3 ms·

If you're going to do 1.2 and 1.3 and get everyone to make massive changes to how they operate, why not just use a secure messenger instead of trying to shoehor

by lvh 7y ago

If you're going to do 1.2 and 1.3 and get everyone to make massive changes to how they operate, why not just use a secure messenger instead of trying to shoehorn privacy onto a protocol designed for when the Internet had like five computers on it and all the people knew each other?

einpoklum 7y ago
Because email and secure messaging are not the same thing, and the latter does not replace the former. Now, there could be a distributed infrastructure for "email" that's not SMTP-and-IMAP/POP3-based, theoretically, based on what is now used for secure instant messaging - but I can't just recommend this to individuals. Also, my suggestions do not make email private, they reduce the exposure to large-scale surveillance and make it more difficult to target individuals. Also, they do not involve "shoehorning" as far as user experience is concerned.
- cjbprime 7y ago
  > But most of us are facing the problem of MASS SURVEILLANCE All that you're accomplishing by switching to decentralized servers is publishing the metadata that you claim to be concerned about for free. Before, someone had to serve Google a valid subpoena to find out who you've been talking to. After, you're just broadcasting it publicly across the net in network header logs.
  - einpoklum 7y ago
    You're misinforming people. Nobody has to hand Google anything. The NSA has direct access to their systems and can take in as much as they want. This is not a conspiracy theory - it is public knowledge thanks to the Edward Snowden leaks.
    - joshuamorton 7y ago
      Can you cite that this is true today?
      - einpoklum 7y ago
        Seriously? :-(
        joshuamorton 7y ago
        Yes, as far as I can tell you're claiming one of three things 1. Google actively assisted the NSA with data collection, beyond legal obligations (subpoenas etc.) 2. The NSA had a way of legally compelling companies to provide direct access to systems and can do arbitrary processing on company internal data 3. The NSA was snooping in Google's systems without Google's knowledge in 2013, and this hasn't been fixed 7 years later. As far as I know, the Snowden leaks don't provide any real evidence for (1) or (2), and so are an extraordinary claim without evidence. (3) also seems rather unlikely. Hence the question.
        cjbprime 7y ago
        I think OP is talking about https://en.wikipedia.org/wiki/PRISM_(surveillance_program) https://en.wikipedia.org/wiki/PRISM_(surveillance_program).
        joshuamorton 7y ago
        I'm aware. My statement still stands.
        cjbprime 7y ago
        But the outline of PRISM described there seems to confirm (1) and (2), no? They didn't need a subpoena for each user, had access to a search term firehose, and the legal method for (2) was the secret FISA court. The access isn't as complete as full arbitrary data, but it's also a long way from only responding to known legal warrants and subpoenas.
BlueTemplar 7y ago
A secure messenger that is standardized. While Signal has actively resisted that.

by lvh 7y ago

einpoklum 7y ago

Because email and secure messaging are not the same thing, and the latter does not replace the former. Now, there could be a distributed infrastructure for "email" that's not SMTP-and-IMAP/POP3-based, theoretically, based on what is now used for secure instant messaging - but I can't just recommend this to individuals. Also, my suggestions do not make email private, they reduce the exposure to large-scale surveillance and make it more difficult to target individuals. Also, they do not involve "shoehorning" as far as user experience is concerned.

cjbprime 7y ago
> But most of us are facing the problem of MASS SURVEILLANCE All that you're accomplishing by switching to decentralized servers is publishing the metadata that you claim to be concerned about for free. Before, someone had to serve Google a valid subpoena to find out who you've been talking to. After, you're just broadcasting it publicly across the net in network header logs.
- einpoklum 7y ago
  You're misinforming people. Nobody has to hand Google anything. The NSA has direct access to their systems and can take in as much as they want. This is not a conspiracy theory - it is public knowledge thanks to the Edward Snowden leaks.
  - joshuamorton 7y ago
    Can you cite that this is true today?
    - einpoklum 7y ago
      Seriously? :-(
      - joshuamorton 7y ago
        Yes, as far as I can tell you're claiming one of three things 1. Google actively assisted the NSA with data collection, beyond legal obligations (subpoenas etc.) 2. The NSA had a way of legally compelling companies to provide direct access to systems and can do arbitrary processing on company internal data 3. The NSA was snooping in Google's systems without Google's knowledge in 2013, and this hasn't been fixed 7 years later. As far as I know, the Snowden leaks don't provide any real evidence for (1) or (2), and so are an extraordinary claim without evidence. (3) also seems rather unlikely. Hence the question.
        cjbprime 7y ago
        I think OP is talking about https://en.wikipedia.org/wiki/PRISM_(surveillance_program) https://en.wikipedia.org/wiki/PRISM_(surveillance_program).
        joshuamorton 7y ago
        I'm aware. My statement still stands.
        cjbprime 7y ago
        But the outline of PRISM described there seems to confirm (1) and (2), no? They didn't need a subpoena for each user, had access to a search term firehose, and the legal method for (2) was the secret FISA court. The access isn't as complete as full arbitrary data, but it's also a long way from only responding to known legal warrants and subpoenas.

BlueTemplar 7y ago

A secure messenger that is standardized. While Signal has actively resisted that.