6 ms·

> Obfuscation may be our best digital weapon. From Dan Geer's talk "Cybersecurity as Realpolitik" (which everyone should hear[1]/read[2]): >> There are so man

by pdkl95 7y ago

> Obfuscation may be our best digital weapon. From Dan Geer's talk "Cybersecurity as Realpolitik" (which everyone should hear[1]/read[2]): >> There are so many technologies now that power observation and identification of the individual at a distance. They may not yet be in your pocket or on your dashboard or embedded in all your smoke detectors, but that is only a matter of time. Your digital exhaust is unique hence it identifies. Pooling everyone's digital exhaust also characterizes how you differ from normal. Privacy used to be proportional to that which it is impossible to observe or that which can be observed but not identified. No more -- what is today observable and identifiable kills both privacy as impossible-to-observe and privacy as impossible-to-identify, so what might be an alternative? If you are an optimist or an apparatchik, then your answer will tend toward rules of data procedure administered by a government you trust or control. If you are a pessimist or a hacker/maker, then your answer will tend towards the operational, and your definition of a state of privacy will be my definition: the effective capacity to misrepresent yourself. >> Misrepresentation is using disinformation to frustrate data fusion on the part of whomever it is that is watching you. Some of it can be low-tech, such as misrepresentation by paying your therapist in cash under an assumed name. Misrepresentation means arming yourself not at Walmart but in living rooms. Misrepresentation means swapping affinity cards at random with like-minded folks. Misrepresentation means keeping an inventory of misconfigured webservers to proxy through. Misrepresentation means putting a motor-generator between you and the Smart Grid. Misrepresentation means using Tor for no reason at all. Misrepresentation means hiding in plain sight when there is nowhere else to hide. Misrepresentation means having not one digital identity that you cherish, burnish, and protect, but having as many as you can. Your fused identity is not a question unless you work to make it be. [1] https://www.youtube.com/watch?v=nT-TGvYOBpI https://www.youtube.com/watch?v=nT-TGvYOBpI [2] http://geer.tinho.net/geer.blackhat.6viii14.txt http://geer.tinho.net/geer.blackhat.6viii14.txt

