5 ms·

Surely the final solution to this problem is a community-based one - one that decentralises the tech giants? I'm still struggling to figure out why a cohesive,

Surely the final solution to this problem is a community-based one - one that decentralises the tech giants? I'm still struggling to figure out why a cohesive, widespread, community-driven solution hasn't emerged yet. Anybody have any ideas as to why?

deleted 8y ago
[deleted]
pjc50 8y ago
- winner-take-all economics created the giants - similar forces drive techies: would you rather make Facebook for free or for a billion dollars? - tech culture doesn't understand community building - some censorship / legal control is absolutely necessary lest you become the child porn network, or crown in spam
- mirimir 8y ago
  > some censorship / legal control is absolutely necessary lest you become the child porn network, or crown in spam Arguably, "becom[ing] the child porn network" is the only proof that you can't be compromised. Because assholes will eventually migrate to the most secure options.
  - adventured 8y ago
    The assholes migrated to TOR. They were wrong, their migration didn't act as a proof. You can always be compromised a dozen different ways if you're breaking the law (in the US) and your adversary has the resources and reach of the US Federal Government. You're fucked, period, if they're on to you and determined. We keep seeing this demonstrated over and over and over again. There are always flaws somewhere.
    - mirimir 8y ago
      As I read the evidence, you're only fucked if your OPSEC is weak. Sure there have been lots of high-profile takedowns. But I only know of one case where a bug in Tor per se compromised users. That was CMU exploitation of the relay-early bug. That's how they got PlayPen. And then they ran it as a honeypot, serving phone-home malware, and nailed lots of users. But in every other case that I'm aware of, OPSEC failure led to pwnage. Freedom Hosting. Silk Road 1. Sheep Marketplace. So can you point to another case where defects in Tor design or practice got people pwned? I doubt it. But even so, I am concerned that the absence of such news just reflects parallel construction. And finally, it's not enough to just rely on Tor. In my opinion, one should always use Tor through a nested VPN chain, comprising servers from at least three different VPN providers. That way, adversaries must compromise both Tor and the VPN services. Also, it's crucial to never run servers in places that can be associated with you. Because the more traffic there is, especially if an adversary can control traffic flow, the easier it is to do traffic correlation.
      - pdkl95 8y ago
        > you're only fucked if your OPSEC is weak The problem is that actually implementing not-weak OPSEC is much harder than most people understand (even those with technical backgrounds). For example, is your "secret" activity on TOR easily tied to your non-secret activity from a search of network entry/exit times (i.e. "secret" activity is the complement "non-secret" activity)? I recommend Zoz's DEFCON talk, "Don't Fuck It Up!"[1], for a very good overview of how hard OPSEC has become. [1] https://www.youtube.com/watch?v=J1q4Ir2J8P8 https://www.youtube.com/watch?v=J1q4Ir2J8P8
        mirimir 8y ago
        True. Good OPSEC is nontrivial. But in my case, all of my online activity uses part of the same nested VPN chain. Then I branch the chain for opennet vs Tor traffic. So an adversary would need to get data from multiple VPN providers, just to know what involved Tor. And it's not at all very hard.[0] Also, about OPSEC, see my review.[1] 0) See https://www.ivpn.net/privacy-guides/advanced-privacy-and-anonymity-part-1 https://www.ivpn.net/privacy-guides/advanced-privacy-and-ano... 1) https://www.ivpn.net/privacy-guides/online-privacy-through-opsec-and-compartmentalization-part-1 https://www.ivpn.net/privacy-guides/online-privacy-through-o...
- NL807 8y ago
  Then there is convenience. Average user prefers low cognitive load when using computing equipment or applications. Certain decentralised approaches are bit more difficult to understand and/or get it to work. Same goes with security.
brandonjm 8y ago
To put it simply: It's easier said and theorised than done. The easiest to use, most consistent and stable system is always going to be a centralised system and these cost money. Once money is involved it starts to become a company and be bound to the laws the countries want. Unless someone can solve the known problems with decentralised systems while simultaneously making the system as easy to onboard and use as the tech giants can we will never have a truly competitive open source equivalent the products of tech giants.
- jstanley 8y ago
  > as easy to onboard and use as the tech giants It doesn't need to be as easy to onboard and use. Freedom from censorship and surveillance is worth an awful lot of inconvenience in initial setup, and more people learn that every day.
mirimir 8y ago
Well, there's Tor, I2P, and good old Freenet. But I2P is too small, and Freenet users are too readily targetable. And once suspicious peers can be globally targeted, it's hard to imagine how even decentralized systems could be viable. The best I've come up with is a P2P mix network which used some covert channel. For plausible deniability, it would need to spread as malware, pretty much like WannaCry did (both virus-like and worm-like). But obviously, it wouldn't do anything horrible on inadvertently infected systems, except perhaps relay some traffic. And yeah, it's a horrible idea. But what else is possible, if using unauthorized encryption itself becomes illegal?
ohthehugemanate 8y ago
Technologically, it's end to end encryption, with forward secrecy. Done. We have lots of commercial and non commercial products that do this, from PGP to Signal. Even WhatsApp does it. Eventually, the elderly, uninformed US government is going to pass a law requiring a back door. And two things will happen: - someone nefarious will get the private key, and do something nefarious with it. (Hopefully no one will die) - offshore private messaging will become a thing. There's a market for bith insecure-but-endorsed and secure-but-illegal, to be sure. And the 5 eyes will probably fight for decades to squash private messaging. For a worst case scenario, see the war on drugs for an example of how this could go.
- mirimir 8y ago
  Yeah, I recently researched a piece on secure messaging apps. Briar and Ricochet are the only arguably secure ones. They're both P2P, and use Tor .onion services. Tox and Ring are also both P2P, but peer IPs are readily discoverable, so users are vulnerable to identity compromise. For the rest, all bets are off. Signal, Telegram and WhatsApp say in their privacy policies that they may disclose such account information as IP address and phone number when legally required. And there are no others that protect against identity compromise.
- jstanley 8y ago
  > Eventually, the elderly, uninformed US government is going to pass a law requiring a back door. Eventually, the elederly, uninformed governments are going to die off, to be replaced with younger governments. Still uninformed, but hopefully less tyrannical. > offshore private messaging will become a thing. This won't have to happen. Just because the law says there has to be a backdoor doesn't mean open source software developers will comply. Develop your software anonymously, release it anonymously, and run it wherever you want. It doesn't need to be a service provided by a company in a foreign land, it can just be software you run on your own computer.
  - cyphar 8y ago
    > Still uninformed, but hopefully less tyrannical. I don't think this is a reasonable thing to just hope for. Historically, governments have always had tyrannical streaks and I don't think it makes much sense to simply assert that "this time it'll be different". It probably won't.
deleted 8y ago
[deleted]

