11 ms·

Over the years I've noticed this, privacy defeatism, amongst other excuses used to push back against security and privacy enhancements. Another is security chi

Over the years I've noticed this, privacy defeatism, amongst other excuses used to push back against security and privacy enhancements. Another is security chicken and egg. "Because A isn't secure, there's no point in securing B. And because B isn't secure, there's no point in securing A." I've seen arguments along those lines used against improving the security of, for example, DNS and SNI. Or just DNS in general. "There's no point in securing DNS because your ISP can see what IP addresses you connect to." The all-or-nothing argument has been used to argue against HTTPS. "State actors like China can circumvent HTTPS, since they control trusted CAs! So why use HTTPS at all?" Then there's the arguments against security because "it makes development harder!" People have argued against mandatory HTTPS saying that it makes developing websites harder. The list goes on. Luckily it seems that pro-security and pro-privacy succeed in the end, for the most part. But those that use these pathological arguments have certainly delayed things more than they should have been.

sametmax 8y ago
The biggest barrier for privacy is not a technical one. It's that most people don't care. We see outrages in a few intellectual or tech saavy niches, like hn, but the average joe has many, many, other priorities before this.
walterbell 8y ago
Speaking of mining, here’s a thread on cryptocurrency ASIC resistance defeatism, similar pattern? https://www.reddit.com/r/CryptoCurrency/comments/7fuh2l/why_asic_resistance_is_a_stupid_idea/ https://www.reddit.com/r/CryptoCurrency/comments/7fuh2l/why_...
extralego 8y ago
It’s also the extent of the anarchy-libertarian stance popular on HN.
- JumpCrisscross 8y ago
  > the anarchy-libertarian stance popular on HN What’s popular in the tech community is some combination of laziness and naive political cynicism masking as strategy or anarcho-libertarianism.
  - throwaway37585 8y ago
    > laziness and naive political cynicism What are you referring to?
blakesterz 8y ago
I've been thinking that the "State actors like..." argument is rather weak because it seems like the more we learn about "State actors" from anywhere the more it seems like they can get around anything. If they happen be be focused on your or your organization it seems like it's just game over no matter what you try to do. Luckily, I guess, securing yourself against state level actors keeps you safe from everyone else that's trying to do bad things, so, win/win?
- kbenson 8y ago
  A "state actor" focusing on you should be considered at least as dangerous (and semi-impossible) to guard against as a dedicated adversary that wants to infiltrate you specifically. Just as with a dedicated adversary, it's no justification not to make it hard for the average or law-abiding citizen and what they can easily come up with. We don't have locks on our front doors to make it impossible for unwanted people to get inside our houses, we do it to prevent the average person, deter the interested criminal, and hopefully give us warning when it is or has happened. > Luckily, I guess, securing yourself against state level actors To be clear, there is no securing yourself against state level actors. You can harden yourself, and reduce your target area and/or footprint, but there's no way to actually make yourself secure.
  - mirimir 8y ago
    > To be clear, there is no securing yourself against state level actors. You can harden yourself, and reduce your target area and/or footprint, but there's no way to actually make yourself secure. Yes. Your best bet is hiding. Once you're identified, it's basically over. It's just another facet of the state monopoly on force.
    - apk17 8y ago
      The force monopoly has little to do with it - few institutions would have the resources to win against the US govt.
      - 8y ago
cm2187 8y ago
Absolutely. Heard that with stateless IPv6 DHCP. "If you can fingerprint the browser, why does it matter that one can use the MAC component of the IPv6 to track people across networks?". Heard on HN...
neverfone 8y ago
I'm not a privacy defeatist, but I am a fingerprinting defeatist. Here's why: I don't think it's realistic for caching and anti-fingerprinting to co-exist, and given those two options users will always pick the former because the latter would be perceived as slow. The classic example is: <script src=foobar.js> Where foobar.js just returns something like "var id=0x1234567", the user who doesn't want to be fingerprinted cannot cache this script because it could be uniquely generated.
