4 ms·

There are no shades of grey here - state actors have access to every internet node, fibre optic cables, operating systems and hardware. So unless you take your

by qayxc 6y ago

There are no shades of grey here - state actors have access to every internet node, fibre optic cables, operating systems and hardware. So unless you take your time to build your own CPU, main board and modem and only use our own private direct fibre connection, you're a potential target for being spied on. It's as simple as that. You can make things harder by encrypting your traffic, but that's possible regardless of were your Tor relay is located at. And even then some crypto algos are known to have been deliberately weakened by intelligence agencies so you best be a crypto expert as well if you're really that paranoid. The irony is that most (not all!) people who are ever so concerned about these things still use their smartphones (even though EVERY GSM/UMTS/4G protocol has been hacked at this point and is thus insecure), use cloud computing (either directly or indirectly via 3rd party services like Uber) and post on social networks. The only computer that is safe from attacks is not connected to any network and only ever used in a windowless room surrounded by reinforced concrete walls. The only information that is truly private is information you don't share in the first place.

rhn_mk1 6y ago
You say "There are no shades of grey here" but then you contradict it by saying "You can make things harder by encrypting your traffic", so obviously you don't mean it. By dismissing the imperfect possiblities of making yourself safer, you seem to be saying "there only needs to be one gunner to shoot you when you look out the window, so either you never leave your bunker or may as well live in a war zone", while dismissing those who ask "which country is the most peaceful and stable, so that I can settle there?". People can be well aware of weak crypto, compromised CPUs, TEMPEST, Tor compromises, state actors and legal problems, and yet still choose which of those to defend against, and to what extent. In real life, people take tradeoffs, because it's almost never an all-or-nothing situation.
- qayxc 6y ago
  There is no place in the world that is both technologically capable of reliably hosting servers and at the same time inherently safer with regards to the privacy of your data than others. If it's not the domestic government that will raid the server or monitor traffic, it's foreign actors or (in case of monitoring) the country that packets are routed through. Yes, there are possibilities to make yourself safer, but they don't depend on where you place your data. The question wasn't "can I be safer", the question was "is there a specific place that is safer" and the answer is no, for the reasons I gave. That's not saying "encryption is useless anyway" or "you might as well give up" - no! I'm saying that if the privacy of your data depends on where your server is located, then you're doing it wrong.
  - rhn_mk1 6y ago
    I'm not sure I'm convinced that location doesn't matter at all. The attack routes are different between countries: local culture determines attack surface inside the company, local law determines attack surface due to the local government. There are probably more factors at play due to technical reasons, like the closeness to internet exchanges and the difficulty to sniff packets in secret by foreign spies. Unless those are uniformly the same everywhere, I don't think your agrument holds.
IncRnd 6y ago
> The only computer that is safe from attacks is not connected to any network and only ever used in a windowless room surrounded by reinforced concrete walls. Perhaps such a computer is safe from the types of attacks you contemplate, but through-the-wall surveillance has been happening for decades.
- qayxc 6y ago
  I only ever heard of such attacks through windows and ceilings, never through reinforced walls. This sounds very intriguing - do have any sources that explain how this work? Do these techniques use vibrations or scattered radiation?
marta_morena_25 6y ago
You contradict yourself. If there are no shades of gray, why don't you post a link here to a website with cameras into your home, a direct link to a microphone you carry at all times, passwords to all your accounts and the public "View" link to a dropbox with all you data. Because you know... Since there is no 100% privacy and safety, there is just none. So why even bother?
- qayxc 6y ago
  That's not at all what I'm saying. What I'm saying is that privacy and security don't depend on where your data is located. The location of your server or whether third parties have access to that server one way or another should not be part of your security concept. My point is that if you have end-to-end encryption and don't store or share unencrypted data in the first place, it doesn't matter where your server is. There is no particular country in the world where you can place your Tor relay or your storage server and be safe against being spied on. To use the obligatory car allegory since it's Germany we're talking about: an unlocked car with the keys in the ignition isn't any safer against theft if you park it next to a police station. On the other hand you can park a locked car with a live pitbull inside (in the shade!) pretty much anywhere in town and the risk of theft will be equally low.

by qayxc 6y ago

rhn_mk1 6y ago

You say "There are no shades of grey here" but then you contradict it by saying "You can make things harder by encrypting your traffic", so obviously you don't mean it. By dismissing the imperfect possiblities of making yourself safer, you seem to be saying "there only needs to be one gunner to shoot you when you look out the window, so either you never leave your bunker or may as well live in a war zone", while dismissing those who ask "which country is the most peaceful and stable, so that I can settle there?". People can be well aware of weak crypto, compromised CPUs, TEMPEST, Tor compromises, state actors and legal problems, and yet still choose which of those to defend against, and to what extent. In real life, people take tradeoffs, because it's almost never an all-or-nothing situation.

qayxc 6y ago
There is no place in the world that is both technologically capable of reliably hosting servers and at the same time inherently safer with regards to the privacy of your data than others. If it's not the domestic government that will raid the server or monitor traffic, it's foreign actors or (in case of monitoring) the country that packets are routed through. Yes, there are possibilities to make yourself safer, but they don't depend on where you place your data. The question wasn't "can I be safer", the question was "is there a specific place that is safer" and the answer is no, for the reasons I gave. That's not saying "encryption is useless anyway" or "you might as well give up" - no! I'm saying that if the privacy of your data depends on where your server is located, then you're doing it wrong.
- rhn_mk1 6y ago
  I'm not sure I'm convinced that location doesn't matter at all. The attack routes are different between countries: local culture determines attack surface inside the company, local law determines attack surface due to the local government. There are probably more factors at play due to technical reasons, like the closeness to internet exchanges and the difficulty to sniff packets in secret by foreign spies. Unless those are uniformly the same everywhere, I don't think your agrument holds.

IncRnd 6y ago

> The only computer that is safe from attacks is not connected to any network and only ever used in a windowless room surrounded by reinforced concrete walls. Perhaps such a computer is safe from the types of attacks you contemplate, but through-the-wall surveillance has been happening for decades.

qayxc 6y ago
I only ever heard of such attacks through windows and ceilings, never through reinforced walls. This sounds very intriguing - do have any sources that explain how this work? Do these techniques use vibrations or scattered radiation?

marta_morena_25 6y ago

You contradict yourself. If there are no shades of gray, why don't you post a link here to a website with cameras into your home, a direct link to a microphone you carry at all times, passwords to all your accounts and the public "View" link to a dropbox with all you data. Because you know... Since there is no 100% privacy and safety, there is just none. So why even bother?

qayxc 6y ago
That's not at all what I'm saying. What I'm saying is that privacy and security don't depend on where your data is located. The location of your server or whether third parties have access to that server one way or another should not be part of your security concept. My point is that if you have end-to-end encryption and don't store or share unencrypted data in the first place, it doesn't matter where your server is. There is no particular country in the world where you can place your Tor relay or your storage server and be safe against being spied on. To use the obligatory car allegory since it's Germany we're talking about: an unlocked car with the keys in the ignition isn't any safer against theft if you park it next to a police station. On the other hand you can park a locked car with a live pitbull inside (in the shade!) pretty much anywhere in town and the risk of theft will be equally low.