17 ms·
China's social network surveillance databases are apparently leaked to Internet
- techie128 8y agosigh I don't condone surveillance. It is a reality of life. However, I would expect that it is done responsibly and securely. I don't consider surveillance a big violation BUT doing a poor job at protecting the collected data is an egregious violation of privacy.
- mirimir 8y agoWhy? Who will hurt you more than authorities can?
- trsfgbb 8y ago1
- Krasnol 8y ago> Government doesn't care about me Until they do. Hi from Germany.
- PavlovsCat 8y agohttps://www.youtube.com/watch?v=CpvAdeAv8KI&t=1h18m06s https://www.youtube.com/watch?v=CpvAdeAv8KI&t=1h18m06s This is the timeline we live in now, this is how it's turning out, this is who we are becoming, and it makes me sick to my stomach.
- cf141q5325 8y agoYou dont even have to worry only about your own/current government. Take the Netherlands, with detailed census data (conveniently as punchcards) about their population before the German invasion. With the threat of an invasion looming some suggested to at least trike out the information about religious believes. Unfortunately this didnt happen. Amsterdam had one of the highest rates of deported Jews for a reason.
- ummonk 8y agoIn the case of the US, the government is bound by due process, at least theoretically, which makes it far less likely to hurt me than private entities. Granted, that may not be the case when it comes to China.
- zAy0LfpBZLC8mAC 8y agoThat's putting the cart before the house. Due process isn't an agent that enforces your rights, due process is a convention of how things are done. Nothing fundamentally prevents anyone from simply not following due process, other than the actual power structure of society, i.e., what people could get away with. That actual power structure depends on stuff like knowing things about people allowing you to control them. To illustrate what I mean: If your opponent can blackmail all judges, there is no due process for you.
- throw2016 8y agoDue process can also be used to oppress. Totalitarian systems are about 'process'. Customs officers going through your personal papers in US airports like the stasi is 'due process'. Secret courts and secret orders are also 'due process', not being able to speak out against arbitrary gag orders is also 'due process'. Whistle blowers and activists being harassed, surveilled or infiltrated by law enforcement or not a single person being held to account after the NSA revelations is 'due process'. Users being spied and stalked on by an assortment of SV companies and state agencies via the internet, phones, facial recognition, licence plates do not seem to have access to the basic right to privacy or any recourse to due process. These binary statements about 'rule of law', 'due process', dissent, democracy comes across as theoretical and disconnected from the complexity and events in the real world.
- stunt 8y agoWell, perhaps the fact that you justify surveillance is mostly the result of what those organizations have done around the world.
- simonh 8y agoThe only reason to collect data is to use it and those collecting and storing the data are fully responsible for how it is used. The reasons for collecting and retaining it should be explicitly stated and it should only be used for those purposes. It doesn't matter who is doing it - Facebook, Google, a random web site or a government.
- Sniffnoy 8y agoNon-mobile link: https://twitter.com/0xDUDE/status/1101917885100945409 https://twitter.com/0xDUDE/status/1101917885100945409
- dang 8y agoFixed, thanks.
- Laforet 8y agoFrom the screencaps it looks like surveillance systems used to monitor internet cafes and public access points where people must use their real ID to login, so it's a bit easier to link accounts to actual identities. A number of these IM suits are actually encrypted in transit that it's very unlikely that this level of interception is possible without a root certificate installed on the client machine.
- ubercow13 8y agoCouldn't this data be coming directly from these IM services' servers? I doubt any of them are E2EE.
- Laforet 8y agoIt's possible but I really doubt it, considering the sheer volume of message being generated every moment. It would be much easier and less likely to have hiccups like these if they just give them server access on demand, rather than having a live data feed replicated to 18 separate locations. Moreover the tweets actually show names and addresses of various internet cafes in one of the pictures. This information should not be available if the data is coming from the service provider's backend. Contrary to popular opinion on HN and other forums in the Anglosphere, surveillance in China is a nuanced problem and tech companies are far from completely passive. Local police are often denied when they request information because technically they lack jurisdiction on companies located in a different town or province. As a result they resort to catch-all interception using devices like these makeshift DPI systems(there is no clear legal requirement, but internet cafe owners are easily coerced into installing them or risk having their business hut down over various infractions) and Stingray-like fake cell sites (a constant source of conflict with major telcos because they are often poorly installed and would interfere with normal cell sites). These ad-hoc schemes are usually put together by the lowest bidder, so they tend to be horribly inefficient and insecure like what's been shown in this case. But to local LE it's still preferable to going dark, not to mention there is usually little accountability when their system breaks.
- 6nf 8y ago
- amrrs 8y agoIs there any research that proves the causal relationship between surveillance and crime rate ? I've been constantly shut up with this statement "Don't you want your country to be safe" when I talk about privacy intrusion by Govt .