- yayana 8y ago
  It would be simple enough to rely on resource hashes to not actually contact the sources of files and then to skip or approve seeking hashes you can't get from your preferred shared caches. Thus a unique file gets ignored by the most anonymity concious. I think there is a chicken and egg here combined with IP incentives to not fix how web browsers work. I hoped the great firewall would have accidentally fixed this by making it preferable to refer to hashes that can be found in peer caches irregardless of CDN status.
  - neverfone 8y ago
    I think you're forgetting that resources cannot be shared if they're marked private. You cannot get account_statement.js from your shared cache, it has to be unique to you. There is no easy fix to this.
    - tripzilch 8y ago
      But, if the server sends you a private resource, this implies the server must already know your identity. Being private it's not supposed to send it to anyone else, so it needs to identify you in order to know "does this user have access to this resource?". Am I missing something here?
      - neverfone 8y ago
        Yes, private doesn't necessarily mean authenticated, it just means shouldn't be saved in a shared cache. For example, "weather_at_your_geoip.js".
oconnor663 8y ago
> "There's no point in securing DNS because your ISP can see what IP addresses you connect to." I don't see the flaw in that one. It does seem kind of extra to secure DNS. What's the argument in favor? > "State actors like China can circumvent HTTPS, since they control trusted CAs! So why use HTTPS at all?" This one I agree is wrong, but not for something-is-better-than-nothing reasons. I think it's wrong because when Chinese CA's abuse their position they get blacklisted: https://arstechnica.com/information-technology/2015/04/google-chrome-will-banish-chinese-certificate-authority-for-breach-of-trust/ https://arstechnica.com/information-technology/2015/04/googl...
- cpeterso 8y ago
  > I don't see the flaw in that one. It does seem kind of extra to secure DNS. What's the argument in favor? If ISPs control your DNS, then they can block domains they don't want you to reach or redirect unknown domains to their own ad pages like Comcast has in the past. If you use someone else's DNS, your ISP could still block network packets sent to certain IP addresses, but they wouldn't want to block all AWS IP addresses just to block one site on AWS. > when Chinese CA's abuse their position they get blacklisted [in Chrome] AFAIK, Chrome has very small market share in China. Most Chinese users use chimeric browsers that combine Chromium and IE's Trident engines. Many Chinese bank and government sites require NPAPI plugins for custom crypto, so the popular browsers can seamlessly switch a tab from Chromium to Trident for sites that are known to require plugins.
  - ummonk 8y ago
    >If you use someone else's DNS, your ISP could still block network packets sent to certain IP addresses, but they wouldn't want to block all AWS IP addresses just to block one site on AWS. Well, that's sort of what Russia did to try to ban Telegram...
    - danShumway 8y ago
      Russia may decide they're OK with blocking AWS. Comcast probably isn't going to do that. Is it really essential that we solve the Russia problem before we solve the Comcast problem? Even on the Russia side of things there are advantages. If you use your ISP's DNS, they can block a specific site or service with very high granularity and zero cost. If you don't, they can still block things, but they have to resort to cruder methods that risk annoying customers/citizens and degrading their overall network health. Over time these extra annoyances might become a kind of death by 1000 cuts, allowing ISPs and countries that don't censor to outperform them in ways that even ordinary, privacy/freedom ambivalent people care about. This is all quite proper. It's healthy for censorship (even when it's possible) to have costs. Where possible, we should try to build technological infrastructure so that networks that censor won't be able to compete on an even ground with the networks that don't.
pmoriarty 8y ago
"your ISP can see what IP addresses you connect to" Why not make some browser extensions that randomly connect to all sorts of websites and download random web pages? There's plenty of bandwidth for us to do that these days, and your real browsing habits should be able to hide in the noise. Of course, for something more sophisticated, the "random" browsing should statistically match real web browsing, to make traffic analysis more difficult.
