3 ms·

It's also pretty self-defeating at all other layers of privacy. There are, obviously, a lot of ways to get away with a crime: you can try to ensure people don'

It's also pretty self-defeating at all other layers of privacy. There are, obviously, a lot of ways to get away with a crime: you can try to ensure people don't know anything happened; that they don't know what happened was a crime; that they don't know you did it; or that they can't prove you did it. If you want to commit a crime for which you will be suspected but escape conviction, plausible deniability (which this isn't) can be a reasonable approach. If you want to live your life without undue surveillance and intrusion, generating 'chaff' like this is ludicrously counterproductive. It amounts to making your search patterns more unusual and adding search terms which might be suspicious in all sorts of ways you didn't foresee. If I search "hot car how long milk safe to drink", it's pretty obvious what I'm thinking. If the extension adds "hot car safety" and "hot car how long", those are more ambiguous. And if it grabs popular suggested searches and picks "hot car kid safety", now it's adding potential surveillance triggers to an innocuous search. Less hypothetically, we already know that the NSA runs full-take collection against people who make certain searches relating to Tails Linux. If you make a non-tracked search on the topic, this could easily permute it into one of the tracked searches. Even philosophically, I'm pretty baffled by the idea that I should improve my privacy by adding an extension which does unpredictable things in my name online...

jstanley 8y ago
> we already know that the NSA runs full-take collection against people who make certain searches relating to Tails Linux Wow, is this actually true? For how long do they continue to collect everything you do? Do you have a source? So all this time people have been saying "lol I'm probably on a list now", they were actually right?!
- Bartweiss 8y ago
  Seemingly yes, I don't know if they continue, yes, and yes. I think that my IP at least is probably on a list, along with a lot of other HN readers. This is a mid-2014 story which didn't get a ton of press traction, I assume for no deeper reason than "people were burned out on specifics-of-surveillance stories after 2013". Original source [1, 2] was Tagesschau, a branch of German public broadcasting, by two high-profile German journalists and Jacob Appelbaum. (People other than Applebaum did review the technical side of things. [3]) It's since run in the standard English publications (Ars, TechDirt, El Reg, etc). I first got it from Bruce Schneier. [4] The document source is somewhat unclear; the publisher hasn't said and it doesn't appear to be from Snowden's leaks. It was published around the time the TAO leaks started. But the document's accuracy (and that of the TAO leaks) is undisputed, and the NSA responded by defending the program instead of denying the report. [5] The surveillance targets were numerous: emails, page visits, usage, and web searches variously relating to Tor, Tails (which was described as "advocated by extremists"), proxy services, and even the Linux Journal! The surveillance scope is unclear; the outlined system targets the full data of a single action then logs the IP for possible followup. One published code segment used deep packet inspection to find emails with links to the Tor homepage, then extracted the full body of those emails. This collection was part of XKeyscore, and presumably had the same targeting standards as the larger program. [4, 5] As for being on a list, the Tor-homepage email filter had an exemption for IPs based in Five Eyes countries. But the other's didn't, so domestic users would presumably have at least been flagged. [4] The presence of a location filter in one tool sort of implies location wasn't being filtered later in the flow, but it's also possible non-email mediums were being filtered in other ways. The NSA statement was of course unhelpful, but includes "The communications of people who are not foreign intelligence targets are of no use to the agency." Given the NSA history of exact-words paltering, it seems significant that it calls those other communications useless, but doesn't say they're not collected. [5] So yes; I think a large fraction of techies and Linux fans probably are on lists for completely innocuous searches. [1] http://www.tagesschau.de/inland/nsa-xkeyscore-100.html http://www.tagesschau.de/inland/nsa-xkeyscore-100.html [2] https://translate.googleusercontent.com/translate_c?depth=1&hl=en&ie=UTF8&prev=_t&rurl=translate.google.com&sl=de&tl=en&u=http://www.tagesschau.de/inland/nsa-xkeyscore-100.html&usg=ALkJrhi2ET6hGN6WzIfHvDy0LolUr8-02g https://translate.googleusercontent.com/translate_c?depth=1&... [3] http://daserste.ndr.de/panorama/aktuell/nsa230_page-1.html http://daserste.ndr.de/panorama/aktuell/nsa230_page-1.html [4] https://www.schneier.com/blog/archives/2014/07/nsa_targets_pri.html https://www.schneier.com/blog/archives/2014/07/nsa_targets_p... [5] https://arstechnica.com/tech-policy/2014/07/report-rare-leaked-nsa-source-code-reveals-tor-servers-targeted/ https://arstechnica.com/tech-policy/2014/07/report-rare-leak...
- mindslight 8y ago
  I've always taken the "I'm probably on a list now" to be the product of cognitive dissonance, and a kind of flirting with the idea of being an outlaw. It's not like the NSA has to optimize to spend fewer resources. Their only constraint is finding a justification for the level of surveillance against any specific individual. And when considering how quick social networks fan out, I would think that's game over for anyone posting here. Honestly given how programmers can be indifferent to legal concerns, I wouldn't be surprised if the actual implementation was optimized to just a list of specific targets to not retain surveillance on. And it's probably comprised of a single herd of cows in Wisconsin. It's prudent to just assume we're all on "a list".

