-out existing? Or even just DNT having a legal basis?
  - blfr 9y ago
    Is it? For who? For HN readers. And probably in general. As for your questions, I would definitely like to first use software which doesn't compromise my privacy and security and only as a very distant second have some bureaucrat who would maybe in the best case scenario fine a company which leaks my data. The vote I cast by running a Tor relay is much more meaningful and valuable defence of privacy than a vote in the general elections. By orders of magnitude.
    - confounded 9y ago
      Don't get me wrong, I'm all for using technology to preserve privacy. > The vote I cast by running a Tor relay is much more meaningful and valuable defence of privacy than a vote in the general elections. I kind of agree, but, not if the new leader outlaws using Tor tomorrow, as they have in China and Iran, and are attempting to do in Russia and France. > bureaucrat who would maybe in the best case scenario fine a company which leaks my data You may be selling the power of legislation short. It has the power to entirely transform the default business model of the Internet away from surveillance capitalism, for example. In terms of privacy, this would eliminate entire classes of "threat". We frequently under-estimate our power as technologists to influence these things; we have very much more than a single vote. The narrative of 'technology' in the media is almost entirely that of billionaires and spies, and the media are gradually starting to realize that they're being led along. Getting the voice of technologists to explain the societal impacts of technology policy is a problem that we need to identify with as group.
  - SeanDav 9y ago
    Let's say you have your data secured with Ultimate Encryption Method. A couple of thugs appear at your door and mention that if you don't un-encrypt that data, they will send these very compromising photographs of you to very public places. Ultimate Encryption Method has just been trivially bypassed.
    - pdimitar 9y ago
      Agreed, and I am very sure governments have been doing that many times since they can force you to keep quiet -- and they got away with very criminal methods probably tens of thousands of times. Hence, the good crypto is really only the most basic first step. Full privacy should be the second and a very important step. Fine, I might have an account in <insert-trendy-social-network-here>. Fine, my real name is known there. OK. But there are plethora of cases where having a user profile and personally identifiable information is simply not necessary -- like web search. Even e-commerce like Amazon can be mostly anonymized: you can pay with an e-gold kind of currency (Bitcoin, Ethereum) and Amazon can only ask politely another API if the goods are deliverable to your address (while Amazon won't have an idea about your physical address). Then, even if that mystical-another-API has your physical address, at least it's not in the hands of Amazon -- fragmentation of personal info gives us a small degree of protection, even if Amazon can eventually procure the info under the table. Hey, every little bit helps. Make surveillance expensive and many will drop it (not everybody of course, I recognize that). Again, every little bit helps. Of course, due to a mountain of vested interests, nobody is talking about such technical solutions. "They" want your info all over the net. It's easier for them, so why change anything? The current status quo is sadly very logical. Back to your example, thugs will just be angrily gnawing at their nails if they have no idea who you are and where you live.
- stinkytaco 9y ago
  Sure, if you're a fairly affluent and educated hacker news reader. But there are far more people who I routinely work with who struggle with the concept of a password but need to use the internet to apply for work, register for disability, social security, communicate with family, etc. Do those people deserve less privacy?
  - fiatjaf 9y ago
    Nom they deserve the same privacy. I wish there was a solution for them, but I don't think there is. Better software and newer generations that know how to use them will, however, come before anyone can make a government that respects his population.
    - pdimitar 9y ago
      Stuff like Apple's FaceID might help. I am eagerly awaiting to see how will Apple entrench it in their services because I am sure they will.
- Fice 9y ago
  A decentralized technology only works until some corporation with large advertising resources creates a proprietary centralized service around it and most people flock to their offering. E.g. Bitcoin is becoming centralized around popular online wallets, exchanges and pools; email was supposed to be decentralized, but now most people use Gmail; etc. We will not achieve full decentralization until it becomes both technological and social norm.
  - pdimitar 9y ago
    Sadly I agree, Homo Sapiens hasn't collectively evolved enough to recognize the dangers of centralization. However, what we can do is make decentralized tech absolutely idiot-proof and put it in the hands of non-technical users. If it's convenient, fast and reliable, it will at least have an equal footing against the centralized services. Let's get to that point and fight the other battle you mentioned then.
pdimitar 9y ago
I agree. The biggest problem in this age is having a strong encryption that is user-friendly. The common wisdom says it's impossible to combine the two. I disagree with it but I don't have the time to try and work in the area, nor am I an expert. IMO it's a good cause to work on anyhow. Furthermore, spies aren't stopped by social stigma. Even if the whole planet agrees in one voice wiretapping shouldn't be done (never gonna happen) the spies can always deny that they're spying. It's not like any of us can actually prove that any agency is indeed wiretapping. Morality is, in the technical sense, optional. It cannot be enforced. Thus it's unreliable.
- stinkytaco 9y ago
  > strong encryption that is user-friendly Not enough, in my opinion. Where most people will fail is on the opsec side. They just don't understand security best practices. I realize that not all problems can be solved, but technology is not just encryption, it's understanding how the technology works so you can avoid leaking information in the hundreds of other ways that are possible on the Internet.

fiatjaf 9y ago

Solving the problem with technology is 1000000 times easier than solving it from the "social" side.

