21 ms·

One thing I see people saying on here is that people should care....and I do...but I don't know _what_ to do with it! Can someone show/tell me what I, an avera

• fugue88 16y ago
  We could use GPG for normal e-mail correspondence. But I really don't know if this would do anything more than delay any problems. In a similar vein, I've deleted all the trusted root CA certs from my computer, and am now marking individual certs trusted as I hit them. Not fail-safe, but safer, I think.
  • HelloBeautiful 16y ago
    Haha, this doesn't make any sense. How can you possibly know the real cert from the one generated by NSA?
    • fugue88 16y ago
      Great question! Unfortunately, I don't think you can. If you use CA certs to trust site certs, the site certs can change on the fly (i.e. be replaced with an NSA interloper) without you knowing. If you kill your CA certs, and mark individual sites trusted, than at least your browser will notify you if the site's cert has changed since you lasted trusted it. Theoretically. I haven't actually tested this yet. :(
    • kronusaturn 16y ago
      Call them on the phone and ask them to read you their cert fingerprint. Or use this: http://www.networknotary.org/firefox.html http://www.networknotary.org/firefox.html
      • HelloBeautiful 16y ago
        Phone lines are secure of course ...
  • Mafana0 16y ago
    >In a similar vein, I've deleted all the trusted root CA certs from my computer, and am now marking individual certs trusted as I hit them. Not fail-safe, but safer, I think. Excuse my ignorance, could you tell why it's useful to remove the certs from a PC. I've heard about root certs a couple of times already but don't understand what they really are.
    • asharp 16y ago
      Basically if you see a certificate on the interwebs, it goes through and says: "This particular website is X". And it can back this up with all sorts of fancy math. The problem then, is how do you know that the particular certificate is correct? I can go through and make a certificate saying that i'm santa clause. How you get around that is by using another certificate that you already have, and using that to certify the websites certificate. Ie. if you trust godaddy (or the hong kong post office), and I have a certificate saying that i'm me, signed by godaddy, then you can trust that i'm me. The collection of certificates that you trust are then called the "root ca", and having random certificates there is a problem because if one of them was to produce a forged certificate, you'd never know about it. ie. by adding in untrusted certificates to your root ca, you lose trust in the whole certificate chain of trust process.
      • Mafana0 16y ago
        Thanks for the explanation. After taking a look at the certificates that come with Windows, I can see that there are dozens of trusted root certificates, issued by some organizations that I've never heard of. Can I really trust those "root ca"? especially that I noticed some differences between the two PCs that I've checked!
        • tonfa 16y ago
          Usually the OS or browser vendor chose them, so it is normal that they differ between computers. But the CA trust chain really sucks, as one compromized CA compromizes everything (the security of the system relies on the security of the weakest root CA).
  • mhb 16y ago
    I don't understand what you're doing. When you get an individual cert, are you adding another trusted authority to verify that cert? If you're just trusting the individual cert, you're exposed to MITM.
    • fugue88 16y ago
      Yes, you're exposed to MITM. But if you permantly mark the cert as trusted, and the MITM goes away, you'll know somethings has changed. You'll be blind as to which way things changed, but at least you'll know to investigate.
• wtn 16y ago
  Besides using SSH and VPN more, the only thing I can do is avoid ATT. I was on T-Mobile for years (out of ATT spite) until Verizon got the iPhone and I jumped within the week. I also spent a lot more money on internet using alternatives to ATT DSL (although I doubt my information was more secure from that choice).
  • fingerprinter 16y ago
    I'm guessing those other big companies are just as bad, however. Might not have the facts yet, but being paranoid leads me to think that way....
    • abstractwater 16y ago
      I feel the same. What we would need is a telecommunication company that puts the respect of privacy as one of its core goals (think Zappos), and not just in the boilerplate license agreements. Although entering that arena has high entry costs, it seems like a huge demand for such a service exists.
      • haecib 16y ago
        Quest communications was allegedly the only telecom co that didn't roll over to the NSA: http://en.wikipedia.org/wiki/Qwest#Refusal_for_NSA_spying http://en.wikipedia.org/wiki/Qwest#Refusal_for_NSA_spying A lot of time has passed, and they have a new CEO. I wonder if they have continued to hold out, or have quietly installed the black-room... EDIT: I see they were just acquired last year by CenturyLink. I have to doubt that they have now not rolled over (call me a pessimist). Very sad that corporations are so willing to forsake the privacy of the entire country's citizens (on the level of a constitutional breach) in order to make a dime or curry favor. Beyond sad, it is terrifying that the government then used warrantless wiretapping to specifically target our journalists: http://www.theregister.co.uk/2009/01/25/tice_nsa_revelations/ http://www.theregister.co.uk/2009/01/25/tice_nsa_revelations... ...at least according to the same source that was responsible for leaking the existence of the black-rooms in the first place. Sigh. Maybe I'll pick up my old copy of 1984. It's getting ironic now.
