6 ms·

> if you search for «illegal Irish potato recipes», it’ll inject similar searches such as «fun Irish drinking games» and «funny potato pictures». Google will no

> if you search for «illegal Irish potato recipes», it’ll inject similar searches such as «fun Irish drinking games» and «funny potato pictures». Google will now see your relevant but also irrelevant queries making it hard to distinguish what you actually searched for. This will give us a layer of «plausible deniability» in case anyone accuses you of a crime you never committed based on your search history stored at Google. This is pretty implausibly deniable. "Yes, officer, I know my computer searched for that, but that's only because I installed some software to deliberately search for things so that if I ever got suspected of a crime based on my search history I'd be able to tell you that it might not have been me"

raxxorrax 8y ago
In a time before the current political generation we actually created laws against surveillance. These laws are also valid for executive organs like police and secret services. Time to bring that back.
tyingq 8y ago
You could go for the plausible insanity defense angle, having it occasionally inject things like: "How to sculpt myself an imaginary friend from butter"
- achievingApathy 8y ago
  At that point, would he still be imaginary?
Bartweiss 8y ago
It's also pretty self-defeating at all other layers of privacy. There are, obviously, a lot of ways to get away with a crime: you can try to ensure people don't know anything happened; that they don't know what happened was a crime; that they don't know you did it; or that they can't prove you did it. If you want to commit a crime for which you will be suspected but escape conviction, plausible deniability (which this isn't) can be a reasonable approach. If you want to live your life without undue surveillance and intrusion, generating 'chaff' like this is ludicrously counterproductive. It amounts to making your search patterns more unusual and adding search terms which might be suspicious in all sorts of ways you didn't foresee. If I search "hot car how long milk safe to drink", it's pretty obvious what I'm thinking. If the extension adds "hot car safety" and "hot car how long", those are more ambiguous. And if it grabs popular suggested searches and picks "hot car kid safety", now it's adding potential surveillance triggers to an innocuous search. Less hypothetically, we already know that the NSA runs full-take collection against people who make certain searches relating to Tails Linux. If you make a non-tracked search on the topic, this could easily permute it into one of the tracked searches. Even philosophically, I'm pretty baffled by the idea that I should improve my privacy by adding an extension which does unpredictable things in my name online...
- jstanley 8y ago
  > we already know that the NSA runs full-take collection against people who make certain searches relating to Tails Linux Wow, is this actually true? For how long do they continue to collect everything you do? Do you have a source? So all this time people have been saying "lol I'm probably on a list now", they were actually right?!
  - Bartweiss 8y ago
    Seemingly yes, I don't know if they continue, yes, and yes. I think that my IP at least is probably on a list, along with a lot of other HN readers. This is a mid-2014 story which didn't get a ton of press traction, I assume for no deeper reason than "people were burned out on specifics-of-surveillance stories after 2013". Original source [1, 2] was Tagesschau, a branch of German public broadcasting, by two high-profile German journalists and Jacob Appelbaum. (People other than Applebaum did review the technical side of things. [3]) It's since run in the standard English publications (Ars, TechDirt, El Reg, etc). I first got it from Bruce Schneier. [4] The document source is somewhat unclear; the publisher hasn't said and it doesn't appear to be from Snowden's leaks. It was published around the time the TAO leaks started. But the document's accuracy (and that of the TAO leaks) is undisputed, and the NSA responded by defending the program instead of denying the report. [5] The surveillance targets were numerous: emails, page visits, usage, and web searches variously relating to Tor, Tails (which was described as "advocated by extremists"), proxy services, and even the Linux Journal! The surveillance scope is unclear; the outlined system targets the full data of a single action then logs the IP for possible followup. One published code segment used deep packet inspection to find emails with links to the Tor homepage, then extracted the full body of those emails. This collection was part of XKeyscore, and presumably had the same targeting standards as the larger program. [4, 5] As for being on a list, the Tor-homepage email filter had an exemption for IPs based in Five Eyes countries. But the other's didn't, so domestic users would presumably have at least been flagged. [4] The presence of a location filter in one tool sort of implies location wasn't being filtered later in the flow, but it's also possible non-email mediums were being filtered in other ways. The NSA statement was of course unhelpful, but includes "The communications of people who are not foreign intelligence targets are of no use to the agency." Given the NSA history of exact-words paltering, it seems significant that it calls those other communications useless, but doesn't say they're not collected. [5] So yes; I think a large fraction of techies and Linux fans probably are on lists for completely innocuous searches. [1] http://www.tagesschau.de/inland/nsa-xkeyscore-100.html http://www.tagesschau.de/inland/nsa-xkeyscore-100.html [2] https://translate.googleusercontent.com/translate_c?depth=1&hl=en&ie=UTF8&prev=_t&rurl=translate.google.com&sl=de&tl=en&u=http://www.tagesschau.de/inland/nsa-xkeyscore-100.html&usg=ALkJrhi2ET6hGN6WzIfHvDy0LolUr8-02g https://translate.googleusercontent.com/translate_c?depth=1&... [3] http://daserste.ndr.de/panorama/aktuell/nsa230_page-1.html http://daserste.ndr.de/panorama/aktuell/nsa230_page-1.html [4] https://www.schneier.com/blog/archives/2014/07/nsa_targets_pri.html https://www.schneier.com/blog/archives/2014/07/nsa_targets_p... [5] https://arstechnica.com/tech-policy/2014/07/report-rare-leaked-nsa-source-code-reveals-tor-servers-targeted/ https://arstechnica.com/tech-policy/2014/07/report-rare-leak...
mindslight 8y ago
Most forms of plausible deniability rely on enough people casually adopting them so that the presence of the software is expected rather than abnormal. This extension is not there yet. Which means yes, if your intent is to commit a crime, then it's a poor idea to install this extension. But if you're an innocent person who simply wants to protest/undermine the idea of surveilled searches, then it makes sense to increase adoption. Even better would be to get say Mozilla to include it in the default install. Although I'd personally be happy if they just worked on addressing the security issues highlighted by Panopticlick.

raxxorrax 8y ago

In a time before the current political generation we actually created laws against surveillance. These laws are also valid for executive organs like police and secret services. Time to bring that back.

tyingq 8y ago

You could go for the plausible insanity defense angle, having it occasionally inject things like: "How to sculpt myself an imaginary friend from butter"

achievingApathy 8y ago
At that point, would he still be imaginary?

