6 ms·

>Free Speech is not a privacy issue, and medical and financial records being public will not limit your ability to speak out. If one cannot communicate private

by lhnn 16y ago

>Free Speech is not a privacy issue, and medical and financial records being public will not limit your ability to speak out. If one cannot communicate private information without worrying about its release to the public, one may be pressured internally NOT to speak as one would wish.

jacquesm 16y ago
That's reaching, private communications can be protected quite effectively by encryption, and having your private communications released to the public means that at least one person who should not have had access to that data get their hands on it. So only in the case that all those conditions are met and the person we're talking about is embarrassed to the point where they'd rather shut up than speak out (in which case I'd call them a coward) does that come true.
- tptacek 16y ago
  Because clearly, if you encrypted your communications, Assange would never dream of publishing it once it was broken.
  - jacquesm 16y ago
    He'd have to break it first. From what I get all this stuff was in plaintext, not even the most basic precautions were taken to limit access.
    - scott_s 16y ago
      The communication may have been encrypted, but the storage at the end points may not have.
      - jacquesm 16y ago
        Somehow I find it hard to blame wikileaks for that.
        scott_s 16y ago
        That was not my point. My understanding of the discussion: someone pointed out a potential result of the leaks is that government employees may not communication frankly because of the leaks. You brought up encryption as a means to counter that. I pointed out that encryption of the communication itself does not necessarily mean it is stored encrypted. I brought that up because I feel it takes encryption out of the discussion; I don't think it's relevant to the original point made.
        jacquesm 16y ago
        Sorry, it is my understanding that if you value your data enough to protect it in transit that you should protect it equally strong at the endpoints.
        scott_s 16y ago
        Okay, granted. But my point was that has no relevance to the lhnn's point: http://news.ycombinator.com/item?id=1950776 http://news.ycombinator.com/item?id=1950776
      - krschultz 16y ago
        That's not true either. The end points can be encrypted by every techonology imaginable, that only prevents people who shouldn't be able to access the data from accessing it. The guy who leaked this stuff was granted access to it. He had the passwords to open everything he leaked, so the problem is not (a possible) lack of encryption but the fact that he was able to access so much without anyone noticing. He seemingly downloaded more files than one person could read in a year, how was this not noticed?
        scott_s 16y ago
        What's not true? I pointed out something that may be the case because I thought it was relevant to the discussion.
        yread 16y ago
        The weird thing is that wikileaks were said to be breaking encryption on the Apache video. And that was supposed to be also from Manning
    - tptacek 16y ago
      This is a "might makes right" argument and it's garbage. I'm not close to the scariest person breaking systems. And I'm appalled on a biweekly basis by what I can manage to get software to cough up. One person's "basic precaution" is another's "failure so spectacular it demands an example be made of its author". You aren't OK with a world governed by the ethic you just alluded to. You're only OK with invoking it to make a haphazard argument. I absolutely do place blame on the people charged with protecting the information that got leaked. But that has nothing whatsoever to do with WL's culpability.
      - jacquesm 16y ago