• pedalpete 16y ago
  Yes to Petition your government, contact your congressperson, and support the EFF. The problem with making yourself 'technically safe' is that it realistically leaves most non-technical people exposed. The only way to 'protect' everybody is to cure the cancer, not just your symptoms.
  • deleted 16y ago
    [deleted]
  • deleted 16y ago
    [deleted]
  • borism 16y ago
    The problem with making yourself 'technically safe' is that it realistically leaves most non-technical people exposed. then lets make everybody safe technically. it's hard, but doable. if everyone ran tor and 10% of users ran tor relay, that should be a hell to track, no?
    • pedalpete 16y ago
      I think you missed the point of my comment. Though running tor or other technical solutions are possible, getting penetration into the non-techie world is very difficult. You're proposing a technical solution to a legislative problem. Working with the law (constitutional or otherwise) creates the environment where you aren't trying to work around the issue or 'hide' from anybody. Privacy laws are there for your protection. As another commenter mentioned, you wouldn't accept the gov't or private corporations reading your mail, e-mail shouldn't be any different.
• phlux 16y ago
  So after applying to YC today (worried that I borked my app) I had the following idea - which is an evolutionary idea from the one I applied to YC with, I dont know if this is possible - but I want to throw it out to HN: I would like to see mobile end-to-end secure communications apps that allow for users to have completely encrypted message passing. I had the following idea - please tell me if this would work: You have a distributed truecrypt file system with a client that the users run on their device, and intermediate cloud storage. Each user device is a "folder" on the file system - messages are effectively truecrypt encrypted files that gave saved out to the remote folder that == the recipient. The system would notify you that you have a new file that has been pushed to your folder - you can then decrypt and read it. However - I feel that the weakness would be in the required key/passwd to open the files -- this might not be securable. It may require that folders between two users have a known password on each eand - and that for every contact/recipient you would have to have a separate key (they could be the same value, but still separate) thus a communication looks like this [typed mesage] --> [truecrypt'ed file] --> [to: folder] --> [routing engine/store and forward] --> [from: folder] --> [truecrypt decrypt by user] --> [user reads message] But in a mobile environment... Anyway - half baked stream-of-thought idea... Why would this not work?
  • Splines 16y ago
    I think you're trying too hard. There are existing protocols (S/MIME, PGP, Jabber, etc.) for transferring messages in a secure manner. I'd pick the one that fits your scenario and wrap it up in a shiny app. AFAIK, there are several IM apps that could support encryption, but I don't think they are actually doing so (and if they are, they aren't advertising it). As it is, end-end secure communications is not (I think) on anyone's feature bullet-list.
    • phlux 16y ago
      You may be right, however one advantage of this method is that any messages and files are seen as exactly the same: a secure truecrypt encrypted file transfer. No differentiation between a txt or file...
• gcb 16y ago
  Vote, for one thing. Geez. How, difficult is that? Oh wait, you guys only have one option laid down as only two parties... tough. Before you start to disagree, name one candidate that had "end patriotic act" on their government plan.
  • tesseract 16y ago
    As I recall, Kucinich, Gravel, and Paul all did.
    • Duff 16y ago
      The support of wingnuts like Kucinich and Paul guarantees that an issue will be ignored by 99.8% of the country.
      • lutorm 16y ago
        Actually, if Kucinich and Paul agree on something, it's probably worth listening to.
        • tesseract 16y ago
          I'd take government by a diverse group of wingnuts who enact the laws they all agree on, over government by a homogeneous group of centrists any day.
    • gcb 16y ago
      I confess i wasn't living in the US during the last elections, so i only followed the elections from international news sources. and i have no idea what those names means (paul i may have heard about while reading slash dot) That also reminds me of that simpsons episode where the aliens take place of the democrat and republican candidates, and when they discover they are aliens trying to take over earth, someone shouts that he will vote for somebody else. the alien just says "go ahead, waste your vote" and the guy agrees and feels defeated.
      • 16y ago
• deleted 16y ago
  [deleted]
• reedlaw 16y ago
  Whenever I mention libertarian principles on HN I get a mixed response, but this is one situation where we must demand individual rights. We need to elect politicians like Ron Paul who oppose big government intrusions into our privacy. This country is supposed to be a bastion of liberty and we go to war to "protect freedom" and "democracy" and yet we are less and less free every day. When we see articles about Chinese "human rights abuses" many are quick to condemn them and other countries perceived as less free than ourselves. Yet I have observed that the US has been headed in a very totalitarian direction for at least the past decade while China has been headed the opposite way, towards more and more freedom. Yes, the Chinese have filtered Internet today, but in the last century they've moved from Feudalism to Communism to a mixed economy. We have gone from having the most freedom in the world to having a Department of Homeland Security, TSA, NSA, Patriot Act, full-body X-Rays, and country-tapping.