deleted 8y ago

[deleted]

pjc50 8y ago

- winner-take-all economics created the giants - similar forces drive techies: would you rather make Facebook for free or for a billion dollars? - tech culture doesn't understand community building - some censorship / legal control is absolutely necessary lest you become the child porn network, or crown in spam

mirimir 8y ago
> some censorship / legal control is absolutely necessary lest you become the child porn network, or crown in spam Arguably, "becom[ing] the child porn network" is the only proof that you can't be compromised. Because assholes will eventually migrate to the most secure options.
- adventured 8y ago
  The assholes migrated to TOR. They were wrong, their migration didn't act as a proof. You can always be compromised a dozen different ways if you're breaking the law (in the US) and your adversary has the resources and reach of the US Federal Government. You're fucked, period, if they're on to you and determined. We keep seeing this demonstrated over and over and over again. There are always flaws somewhere.
  - mirimir 8y ago
    As I read the evidence, you're only fucked if your OPSEC is weak. Sure there have been lots of high-profile takedowns. But I only know of one case where a bug in Tor per se compromised users. That was CMU exploitation of the relay-early bug. That's how they got PlayPen. And then they ran it as a honeypot, serving phone-home malware, and nailed lots of users. But in every other case that I'm aware of, OPSEC failure led to pwnage. Freedom Hosting. Silk Road 1. Sheep Marketplace. So can you point to another case where defects in Tor design or practice got people pwned? I doubt it. But even so, I am concerned that the absence of such news just reflects parallel construction. And finally, it's not enough to just rely on Tor. In my opinion, one should always use Tor through a nested VPN chain, comprising servers from at least three different VPN providers. That way, adversaries must compromise both Tor and the VPN services. Also, it's crucial to never run servers in places that can be associated with you. Because the more traffic there is, especially if an adversary can control traffic flow, the easier it is to do traffic correlation.
    - pdkl95 8y ago
      > you're only fucked if your OPSEC is weak The problem is that actually implementing not-weak OPSEC is much harder than most people understand (even those with technical backgrounds). For example, is your "secret" activity on TOR easily tied to your non-secret activity from a search of network entry/exit times (i.e. "secret" activity is the complement "non-secret" activity)? I recommend Zoz's DEFCON talk, "Don't Fuck It Up!"[1], for a very good overview of how hard OPSEC has become. [1] https://www.youtube.com/watch?v=J1q4Ir2J8P8 https://www.youtube.com/watch?v=J1q4Ir2J8P8
      - mirimir 8y ago
        True. Good OPSEC is nontrivial. But in my case, all of my online activity uses part of the same nested VPN chain. Then I branch the chain for opennet vs Tor traffic. So an adversary would need to get data from multiple VPN providers, just to know what involved Tor. And it's not at all very hard.[0] Also, about OPSEC, see my review.[1] 0) See https://www.ivpn.net/privacy-guides/advanced-privacy-and-anonymity-part-1 https://www.ivpn.net/privacy-guides/advanced-privacy-and-ano... 1) https://www.ivpn.net/privacy-guides/online-privacy-through-opsec-and-compartmentalization-part-1 https://www.ivpn.net/privacy-guides/online-privacy-through-o...
NL807 8y ago
Then there is convenience. Average user prefers low cognitive load when using computing equipment or applications. Certain decentralised approaches are bit more difficult to understand and/or get it to work. Same goes with security.