jelliclesfarm 7y ago
Thanks for sharing this. I subscribe to this notion but this is very elegantly put.
worldsayshi 7y ago
Misrepresentation is a good way to improve the training data sets for intelligence agencies.
- peteradio 7y ago
  Only if they have the truth set to compare against already.
- pixl97 7y ago
  Yep, as an individual there is a very limited pool of activities that you can and will misrepresent yourself in, and you will tend to do that in low entropy also.
  - gutnor 7y ago
    On the other hand if you are just a mostly normal guy with a dark secret, your normal life generates enormous amount of data and that's fairly easy to misrepresent the tiny bit you want to hide. If you are an avid facebook, instagram, youtube, reddit, twitter user, it should be fairly easy to hide your plan for world domination on HN.
    - bilbo0s 7y ago
      Actually, misrepresentation is an especially bad strategy if you're a normal guy with a dark secret.
1996 7y ago
Beautiful
tomxor 7y ago
> your definition of a state of privacy will be my definition: the effective capacity to misrepresent yourself. This is true of the world we live in today, which comprises of almost completely centralised services. But in the future, I believe the second option will be: building and using local FOSS replacements for those services. Many of those local replacements will need no communication at all - So many things that run off a server today have no functional need to, it's about control. Others are more difficult, because communication is inherent to the service, and centralization is the simplest and most obvious choice when being provided by a coorporation, so an infamous "decentralised" solution is needed, which are more difficult to create, organise and promote.
- squiggleblaz 7y ago
  What is the local FOSS replacement for Facebook and Instagram? It is not inherent in the notion of communicating publicly and privately using photos, videos and short text messages than I disclose some ungodly amount of private data. I have feel like writing some protocol and a few clients and servers, but I expect that there's already twenty four competing protocols that no-one uses because, if you're not the biggest, you're noone.
  - tomxor 7y ago
    Yes, as I said in my last sentence: > Others are more difficult, because communication is inherent to the service, and centralization is the simplest and most obvious choice when being provided by a coorporation, so an infamous "decentralised" solution is needed, which are more difficult to create, organise and promote. I think the only way a decentralised social network replacement will win out facebook is with a universal but progressive/gracefully degrading protocol is created as the single way lots of different clients/federated servers etc communicate, a protocol that also allows greater level of control over where your data goes... i.e email but better. As i said these problems are the most difficult, but there are a lot of thing being "clouded" at the moment that have no need, those are the low hanging fruit. Note that I am suggesting FOSS is the preferred option to obfuscating, rather than the only option... some services will always be centralised not only because it's simpler but because it's about/for a central authority... for those obfuscation is the only way.
golemotron 7y ago
People who attempt to obfuscate probably go to a special list when obfuscation is detected. You get scrutiny by attempting to avoid scrutiny.
- kazagistar 7y ago
  The goal isn't selfish. Its collectively reducing the power of the scrutinizer by taking a small hit overall to protect yourself and others.
excalibur 7y ago
> If you are an optimist or an apparatchik, then your answer will tend toward rules of data procedure administered by a government you trust or control. Make the data public. All of it. Don't allow them any secrets. Knowledge is power, power to the people.
- bilbo0s 7y ago
  That would also spawn outrage mobs. "This boy said right here in his Call of Duty chat that he was going to go to school with his dad's rifle and shoot people!!!" The only thing you would do is put entirely unprofessional future mobs in place of the slightly unprofessional police we use currently. I would hope people could see the very real chance that your idea would make things worse.
  - excalibur 7y ago
    > The only thing you would do is put entirely unprofessional future mobs in place of the slightly unprofessional police we use currently. I would hope people could see the very real chance that your idea would make things worse. Worse than the status quo, yes. But you seem to be under the assumption that we will be able to maintain a police force at "slightly unprofessional" moving forward, when governments have the tools and incentive to become far more controlling.
    - bilbo0s 7y ago
      Governments can be ultra-controlling with slightly unprofessional police. It happens all the time across the globe. But without exception, wherever those police have been removed, poor though those police may have been, it has resulted in untold misery on the populace. Giving everyone the power to know exactly what everyone else is saying and doing is tantamount to taking data and removing all its police, and removing all its locks. It will not end well.
      - excalibur 7y ago
        I'm not sure how much stock I put in this analogy, but you could be right. It could also create an incentive to avoid collecting data in the first place, which would obviously be a good thing. But perhaps this could be better achieved through other methods.
YeGoblynQueenne 7y ago
Well, obfuscation is great for that sweet frisson of resistance and for laughs (I guffawed when I read about ah's datapools; https://ahprojects.com/datapools/ https://ahprojects.com/datapools/) but if we're resisting by hiding ourselves, then we've already lost. We should not need to hide ourselves from anyone, because there should not be anyone to spy on us. We should not have to think about how to obfuscate our activity, because there shouldn't be anyone watching our activity without a very, very good reason (and even then, with enough safeguards to discourage all but the most commited of spies). If we're subverting the authority of democratically elected governments -governments that _we_ have given authority to- then we are in deep, deeep shit. We might as well obfuscate ourselves out of shame of being recognised for the negligent democratic citizens that we are.
danShumway 7y ago
> the effective capacity to misrepresent yourself. Agreed. I describe this as The Right to Hide.[0] An important part of hiding is that when people ask you to provide information, you should be able to lie. We've learned from App Mainfests on Android and on the web that if an app can tell whether or not they were granted a permission, they'll just try to harass the user into giving it. The better solution is to make it so that the app can ask for anything, but can't validate whether or not any of it is true. I'm encouraged by the work people are putting into protecting privacy by blocking data collection itself, but I think that obfuscation/misinformation is a more promising direction for us to go. [0]: https://anewdigitalmanifesto.com/#right-to-hide https://anewdigitalmanifesto.com/#right-to-hide
Maximus9000 7y ago
> "Misrepresentation means putting a motor-generator between you and the Smart Grid. Misrepresentation means..." All of that sounds exhausting. Some of it is easy... but some of those tasks would take over 10 hours to do. I've got a life to live. Plus, it doesn't really fix the problem, does it? Wouldn't it be better if we all took those hours to lobby the government to change the laws?
- Endy 7y ago
  No, it would not be better. You are asking someone who is psychopathic and greedy to give up power, influence, control, and money. Short of forceful resistance (which isn't always necessarily violent - Gandhi used force but not violence for example), it isn't going to work. It's also actually better if you only do the things to hide within your patience level, because the point is to lie and not be easily connected. Remember that part of why DNT is on the way out is because it set another trackable variable, working against the point. If you use Iceweasel on Linux, send a UA string of Chrome on Windows. Just look 'normal'. People with mental illnesses or alternate lifestyles have long since learned that the first and best coping mechanism to hide is to just look normal on the surface. The line from Ghostbusters comes to mind, 'Quiet, you're scaring the straights'. Look normal, keep your head down when there's no reason not to. Make it too obvious that you're hiding, and they take it as a challenge. Just learn to hide passively.