  • bioh42_2 16y ago
    We need to elect politicians like Ron Paul Ran Paul has a pretty safe seat in the house. It is not practical to expect Americans to elect him president. I believe the OP asked for practical advice.
    • reedlaw 16y ago
      Maybe his son, Rand (Senator-KY), will someday run. He may stand a better chance.
      • nroman 16y ago
        Not really. Any political consultant worth his salt could easily paint Rand Paul as a racist, given his comments on the Civil Rights Act. (http://voices.washingtonpost.com/right-now/2010/05/rand_paul_telling_the_truth.html http://voices.washingtonpost.com/right-now/2010/05/rand_paul...) Just to be clear, I'm not saying I think Rand Paul is a racist. I'm just saying I don't think he has a chance in a national election.
        • kingkawn 16y ago
• winthrowe 16y ago
  You could work on the Freedom Box. http://wiki.debian.org/FreedomBox http://wiki.debian.org/FreedomBox http://www.kickstarter.com/projects/721744279/push-the-freedombox-foundation-from-0-to-60-in-30?ref=live http://www.kickstarter.com/projects/721744279/push-the-freed...
• bioh42_2 16y ago
  Can someone show/tell me what I, an average person, can do? Get personally involved with your representatives and senators. Write paper letters, call, and show up in person. Be friendly and talk with other voters at the events you show up to. Educate them on this issue. Abandon party affiliation, work with both Democrats and Republicans.
• bcl 16y ago
  Use https as much as possible. I note that Hacker News still doesn't have https access...
  • lallysingh 16y ago
    Is there anything private on HN? The packet headers will still say that you went to HN, and when. The only thing it's blocking directly is knowing your username. That's pretty straightforward to figure out from correlating POSTs to the comment timestamps.
    • logic 16y ago
      My password might be considered private.
• fleitz 16y ago
  Now you have an excellent opportunity, AT&T wants to merge with T-Mobile. Start a campaign saying that the merger will expose T-Mobile customers to NSA wiretapping. Buy some facebook ads and start something.
  • mih 16y ago
    What is to say T-Mobile isn't already doing something similar? AT&T was only exposed because of the whistleblower.
    • fleitz 16y ago
      Do you think T-Mobile's spokesperson is going to make a factual correction to that claim, something along the lines of 'don't worry all our customers are already wiretapped?'. Since this will never happen the argument is valid.
• aantix 16y ago
  #2 - What about writing some sort of client that sends data with sensitive phrases to overwhelm the system with false positives?
  • tjarratt 16y ago
    That could be construed as a denial of service attack and would be illegal (or at least in a very murky legal grey area). Also you seem to have forgot that most AT&T customers have bandwidth caps in place that would make it difficult for them to run this attack in the first place.
    • __david__ 16y ago
      The idea isn't to spew data at AT&T like a DoS, just taint all your boring communication to make them have to sift through more junk. For example, add extra "scary" keywords in your outgoing HTTP headers. X-Spook: Hamas subversive War on Terrorism Kosovo Delta Force
      • tonfa 16y ago
        I am pretty sure it doesn't bother them. They don't actually go through the data, otherwise encryption would defeat the surveillance. There are many other more useful signals (and the fact that you use encryption is probably one). The goal is to find outliers, not people using scary words Furthermore it would be probably quite easy for them to filter that kind of "DoS", it is just too simplistic. If you come up with something more clever they probably are interested about knowing more about you anyway.
  • __david__ 16y ago
    It's called "spook". In Emacs, "M-x spook": cryptanalysis Roswell blackjack Exon Shell Ruby Ridge NORAD Al Jazeera world domination Becker cybercash nuclear csim SHA Leuken-Baden BLU-114/B
• leot 16y ago
  If any of the major webmail providers, with millions of active users, offered "brain dead" PGP (i.e., PGP signatures by default, and automatic PGP encryption and decryption whenever possible), many of the others would follow suit and a lot could be done to counter this kind of program ... ... and, furthermore, it would take a huge bite out of spammers and phishers while allowing you to, e.g., talk to your doctor and banker over email without needing to sign in to some other closed service.
  • mikepurvis 16y ago
    For a while, I've liked the idea of a client-side PGP plugin for Gmail. Essentially, you have a greasemonkey (or bookmarklet, whatever) script which performs the encode on send and save draft, and the decode on receive. Of course, it kills Gmail's big feature, which is search. But for that, I figure you could take the wordlist from the email, hash each one individually, and then paste that at the bottom of the message. So your searches would still find matching messages, they'd just be a garbled mess to Google or any interceptor. This doesn't seem like it'd be terribly complicated, but I don't think anyone's done it.
    • DennisP 16y ago
      Encrypt each word with a secret key, rather than just hashing it.
• linuxhansl 16y ago
  1. Donate to the EFF and the ACLU. 2. Encrypt everything. Or at least something randomly. Even the NSA will have a hard time cracking AES 256 when large amounts of traffic are encrypted.