brandonjm 8y ago

To put it simply: It's easier said and theorised than done. The easiest to use, most consistent and stable system is always going to be a centralised system and these cost money. Once money is involved it starts to become a company and be bound to the laws the countries want. Unless someone can solve the known problems with decentralised systems while simultaneously making the system as easy to onboard and use as the tech giants can we will never have a truly competitive open source equivalent the products of tech giants.

jstanley 8y ago
> as easy to onboard and use as the tech giants It doesn't need to be as easy to onboard and use. Freedom from censorship and surveillance is worth an awful lot of inconvenience in initial setup, and more people learn that every day.

mirimir 8y ago

Well, there's Tor, I2P, and good old Freenet. But I2P is too small, and Freenet users are too readily targetable. And once suspicious peers can be globally targeted, it's hard to imagine how even decentralized systems could be viable. The best I've come up with is a P2P mix network which used some covert channel. For plausible deniability, it would need to spread as malware, pretty much like WannaCry did (both virus-like and worm-like). But obviously, it wouldn't do anything horrible on inadvertently infected systems, except perhaps relay some traffic. And yeah, it's a horrible idea. But what else is possible, if using unauthorized encryption itself becomes illegal?

ohthehugemanate 8y ago

Technologically, it's end to end encryption, with forward secrecy. Done. We have lots of commercial and non commercial products that do this, from PGP to Signal. Even WhatsApp does it. Eventually, the elderly, uninformed US government is going to pass a law requiring a back door. And two things will happen: - someone nefarious will get the private key, and do something nefarious with it. (Hopefully no one will die) - offshore private messaging will become a thing. There's a market for bith insecure-but-endorsed and secure-but-illegal, to be sure. And the 5 eyes will probably fight for decades to squash private messaging. For a worst case scenario, see the war on drugs for an example of how this could go.

mirimir 8y ago
Yeah, I recently researched a piece on secure messaging apps. Briar and Ricochet are the only arguably secure ones. They're both P2P, and use Tor .onion services. Tox and Ring are also both P2P, but peer IPs are readily discoverable, so users are vulnerable to identity compromise. For the rest, all bets are off. Signal, Telegram and WhatsApp say in their privacy policies that they may disclose such account information as IP address and phone number when legally required. And there are no others that protect against identity compromise.
jstanley 8y ago
> Eventually, the elderly, uninformed US government is going to pass a law requiring a back door. Eventually, the elederly, uninformed governments are going to die off, to be replaced with younger governments. Still uninformed, but hopefully less tyrannical. > offshore private messaging will become a thing. This won't have to happen. Just because the law says there has to be a backdoor doesn't mean open source software developers will comply. Develop your software anonymously, release it anonymously, and run it wherever you want. It doesn't need to be a service provided by a company in a foreign land, it can just be software you run on your own computer.
- cyphar 8y ago
  > Still uninformed, but hopefully less tyrannical. I don't think this is a reasonable thing to just hope for. Historically, governments have always had tyrannical streaks and I don't think it makes much sense to simply assert that "this time it'll be different". It probably won't.

deleted 8y ago

[deleted]