- notriddle 8y ago
  No. [The Tor people did the math on that][1]. It would probably spell the end of "unlimited home internet at X Mb/s" if it got widely used. [1]: https://www.torproject.org/docs/faq.html.en#SendPadding https://www.torproject.org/docs/faq.html.en#SendPadding
deleted_account 8y ago
I see a parallel between this and digital rights management. Eliminating probabilistic fingerprinting for browsers is always going to be a technical arms race.
rqs 8y ago
Irony. HTTPS deployment in China is going very ... not bad. First and second tier websites already switched it on long ago. Because in China we had an ancient tradition for ISPs to sniff and modify user's traffic to (for example) inject their own affiliation codes to the web request. Those websites hates it of course.
- taneq 8y ago
  Another example of how "untrusted by default" results in a better system.
- forkerenok 8y ago
  > Irony. HTTPS deployment in China is going very ... not bad. Given Chinese govt has been controlling some CAs, China vs. HTTPS irony is.. well, less of an irony :)
  - rqs 8y ago
    On the "CAs is controlled by state" side, some privacy enthusiasts in China already removed those CAs from their system long ago. Go give them some hug and support: https://github.com/chengr28/RevokeChinaCerts https://github.com/chengr28/RevokeChinaCerts And of course, in the context of CA, what's truly important is transparency in the audit process and continuous monitoring. Catch them red handed will end their business[0] once and for all. And so far, most of them are rule-abiding. [0] https://blog.mozilla.org/security/2016/10/24/distrusting-new-wosign-and-startcom-certificates/ https://blog.mozilla.org/security/2016/10/24/distrusting-new...
    - gsnedders 8y ago
      And it's a question of when, and not if, we require CT logs for every certificate the browser sees.
textmode 8y ago
"There's no point in securing DNS because your ISP can see what IP addresses you connect to." Perhaps the ISP has fingerprinted the pages of every website on every shared IP address so they can easily determine which website the user is visiting? Why rely on unencrypted DNS or unencrypted SNI when it is so trivial to map IP addresses to domains. A poor example, but consider this single IP address 216.239.36.21 with a reverse lookup returning a 23M list of 1,283,151 domains. https://api.hackertarget.com/reverseiplookup/?q=216.239.36.21 https://api.hackertarget.com/reverseiplookup/?q=216.239.36.2...
paganel 8y ago
I’m a privacy defeatist because the vast majority of people who argue for things like “https everywhere” and secure DNS nevertheless still use CC payments and buy most of their things online, which practically defeats the whole purpose: your CC-processor or bank now know when and if you’re going to have sex (you bought some condoms with your CC), know your political and ideological affiliations (based on the books you’ve purchased online) etc etc. It’s all pretty much a farse, I’d call it “voodoo privacy”.
- forkerenok 8y ago
  That's ironic that you responded with the points, exact spirit of which the parent rebukes. The issues you are raising are indeed real issues, that will be eventually addressed. And that "eventually" largely depends on the pressure that privacy-minded consumers create. And just because they are not addressed yet, it doesn't mean we shouldn't care about fixing other weak links.
  - paganel 8y ago
    It’s not ironic at all, I’ve read about this discourse about data privacy for at least 10 years, nothing has changed for the better since then, quite the contrary. I for one take active steps in combating it (I very rarely use my CC for purchases, I buy almost nothing online etc), it’s tiring to be lectured on privacy by people who act one way and say a totally different thing.
- godzillabrennus 8y ago
  Merchants don’t typically pass data about items being purchased to merchant providers. Merchants rely on cc info to track consumer behavior. Projects like ShopIn.com give me hope that blockchain may decentralize this data and put control back in consumers hands. If they decide that’s important to them.
- dkersten 8y ago
  Just because one person or entity (the CC company in this case) has all my data doesn’t mean every other person or entity should have it too. The fewer that have your data the better and the more it becomes possible to slowly improve your privacy level. Es, my CC company can infer a lot about me. Yes, they may even be selling that information to others. That doesn’t mean that I want anybody who can MITM my requests to be able to see what I’m doing (or, worse, send me forged content for whatever purpose).