confounded 9y ago
Is it? For who? Do you think people's data would be more secure at the border if - You kernal-hacked iOS so that it booted into a vanilla account upon entry of a certain passcode, and encouraged people to install your hack from GitHub, potentially borking their phones - People couldn't be compelled (or face being denied entry) to allow search of their electronic devices ? What about trying to do everything via a VPN and spoofed UA strings vs. PII being banned from sale, heavily taxed, or a meaningful opt-out existing? Or even just DNT having a legal basis?
- blfr 9y ago
  Is it? For who? For HN readers. And probably in general. As for your questions, I would definitely like to first use software which doesn't compromise my privacy and security and only as a very distant second have some bureaucrat who would maybe in the best case scenario fine a company which leaks my data. The vote I cast by running a Tor relay is much more meaningful and valuable defence of privacy than a vote in the general elections. By orders of magnitude.
  - confounded 9y ago
    Don't get me wrong, I'm all for using technology to preserve privacy. > The vote I cast by running a Tor relay is much more meaningful and valuable defence of privacy than a vote in the general elections. I kind of agree, but, not if the new leader outlaws using Tor tomorrow, as they have in China and Iran, and are attempting to do in Russia and France. > bureaucrat who would maybe in the best case scenario fine a company which leaks my data You may be selling the power of legislation short. It has the power to entirely transform the default business model of the Internet away from surveillance capitalism, for example. In terms of privacy, this would eliminate entire classes of "threat". We frequently under-estimate our power as technologists to influence these things; we have very much more than a single vote. The narrative of 'technology' in the media is almost entirely that of billionaires and spies, and the media are gradually starting to realize that they're being led along. Getting the voice of technologists to explain the societal impacts of technology policy is a problem that we need to identify with as group.
- SeanDav 9y ago
  Let's say you have your data secured with Ultimate Encryption Method. A couple of thugs appear at your door and mention that if you don't un-encrypt that data, they will send these very compromising photographs of you to very public places. Ultimate Encryption Method has just been trivially bypassed.
  - pdimitar 9y ago
    Agreed, and I am very sure governments have been doing that many times since they can force you to keep quiet -- and they got away with very criminal methods probably tens of thousands of times. Hence, the good crypto is really only the most basic first step. Full privacy should be the second and a very important step. Fine, I might have an account in <insert-trendy-social-network-here>. Fine, my real name is known there. OK. But there are plethora of cases where having a user profile and personally identifiable information is simply not necessary -- like web search. Even e-commerce like Amazon can be mostly anonymized: you can pay with an e-gold kind of currency (Bitcoin, Ethereum) and Amazon can only ask politely another API if the goods are deliverable to your address (while Amazon won't have an idea about your physical address). Then, even if that mystical-another-API has your physical address, at least it's not in the hands of Amazon -- fragmentation of personal info gives us a small degree of protection, even if Amazon can eventually procure the info under the table. Hey, every little bit helps. Make surveillance expensive and many will drop it (not everybody of course, I recognize that). Again, every little bit helps. Of course, due to a mountain of vested interests, nobody is talking about such technical solutions. "They" want your info all over the net. It's easier for them, so why change anything? The current status quo is sadly very logical. Back to your example, thugs will just be angrily gnawing at their nails if they have no idea who you are and where you live.
stinkytaco 9y ago
Sure, if you're a fairly affluent and educated hacker news reader. But there are far more people who I routinely work with who struggle with the concept of a password but need to use the internet to apply for work, register for disability, social security, communicate with family, etc. Do those people deserve less privacy?
- fiatjaf 9y ago
  Nom they deserve the same privacy. I wish there was a solution for them, but I don't think there is. Better software and newer generations that know how to use them will, however, come before anyone can make a government that respects his population.
  - pdimitar 9y ago
    Stuff like Apple's FaceID might help. I am eagerly awaiting to see how will Apple entrench it in their services because I am sure they will.
Fice 9y ago
A decentralized technology only works until some corporation with large advertising resources creates a proprietary centralized service around it and most people flock to their offering. E.g. Bitcoin is becoming centralized around popular online wallets, exchanges and pools; email was supposed to be decentralized, but now most people use Gmail; etc. We will not achieve full decentralization until it becomes both technological and social norm.
- pdimitar 9y ago
  Sadly I agree, Homo Sapiens hasn't collectively evolved enough to recognize the dangers of centralization. However, what we can do is make decentralized tech absolutely idiot-proof and put it in the hands of non-technical users. If it's convenient, fast and reliable, it will at least have an equal footing against the centralized services. Let's get to that point and fight the other battle you mentioned then.

pdimitar 9y ago

I agree. The biggest problem in this age is having a strong encryption that is user-friendly. The common wisdom says it's impossible to combine the two. I disagree with it but I don't have the time to try and work in the area, nor am I an expert. IMO it's a good cause to work on anyhow. Furthermore, spies aren't stopped by social stigma. Even if the whole planet agrees in one voice wiretapping shouldn't be done (never gonna happen) the spies can always deny that they're spying. It's not like any of us can actually prove that any agency is indeed wiretapping. Morality is, in the technical sense, optional. It cannot be enforced. Thus it's unreliable.

stinkytaco 9y ago
> strong encryption that is user-friendly Not enough, in my opinion. Where most people will fail is on the opsec side. They just don't understand security best practices. I realize that not all problems can be solved, but technology is not just encryption, it's understanding how the technology works so you can avoid leaking information in the hundreds of other ways that are possible on the Internet.