by pdkl95 7y ago

jelliclesfarm 7y ago

Thanks for sharing this. I subscribe to this notion but this is very elegantly put.

worldsayshi 7y ago

Misrepresentation is a good way to improve the training data sets for intelligence agencies.

peteradio 7y ago
Only if they have the truth set to compare against already.
pixl97 7y ago
Yep, as an individual there is a very limited pool of activities that you can and will misrepresent yourself in, and you will tend to do that in low entropy also.
- gutnor 7y ago
  On the other hand if you are just a mostly normal guy with a dark secret, your normal life generates enormous amount of data and that's fairly easy to misrepresent the tiny bit you want to hide. If you are an avid facebook, instagram, youtube, reddit, twitter user, it should be fairly easy to hide your plan for world domination on HN.
  - bilbo0s 7y ago
    Actually, misrepresentation is an especially bad strategy if you're a normal guy with a dark secret.

1996 7y ago

Beautiful

tomxor 7y ago

> your definition of a state of privacy will be my definition: the effective capacity to misrepresent yourself. This is true of the world we live in today, which comprises of almost completely centralised services. But in the future, I believe the second option will be: building and using local FOSS replacements for those services. Many of those local replacements will need no communication at all - So many things that run off a server today have no functional need to, it's about control. Others are more difficult, because communication is inherent to the service, and centralization is the simplest and most obvious choice when being provided by a coorporation, so an infamous "decentralised" solution is needed, which are more difficult to create, organise and promote.

squiggleblaz 7y ago
What is the local FOSS replacement for Facebook and Instagram? It is not inherent in the notion of communicating publicly and privately using photos, videos and short text messages than I disclose some ungodly amount of private data. I have feel like writing some protocol and a few clients and servers, but I expect that there's already twenty four competing protocols that no-one uses because, if you're not the biggest, you're noone.
- tomxor 7y ago
  Yes, as I said in my last sentence: > Others are more difficult, because communication is inherent to the service, and centralization is the simplest and most obvious choice when being provided by a coorporation, so an infamous "decentralised" solution is needed, which are more difficult to create, organise and promote. I think the only way a decentralised social network replacement will win out facebook is with a universal but progressive/gracefully degrading protocol is created as the single way lots of different clients/federated servers etc communicate, a protocol that also allows greater level of control over where your data goes... i.e email but better. As i said these problems are the most difficult, but there are a lot of thing being "clouded" at the moment that have no need, those are the low hanging fruit. Note that I am suggesting FOSS is the preferred option to obfuscating, rather than the only option... some services will always be centralised not only because it's simpler but because it's about/for a central authority... for those obfuscation is the only way.

golemotron 7y ago

People who attempt to obfuscate probably go to a special list when obfuscation is detected. You get scrutiny by attempting to avoid scrutiny.

kazagistar 7y ago
The goal isn't selfish. Its collectively reducing the power of the scrutinizer by taking a small hit overall to protect yourself and others.