        > One person's "basic precaution" is another's "failure so spectacular it demands an example be made of its author". The American Government and it's diplomatic services are currently being made an example of. > You aren't OK with a world governed by the ethic you just alluded to. That's an assumption. > You're only OK with invoking it to make a haphazard argument. I think it's pretty solid. If you are in charge of material that you deem important enough to stamp it 'secret' then you should take basic precautions, if you do not then you only have yourself to blame. Not locking your house is stupid, even if burglary is wrong. > I absolutely do place blame on the people charged with protecting the information that got leaked. Good. > But that has nothing whatsoever to do with WL's culpability. Indeed, it doesn't because as far as I know they're not culpable. The investigation in to the leak has so far been limited to those in the employ of the US government, and again, as far as I know wikileaks and its associates have not been charged with any crimes or even misdemeanors related to these leaks. The 'if you've got nothing to hide you've got nothing to fear' mantra cuts both ways. I don't agree with it when applied to the general public, and I just as much don't agree with it when applying it to the government. The difference is that I would expect the government to at least be somewhat capable when it comes to dealing with data that is deemed sensitive. So maybe your point is that crypto is pointless because no matter what information will be leaked and therefore the recipients of the leaked data should have culpability but that is a world governed by an ethic that I'm not ok with.
        tptacek 16y ago
        Your argument is incoherent. It will be modded up because it supports Wikileaks, but understand between the two of us that it is a stupid argument, and I think less of you for making it. People who leave their front doors unlocked are not themselves responsible for burglary. Burglars are responsible for buglary. Information security people in the US government were apparently negligent with information they were charged with protecting. But those people weren't information owners or stakeholders.
  - forza 16y ago
    I've always found your attitude strange for someone working in security. Especially in military intelligence the name of the game is protect yourself or you only have yourself to blame. The main reason we are seeing this leak is because too many and/or the wrong people had access to the data, which is also why it's mostly "raw data".
    - tptacek 16y ago
      What's your point? Try to hold these two thoughts together in your head: whoever was charged with protecting this information was negligent, and whoever actually leaked it is responsible for their own actions.
      - jacquesm 16y ago
        > Try to hold these two thoughts together in your head That's skirting the edge of an ad-hominem attack, maybe even crossing the line. For someone of your stature that is a pretty bad example to set. > whoever was charged with protecting this information was negligent, and whoever actually leaked it is responsible for their own actions. Neither of those are Assange. So, the new world we live in: if information is leaked it will instantly reach an audience of millions. Plan accordingly.
- ori_b 16y ago
  And - in a large organization, where you need to communicate patient information to a potentially significant number of doctors, for example - what prevents one unscrupulous doctor from posting the information in plain text when it gets decrypted? Encryption works fine for trusted communication, but it's not a solution when the people posting the information are also potential valid recipients.
  - jacquesm 16y ago
    This is absolutely true, which is why I'm categorically against long lived record keeping in centralized databases when it comes to stuff like this. Eventually it will hit the street and eventually it will be abused, you can pretty much count on it. That's also the reason why I have yet to get a new passport because I don't think the government should have my fingerprints on file, given their history with respect to data loss and internal abuse cases.
gloob 16y ago
Then it is whoever is causing the internal pressure that is harming freedom of speech.
- scott_s 16y ago
  Sometimes it's self-censorship. If people don't trust that their own communication will remain confidential, they may censor themselves.
- ori_b 16y ago
  Yes and no. If you know that stuff you say confidentially could be leaked at any time, you would be pressuring yourself to keep your lips sealed - at least, if you're ethical and care about privacy.