Bartweiss 8y ago

It's also pretty self-defeating at all other layers of privacy. There are, obviously, a lot of ways to get away with a crime: you can try to ensure people don't know anything happened; that they don't know what happened was a crime; that they don't know you did it; or that they can't prove you did it. If you want to commit a crime for which you will be suspected but escape conviction, plausible deniability (which this isn't) can be a reasonable approach. If you want to live your life without undue surveillance and intrusion, generating 'chaff' like this is ludicrously counterproductive. It amounts to making your search patterns more unusual and adding search terms which might be suspicious in all sorts of ways you didn't foresee. If I search "hot car how long milk safe to drink", it's pretty obvious what I'm thinking. If the extension adds "hot car safety" and "hot car how long", those are more ambiguous. And if it grabs popular suggested searches and picks "hot car kid safety", now it's adding potential surveillance triggers to an innocuous search. Less hypothetically, we already know that the NSA runs full-take collection against people who make certain searches relating to Tails Linux. If you make a non-tracked search on the topic, this could easily permute it into one of the tracked searches. Even philosophically, I'm pretty baffled by the idea that I should improve my privacy by adding an extension which does unpredictable things in my name online...

jstanley 8y ago
> we already know that the NSA runs full-take collection against people who make certain searches relating to Tails Linux Wow, is this actually true? For how long do they continue to collect everything you do? Do you have a source? So all this time people have been saying "lol I'm probably on a list now", they were actually right?!
- Bartweiss 8y ago
  Seemingly yes, I don't know if they continue, yes, and yes. I think that my IP at least is probably on a list, along with a lot of other HN readers. This is a mid-2014 story which didn't get a ton of press traction, I assume for no deeper reason than "people were burned out on specifics-of-surveillance stories after 2013". Original source [1, 2] was Tagesschau, a branch of German public broadcasting, by two high-profile German journalists and Jacob Appelbaum. (People other than Applebaum did review the technical side of things. [3]) It's since run in the standard English publications (Ars, TechDirt, El Reg, etc). I first got it from Bruce Schneier. [4] The document source is somewhat unclear; the publisher hasn't said and it doesn't appear to be from Snowden's leaks. It was published around the time the TAO leaks started. But the document's accuracy (and that of the TAO leaks) is undisputed, and the NSA responded by defending the program instead of denying the report. [5] The surveillance targets were numerous: emails, page visits, usage, and web searches variously relating to Tor, Tails (which was described as "advocated by extremists"), proxy services, and even the Linux Journal! The surveillance scope is unclear; the outlined system targets the full data of a single action then logs the IP for possible followup. One published code segment used deep packet inspection to find emails with links to the Tor homepage, then extracted the full body of those emails. This collection was part of XKeyscore, and presumably had the same targeting standards as the larger program. [4, 5] As for being on a list, the Tor-homepage email filter had an exemption for IPs based in Five Eyes countries. But the other's didn't, so domestic users would presumably have at least been flagged. [4] The presence of a location filter in one tool sort of implies location wasn't being filtered later in the flow, but it's also possible non-email mediums were being filtered in other ways. The NSA statement was of course unhelpful, but includes "The communications of people who are not foreign intelligence targets are of no use to the agency." Given the NSA history of exact-words paltering, it seems significant that it calls those other communications useless, but doesn't say they're not collected. [5] So yes; I think a large fraction of techies and Linux fans probably are on lists for completely innocuous searches. [1] http://www.tagesschau.de/inland/nsa-xkeyscore-100.html http://www.tagesschau.de/inland/nsa-xkeyscore-100.html [2] https://translate.googleusercontent.com/translate_c?depth=1&hl=en&ie=UTF8&prev=_t&rurl=translate.google.com&sl=de&tl=en&u=http://www.tagesschau.de/inland/nsa-xkeyscore-100.html&usg=ALkJrhi2ET6hGN6WzIfHvDy0LolUr8-02g https://translate.googleusercontent.com/translate_c?depth=1&... [3] http://daserste.ndr.de/panorama/aktuell/nsa230_page-1.html http://daserste.ndr.de/panorama/aktuell/nsa230_page-1.html [4] https://www.schneier.com/blog/archives/2014/07/nsa_targets_pri.html https://www.schneier.com/blog/archives/2014/07/nsa_targets_p... [5] https://arstechnica.com/tech-policy/2014/07/report-rare-leaked-nsa-source-code-reveals-tor-servers-targeted/ https://arstechnica.com/tech-policy/2014/07/report-rare-leak...

mindslight 8y ago

Most forms of plausible deniability rely on enough people casually adopting them so that the presence of the software is expected rather than abnormal. This extension is not there yet. Which means yes, if your intent is to commit a crime, then it's a poor idea to install this extension. But if you're an innocent person who simply wants to protest/undermine the idea of surveilled searches, then it makes sense to increase adoption. Even better would be to get say Mozilla to include it in the default install. Although I'd personally be happy if they just worked on addressing the security issues highlighted by Panopticlick.