jstanley 8y ago

> we already know that the NSA runs full-take collection against people who make certain searches relating to Tails Linux Wow, is this actually true? For how long do they continue to collect everything you do? Do you have a source? So all this time people have been saying "lol I'm probably on a list now", they were actually right?!

Bartweiss 8y ago
Seemingly yes, I don't know if they continue, yes, and yes. I think that my IP at least is probably on a list, along with a lot of other HN readers. This is a mid-2014 story which didn't get a ton of press traction, I assume for no deeper reason than "people were burned out on specifics-of-surveillance stories after 2013". Original source [1, 2] was Tagesschau, a branch of German public broadcasting, by two high-profile German journalists and Jacob Appelbaum. (People other than Applebaum did review the technical side of things. [3]) It's since run in the standard English publications (Ars, TechDirt, El Reg, etc). I first got it from Bruce Schneier. [4] The document source is somewhat unclear; the publisher hasn't said and it doesn't appear to be from Snowden's leaks. It was published around the time the TAO leaks started. But the document's accuracy (and that of the TAO leaks) is undisputed, and the NSA responded by defending the program instead of denying the report. [5] The surveillance targets were numerous: emails, page visits, usage, and web searches variously relating to Tor, Tails (which was described as "advocated by extremists"), proxy services, and even the Linux Journal! The surveillance scope is unclear; the outlined system targets the full data of a single action then logs the IP for possible followup. One published code segment used deep packet inspection to find emails with links to the Tor homepage, then extracted the full body of those emails. This collection was part of XKeyscore, and presumably had the same targeting standards as the larger program. [4, 5] As for being on a list, the Tor-homepage email filter had an exemption for IPs based in Five Eyes countries. But the other's didn't, so domestic users would presumably have at least been flagged. [4] The presence of a location filter in one tool sort of implies location wasn't being filtered later in the flow, but it's also possible non-email mediums were being filtered in other ways. The NSA statement was of course unhelpful, but includes "The communications of people who are not foreign intelligence targets are of no use to the agency." Given the NSA history of exact-words paltering, it seems significant that it calls those other communications useless, but doesn't say they're not collected. [5] So yes; I think a large fraction of techies and Linux fans probably are on lists for completely innocuous searches. [1] http://www.tagesschau.de/inland/nsa-xkeyscore-100.html http://www.tagesschau.de/inland/nsa-xkeyscore-100.html [2] https://translate.googleusercontent.com/translate_c?depth=1&hl=en&ie=UTF8&prev=_t&rurl=translate.google.com&sl=de&tl=en&u=http://www.tagesschau.de/inland/nsa-xkeyscore-100.html&usg=ALkJrhi2ET6hGN6WzIfHvDy0LolUr8-02g https://translate.googleusercontent.com/translate_c?depth=1&... [3] http://daserste.ndr.de/panorama/aktuell/nsa230_page-1.html http://daserste.ndr.de/panorama/aktuell/nsa230_page-1.html [4] https://www.schneier.com/blog/archives/2014/07/nsa_targets_pri.html https://www.schneier.com/blog/archives/2014/07/nsa_targets_p... [5] https://arstechnica.com/tech-policy/2014/07/report-rare-leaked-nsa-source-code-reveals-tor-servers-targeted/ https://arstechnica.com/tech-policy/2014/07/report-rare-leak...
mindslight 8y ago
I've always taken the "I'm probably on a list now" to be the product of cognitive dissonance, and a kind of flirting with the idea of being an outlaw. It's not like the NSA has to optimize to spend fewer resources. Their only constraint is finding a justification for the level of surveillance against any specific individual. And when considering how quick social networks fan out, I would think that's game over for anyone posting here. Honestly given how programmers can be indifferent to legal concerns, I wouldn't be surprised if the actual implementation was optimized to just a list of specific targets to not retain surveillance on. And it's probably comprised of a single herd of cows in Wisconsin. It's prudent to just assume we're all on "a list".