by lhnn 16y ago

jacquesm 16y ago

That's reaching, private communications can be protected quite effectively by encryption, and having your private communications released to the public means that at least one person who should not have had access to that data get their hands on it. So only in the case that all those conditions are met and the person we're talking about is embarrassed to the point where they'd rather shut up than speak out (in which case I'd call them a coward) does that come true.

tptacek 16y ago
Because clearly, if you encrypted your communications, Assange would never dream of publishing it once it was broken.
- jacquesm 16y ago
  He'd have to break it first. From what I get all this stuff was in plaintext, not even the most basic precautions were taken to limit access.
  - scott_s 16y ago
    The communication may have been encrypted, but the storage at the end points may not have.
    - jacquesm 16y ago
      Somehow I find it hard to blame wikileaks for that.
      - scott_s 16y ago
        That was not my point. My understanding of the discussion: someone pointed out a potential result of the leaks is that government employees may not communication frankly because of the leaks. You brought up encryption as a means to counter that. I pointed out that encryption of the communication itself does not necessarily mean it is stored encrypted. I brought that up because I feel it takes encryption out of the discussion; I don't think it's relevant to the original point made.
        jacquesm 16y ago
        Sorry, it is my understanding that if you value your data enough to protect it in transit that you should protect it equally strong at the endpoints.
        scott_s 16y ago
        Okay, granted. But my point was that has no relevance to the lhnn's point: http://news.ycombinator.com/item?id=1950776 http://news.ycombinator.com/item?id=1950776
    - krschultz 16y ago
      That's not true either. The end points can be encrypted by every techonology imaginable, that only prevents people who shouldn't be able to access the data from accessing it. The guy who leaked this stuff was granted access to it. He had the passwords to open everything he leaked, so the problem is not (a possible) lack of encryption but the fact that he was able to access so much without anyone noticing. He seemingly downloaded more files than one person could read in a year, how was this not noticed?
      - scott_s 16y ago
        What's not true? I pointed out something that may be the case because I thought it was relevant to the discussion.
      - yread 16y ago
        The weird thing is that wikileaks were said to be breaking encryption on the Apache video. And that was supposed to be also from Manning
  - tptacek 16y ago
    This is a "might makes right" argument and it's garbage. I'm not close to the scariest person breaking systems. And I'm appalled on a biweekly basis by what I can manage to get software to cough up. One person's "basic precaution" is another's "failure so spectacular it demands an example be made of its author". You aren't OK with a world governed by the ethic you just alluded to. You're only OK with invoking it to make a haphazard argument. I absolutely do place blame on the people charged with protecting the information that got leaked. But that has nothing whatsoever to do with WL's culpability.
    - jacquesm 16y ago
      > One person's "basic precaution" is another's "failure so spectacular it demands an example be made of its author". The American Government and it's diplomatic services are currently being made an example of. > You aren't OK with a world governed by the ethic you just alluded to. That's an assumption. > You're only OK with invoking it to make a haphazard argument. I think it's pretty solid. If you are in charge of material that you deem important enough to stamp it 'secret' then you should take basic precautions, if you do not then you only have yourself to blame. Not locking your house is stupid, even if burglary is wrong. > I absolutely do place blame on the people charged with protecting the information that got leaked. Good. > But that has nothing whatsoever to do with WL's culpability. Indeed, it doesn't because as far as I know they're not culpable. The investigation in to the leak has so far been limited to those in the employ of the US government, and again, as far as I know wikileaks and its associates have not been charged with any crimes or even misdemeanors related to these leaks. The 'if you've got nothing to hide you've got nothing to fear' mantra cuts both ways. I don't agree with it when applied to the general public, and I just as much don't agree with it when applying it to the government. The difference is that I would expect the government to at least be somewhat capable when it comes to dealing with data that is deemed sensitive. So maybe your point is that crypto is pointless because no matter what information will be leaked and therefore the recipients of the leaked data should have culpability but that is a world governed by an ethic that I'm not ok with.
      - tptacek 16y ago
        Your argument is incoherent. It will be modded up because it supports Wikileaks, but understand between the two of us that it is a stupid argument, and I think less of you for making it. People who leave their front doors unlocked are not themselves responsible for burglary. Burglars are responsible for buglary. Information security people in the US government were apparently negligent with information they were charged with protecting. But those people weren't information owners or stakeholders.
- forza 16y ago
  I've always found your attitude strange for someone working in security. Especially in military intelligence the name of the game is protect yourself or you only have yourself to blame. The main reason we are seeing this leak is because too many and/or the wrong people had access to the data, which is also why it's mostly "raw data".
  - tptacek 16y ago
    What's your point? Try to hold these two thoughts together in your head: whoever was charged with protecting this information was negligent, and whoever actually leaked it is responsible for their own actions.
    - jacquesm 16y ago
      > Try to hold these two thoughts together in your head That's skirting the edge of an ad-hominem attack, maybe even crossing the line. For someone of your stature that is a pretty bad example to set. > whoever was charged with protecting this information was negligent, and whoever actually leaked it is responsible for their own actions. Neither of those are Assange. So, the new world we live in: if information is leaked it will instantly reach an audience of millions. Plan accordingly.
ori_b 16y ago
And - in a large organization, where you need to communicate patient information to a potentially significant number of doctors, for example - what prevents one unscrupulous doctor from posting the information in plain text when it gets decrypted? Encryption works fine for trusted communication, but it's not a solution when the people posting the information are also potential valid recipients.
- jacquesm 16y ago
  This is absolutely true, which is why I'm categorically against long lived record keeping in centralized databases when it comes to stuff like this. Eventually it will hit the street and eventually it will be abused, you can pretty much count on it. That's also the reason why I have yet to get a new passport because I don't think the government should have my fingerprints on file, given their history with respect to data loss and internal abuse cases.

gloob 16y ago

Then it is whoever is causing the internal pressure that is harming freedom of speech.

scott_s 16y ago
Sometimes it's self-censorship. If people don't trust that their own communication will remain confidential, they may censor themselves.
ori_b 16y ago
Yes and no. If you know that stuff you say confidentially could be leaked at any time, you would be pressuring yourself to keep your lips sealed - at least, if you're ethical and care about privacy.