sametmax 8y ago

The biggest barrier for privacy is not a technical one. It's that most people don't care. We see outrages in a few intellectual or tech saavy niches, like hn, but the average joe has many, many, other priorities before this.

walterbell 8y ago

Speaking of mining, here’s a thread on cryptocurrency ASIC resistance defeatism, similar pattern? https://www.reddit.com/r/CryptoCurrency/comments/7fuh2l/why_asic_resistance_is_a_stupid_idea/ https://www.reddit.com/r/CryptoCurrency/comments/7fuh2l/why_...

extralego 8y ago

It’s also the extent of the anarchy-libertarian stance popular on HN.

JumpCrisscross 8y ago
> the anarchy-libertarian stance popular on HN What’s popular in the tech community is some combination of laziness and naive political cynicism masking as strategy or anarcho-libertarianism.
- throwaway37585 8y ago
  > laziness and naive political cynicism What are you referring to?

blakesterz 8y ago

I've been thinking that the "State actors like..." argument is rather weak because it seems like the more we learn about "State actors" from anywhere the more it seems like they can get around anything. If they happen be be focused on your or your organization it seems like it's just game over no matter what you try to do. Luckily, I guess, securing yourself against state level actors keeps you safe from everyone else that's trying to do bad things, so, win/win?

kbenson 8y ago
A "state actor" focusing on you should be considered at least as dangerous (and semi-impossible) to guard against as a dedicated adversary that wants to infiltrate you specifically. Just as with a dedicated adversary, it's no justification not to make it hard for the average or law-abiding citizen and what they can easily come up with. We don't have locks on our front doors to make it impossible for unwanted people to get inside our houses, we do it to prevent the average person, deter the interested criminal, and hopefully give us warning when it is or has happened. > Luckily, I guess, securing yourself against state level actors To be clear, there is no securing yourself against state level actors. You can harden yourself, and reduce your target area and/or footprint, but there's no way to actually make yourself secure.
- mirimir 8y ago
  > To be clear, there is no securing yourself against state level actors. You can harden yourself, and reduce your target area and/or footprint, but there's no way to actually make yourself secure. Yes. Your best bet is hiding. Once you're identified, it's basically over. It's just another facet of the state monopoly on force.
  - apk17 8y ago
    The force monopoly has little to do with it - few institutions would have the resources to win against the US govt.
    - 8y ago

cm2187 8y ago

Absolutely. Heard that with stateless IPv6 DHCP. "If you can fingerprint the browser, why does it matter that one can use the MAC component of the IPv6 to track people across networks?". Heard on HN...

neverfone 8y ago

I'm not a privacy defeatist, but I am a fingerprinting defeatist. Here's why: I don't think it's realistic for caching and anti-fingerprinting to co-exist, and given those two options users will always pick the former because the latter would be perceived as slow. The classic example is: <script src=foobar.js> Where foobar.js just returns something like "var id=0x1234567", the user who doesn't want to be fingerprinted cannot cache this script because it could be uniquely generated.

yayana 8y ago
It would be simple enough to rely on resource hashes to not actually contact the sources of files and then to skip or approve seeking hashes you can't get from your preferred shared caches. Thus a unique file gets ignored by the most anonymity concious. I think there is a chicken and egg here combined with IP incentives to not fix how web browsers work. I hoped the great firewall would have accidentally fixed this by making it preferable to refer to hashes that can be found in peer caches irregardless of CDN status.
- neverfone 8y ago
  I think you're forgetting that resources cannot be shared if they're marked private. You cannot get account_statement.js from your shared cache, it has to be unique to you. There is no easy fix to this.
  - tripzilch 8y ago
    But, if the server sends you a private resource, this implies the server must already know your identity. Being private it's not supposed to send it to anyone else, so it needs to identify you in order to know "does this user have access to this resource?". Am I missing something here?
    - neverfone 8y ago
      Yes, private doesn't necessarily mean authenticated, it just means shouldn't be saved in a shared cache. For example, "weather_at_your_geoip.js".

oconnor663 8y ago

> "There's no point in securing DNS because your ISP can see what IP addresses you connect to." I don't see the flaw in that one. It does seem kind of extra to secure DNS. What's the argument in favor? > "State actors like China can circumvent HTTPS, since they control trusted CAs! So why use HTTPS at all?" This one I agree is wrong, but not for something-is-better-than-nothing reasons. I think it's wrong because when Chinese CA's abuse their position they get blacklisted: https://arstechnica.com/information-technology/2015/04/google-chrome-will-banish-chinese-certificate-authority-for-breach-of-trust/ https://arstechnica.com/information-technology/2015/04/googl...

cpeterso 8y ago
> I don't see the flaw in that one. It does seem kind of extra to secure DNS. What's the argument in favor? If ISPs control your DNS, then they can block domains they don't want you to reach or redirect unknown domains to their own ad pages like Comcast has in the past. If you use someone else's DNS, your ISP could still block network packets sent to certain IP addresses, but they wouldn't want to block all AWS IP addresses just to block one site on AWS. > when Chinese CA's abuse their position they get blacklisted [in Chrome] AFAIK, Chrome has very small market share in China. Most Chinese users use chimeric browsers that combine Chromium and IE's Trident engines. Many Chinese bank and government sites require NPAPI plugins for custom crypto, so the popular browsers can seamlessly switch a tab from Chromium to Trident for sites that are known to require plugins.
- ummonk 8y ago
  >If you use someone else's DNS, your ISP could still block network packets sent to certain IP addresses, but they wouldn't want to block all AWS IP addresses just to block one site on AWS. Well, that's sort of what Russia did to try to ban Telegram...
  - danShumway 8y ago
    Russia may decide they're OK with blocking AWS. Comcast probably isn't going to do that. Is it really essential that we solve the Russia problem before we solve the Comcast problem? Even on the Russia side of things there are advantages. If you use your ISP's DNS, they can block a specific site or service with very high granularity and zero cost. If you don't, they can still block things, but they have to resort to cruder methods that risk annoying customers/citizens and degrading their overall network health. Over time these extra annoyances might become a kind of death by 1000 cuts, allowing ISPs and countries that don't censor to outperform them in ways that even ordinary, privacy/freedom ambivalent people care about. This is all quite proper. It's healthy for censorship (even when it's possible) to have costs. Where possible, we should try to build technological infrastructure so that networks that censor won't be able to compete on an even ground with the networks that don't.