excalibur 7y ago

> If you are an optimist or an apparatchik, then your answer will tend toward rules of data procedure administered by a government you trust or control. Make the data public. All of it. Don't allow them any secrets. Knowledge is power, power to the people.

bilbo0s 7y ago
That would also spawn outrage mobs. "This boy said right here in his Call of Duty chat that he was going to go to school with his dad's rifle and shoot people!!!" The only thing you would do is put entirely unprofessional future mobs in place of the slightly unprofessional police we use currently. I would hope people could see the very real chance that your idea would make things worse.
- excalibur 7y ago
  > The only thing you would do is put entirely unprofessional future mobs in place of the slightly unprofessional police we use currently. I would hope people could see the very real chance that your idea would make things worse. Worse than the status quo, yes. But you seem to be under the assumption that we will be able to maintain a police force at "slightly unprofessional" moving forward, when governments have the tools and incentive to become far more controlling.
  - bilbo0s 7y ago
    Governments can be ultra-controlling with slightly unprofessional police. It happens all the time across the globe. But without exception, wherever those police have been removed, poor though those police may have been, it has resulted in untold misery on the populace. Giving everyone the power to know exactly what everyone else is saying and doing is tantamount to taking data and removing all its police, and removing all its locks. It will not end well.
    - excalibur 7y ago
      I'm not sure how much stock I put in this analogy, but you could be right. It could also create an incentive to avoid collecting data in the first place, which would obviously be a good thing. But perhaps this could be better achieved through other methods.

YeGoblynQueenne 7y ago

Well, obfuscation is great for that sweet frisson of resistance and for laughs (I guffawed when I read about ah's datapools; https://ahprojects.com/datapools/ https://ahprojects.com/datapools/) but if we're resisting by hiding ourselves, then we've already lost. We should not need to hide ourselves from anyone, because there should not be anyone to spy on us. We should not have to think about how to obfuscate our activity, because there shouldn't be anyone watching our activity without a very, very good reason (and even then, with enough safeguards to discourage all but the most commited of spies). If we're subverting the authority of democratically elected governments -governments that _we_ have given authority to- then we are in deep, deeep shit. We might as well obfuscate ourselves out of shame of being recognised for the negligent democratic citizens that we are.

danShumway 7y ago

> the effective capacity to misrepresent yourself. Agreed. I describe this as The Right to Hide.[0] An important part of hiding is that when people ask you to provide information, you should be able to lie. We've learned from App Mainfests on Android and on the web that if an app can tell whether or not they were granted a permission, they'll just try to harass the user into giving it. The better solution is to make it so that the app can ask for anything, but can't validate whether or not any of it is true. I'm encouraged by the work people are putting into protecting privacy by blocking data collection itself, but I think that obfuscation/misinformation is a more promising direction for us to go. [0]: https://anewdigitalmanifesto.com/#right-to-hide https://anewdigitalmanifesto.com/#right-to-hide

Maximus9000 7y ago

> "Misrepresentation means putting a motor-generator between you and the Smart Grid. Misrepresentation means..." All of that sounds exhausting. Some of it is easy... but some of those tasks would take over 10 hours to do. I've got a life to live. Plus, it doesn't really fix the problem, does it? Wouldn't it be better if we all took those hours to lobby the government to change the laws?

Endy 7y ago
No, it would not be better. You are asking someone who is psychopathic and greedy to give up power, influence, control, and money. Short of forceful resistance (which isn't always necessarily violent - Gandhi used force but not violence for example), it isn't going to work. It's also actually better if you only do the things to hide within your patience level, because the point is to lie and not be easily connected. Remember that part of why DNT is on the way out is because it set another trackable variable, working against the point. If you use Iceweasel on Linux, send a UA string of Chrome on Windows. Just look 'normal'. People with mental illnesses or alternate lifestyles have long since learned that the first and best coping mechanism to hide is to just look normal on the surface. The line from Ghostbusters comes to mind, 'Quiet, you're scaring the straights'. Look normal, keep your head down when there's no reason not to. Make it too obvious that you're hiding, and they take it as a challenge. Just learn to hide passively.