- notanum 8y agoIt's classified
- setquk 8y agoBased on this leak, probably not for long
- _cs2017_ 8y agoThere's no convincing research that establishes causality on such complex sociological matters, since you can't create clean experiments, and observations are not useful since there are too many confounding factors. However, you don't really need research on this, it's obvious that surveillance offers meaningful safety benefits. I think the problem some people have with surveillance is that its costs may outweigh its benefits. For example surveillance can be used to shift political system in the authoritarian direction, by suppressing political opposition. It can be used to sustain inequality since it provides those with money or power a powerful leverage to entrench their positions. It can be used by corrupt officials and hackers to commit serious crimes (partly offsetting its crime reduction benefits). Finally, even if surveillance isn't abused, it can be uncomfortable to some people who just don't like being watched.
- zAy0LfpBZLC8mAC 8y ago> partly offsetting its crime reduction benefits No, potentially outweighing them. There is no reason to think surveillance cannot enable more crime than it solves, and the more surveillance you have the more likely that gets.
- _cs2017_ 8y ago
- chj 8y agoWe knew this all alone, but seeing the screenshot still turns my blood boiling. FK THEM
- rawmodz 8y agoThank you sir for digging into this. In fact, Chinese government monitors everything they want, such as qq, wechat, weibo and emails. They know your eaxact locations and behaviors and they ignore human rights. They just want to put you into jail if you say bad of the government.
- ubercow13 8y agoWhy are you copying the first twitter reply here?
- Scoundreller 8y ago> And the most remarkable part is that this network syncs all this data to open MongoDBs in 18 locations. Lol, again. I recall in a previous list of open MongoDBs, the Chinese equivalent of the US Food and Drug Administration had an open MongoDB.
- arthurcolle 8y agois the _index key common to nosql dbs? looks like elastic at first glance, but i haven't used mongodb ever
- Scoundreller 8y agoHow typical is it for the Chinese to use English headers in their DBs? Could this “solution” be off the shelf, or developed by non-Chinese? The front-end users wouldn’t see the backend structure. Along with some native English speaker names like “CertificateNo” for certificate number.
- qlk1123 8y agoAs a non-latin language user, I can say that we do use English headers most of the time because nobody wants to deal with potential locale/coding problems.
- est 8y ago> How typical is it for the Chinese to use English headers in their DBs? very typical. because unicode table names or key names are rare.
- arthurcolle 8y agoWhere are these leaks available?
- deckar01 8y agoIt sounds like the leak is just the mongodb instances being open to incoming traffic from the internet without authentication. This a common problem with MongoDB, because its default configuration is insecure.
- throwawau3243 8y agoI wonder if India's neighbor also engages in "our ability to arrest you proves our network is secure" tactic. Aadhar, the BS cattle-tagging project is premised on this principle, while they ship Indian citizens' information to Inqtel backed corporations ... because "it's nationalist" to do so.
- xv11921 8y agoWhy are comments that criticize governments always downvoted? Sorry moderators, I have read the guidelines, but Aadhaar is BS.
- virgakwolfw 8y agoHe will be a Hero of China in 21 century to save Chinese from communist party.
- dang 8y agoPlease keep political and ideological flamebait off HN. Ditto for nationalistic flamebait.
- Sendotsh 8y agoIt's a copy/paste of one of the comments on Twitter. No idea to what purpose though. https://twitter.com/xiaojianguo2013/status/1102394626219130882?s=20 https://twitter.com/xiaojianguo2013/status/11023946262191308...
- mnemotechny 8y agoBut who need it?
- rqs 8y ago> The most dialogs which are being monitored are typical teenager conversations. In the picture "你还用说我大", "那是衣服紧" (Translate: "You don't need to tell me that mines was big", "That's because the cloth is tight"). I don't know about the "typical" thing due to lack of context. But my sense tells me, that "teenager" is doing some sex talk. Another one: "说:!收【【【46--48道士号】】】卖的微信XXXXXXXXXXX" ("Buying 46~48 level Taoist account, contact me using WeChat XXXXXXXXXXX"). I guess this person is trying to buy a in-game character. Taoist is a type of character similar to magician. I think the message is captured by some type of Internet Cafe managing software, which can be installed on the machine so the admin could remotely control and "auditing" it. Typical feature includes shutdown, force logout, timer etc. I don't know it can also record chat messages, but the fact it can does not surprise me that much to be honest.
- uses 8y agoJust leaving aside for a second what a crime against humanity this surveillance is... It never ceases to amaze me how many of these massive data leaks are simply "mongodb in default configuration". I just don't understand how it was thought, at any point in time, to be a good idea that mongodb in its default configuration, would be open to the world with no authentication.
- ressetera 8y agoWho are the leakers and how easy would it be for the government to track them?
- SZJX 8y agoThe opening statement of the author is really overblown and sensationalist. Only at the end of the thread did he admit that all data there apparently come from net cafes, but 1. there is no evidence that messages from private devices are being included in this database 2. one has to understand that China is vast, and each local authority differs a lot from the next one in deciding what it does. It totally wouldn't surprise me that the local authorities of several cities/provinces decided to sign a contract with this net cafe management software provider, who essentially installs a spyware on each net cafe computer and routes the traffic to the police. Doesn't suggest it's any sort of coordinated, deliberate action from the central government though. Comparing it to PRISM and NSA is highly misleading and irresponsible, and just putting a blanket word "China's" in the title is inaccurate. Sadly it's how most news stories are done these days.