pmoriarty 8y ago

"your ISP can see what IP addresses you connect to" Why not make some browser extensions that randomly connect to all sorts of websites and download random web pages? There's plenty of bandwidth for us to do that these days, and your real browsing habits should be able to hide in the noise. Of course, for something more sophisticated, the "random" browsing should statistically match real web browsing, to make traffic analysis more difficult.

notriddle 8y ago
No. [The Tor people did the math on that][1]. It would probably spell the end of "unlimited home internet at X Mb/s" if it got widely used. [1]: https://www.torproject.org/docs/faq.html.en#SendPadding https://www.torproject.org/docs/faq.html.en#SendPadding

deleted_account 8y ago

I see a parallel between this and digital rights management. Eliminating probabilistic fingerprinting for browsers is always going to be a technical arms race.

rqs 8y ago

Irony. HTTPS deployment in China is going very ... not bad. First and second tier websites already switched it on long ago. Because in China we had an ancient tradition for ISPs to sniff and modify user's traffic to (for example) inject their own affiliation codes to the web request. Those websites hates it of course.

taneq 8y ago
Another example of how "untrusted by default" results in a better system.
forkerenok 8y ago
> Irony. HTTPS deployment in China is going very ... not bad. Given Chinese govt has been controlling some CAs, China vs. HTTPS irony is.. well, less of an irony :)
- rqs 8y ago
  On the "CAs is controlled by state" side, some privacy enthusiasts in China already removed those CAs from their system long ago. Go give them some hug and support: https://github.com/chengr28/RevokeChinaCerts https://github.com/chengr28/RevokeChinaCerts And of course, in the context of CA, what's truly important is transparency in the audit process and continuous monitoring. Catch them red handed will end their business[0] once and for all. And so far, most of them are rule-abiding. [0] https://blog.mozilla.org/security/2016/10/24/distrusting-new-wosign-and-startcom-certificates/ https://blog.mozilla.org/security/2016/10/24/distrusting-new...
  - gsnedders 8y ago
    And it's a question of when, and not if, we require CT logs for every certificate the browser sees.

textmode 8y ago

"There's no point in securing DNS because your ISP can see what IP addresses you connect to." Perhaps the ISP has fingerprinted the pages of every website on every shared IP address so they can easily determine which website the user is visiting? Why rely on unencrypted DNS or unencrypted SNI when it is so trivial to map IP addresses to domains. A poor example, but consider this single IP address 216.239.36.21 with a reverse lookup returning a 23M list of 1,283,151 domains. https://api.hackertarget.com/reverseiplookup/?q=216.239.36.21 https://api.hackertarget.com/reverseiplookup/?q=216.239.36.2...

paganel 8y ago

I’m a privacy defeatist because the vast majority of people who argue for things like “https everywhere” and secure DNS nevertheless still use CC payments and buy most of their things online, which practically defeats the whole purpose: your CC-processor or bank now know when and if you’re going to have sex (you bought some condoms with your CC), know your political and ideological affiliations (based on the books you’ve purchased online) etc etc. It’s all pretty much a farse, I’d call it “voodoo privacy”.

forkerenok 8y ago
That's ironic that you responded with the points, exact spirit of which the parent rebukes. The issues you are raising are indeed real issues, that will be eventually addressed. And that "eventually" largely depends on the pressure that privacy-minded consumers create. And just because they are not addressed yet, it doesn't mean we shouldn't care about fixing other weak links.
- paganel 8y ago
  It’s not ironic at all, I’ve read about this discourse about data privacy for at least 10 years, nothing has changed for the better since then, quite the contrary. I for one take active steps in combating it (I very rarely use my CC for purchases, I buy almost nothing online etc), it’s tiring to be lectured on privacy by people who act one way and say a totally different thing.
godzillabrennus 8y ago
Merchants don’t typically pass data about items being purchased to merchant providers. Merchants rely on cc info to track consumer behavior. Projects like ShopIn.com give me hope that blockchain may decentralize this data and put control back in consumers hands. If they decide that’s important to them.
dkersten 8y ago
Just because one person or entity (the CC company in this case) has all my data doesn’t mean every other person or entity should have it too. The fewer that have your data the better and the more it becomes possible to slowly improve your privacy level. Es, my CC company can infer a lot about me. Yes, they may even be selling that information to others. That doesn’t mean that I want anybody who can MITM my requests to be able to see what I’m doing (or, worse, send me forged content for whatever purpose).