6 ms·

In an authoritarian regime with large masses of human and technological resources determined to have control over its population, nothing is really secure. Send

In an authoritarian regime with large masses of human and technological resources determined to have control over its population, nothing is really secure. Sending a message that can't be read by a third party? You're suspect. Have an illegal app installed on your registered "report to big brother" phone? Expect an unfriendly visit by big brother police. Don't have a "big brother" phone? There are various ways of sniffing you out. The bottom line is that while technology can help in the process, technology can't bring freedom from oppressing regimes. That is only achieved when a synchronised, large enough collection of people feel that they are willing to change things even at great personal risk. Authoritarian regimes know this, and thus put a lot of effort into using fear of consequences to suppress any hint of such development.

giancarlostoro 6y ago
If only Google and Apple would make a fully end to end encrypted chatting platform to take place of SMS that is fully federated and not controlled by a single entity, something the likes of Signal could support / join in on and other chat apps. When you turn crypto into something the masses use seamlessly it gets a little more complicated to figure out who the suspects are. Also default to not synching to the cloud, and explain why syncing to the cloud could be compromised.
- andrepd 6y ago
  If spying on you is their business model, why would they build an app to prevent you from being spied?
  - LeoPanthera 6y ago
    Spying on you is not Apple's business model.
    - shaniamama 6y ago
      Oh indeed it is. I spent years reading apple reports and my conclusion was that they want the data for themselves so they can sell it. Devices don't make much profit when you factor in how much is spent buying up almost all old devices that hit the market.
      - p1necone 6y ago
        Do you have any evidence of Apple selling user data?
        slivanes 6y ago
        It's right in Apple's privacy policy, see Disclosure to Third Parties section: https://www.apple.com/legal/privacy/en-ww/ https://www.apple.com/legal/privacy/en-ww/ They obviously sell user data in aggregate - not at a personal level, but which of the big tech companies sell personal data (maybe FB / Cambridge Analytica?) Also, Apple has Google as the default search engine which Google pays billions for. Is that selling your personal data?
        p1necone 6y ago
        You mean the disclosure to third parties section that explicitly says "Apple does not sell personal information"? I can't see anything in that section that says that they sell information to third parties, personally identifiable or aggregate (I would consider the latter to be "personal" data as well fwiw). Is there a specific sentence you're thinking of? It seems to be talking about the necessary sharing of data that happens when Apple contracts with third party services to run their own business. E.g. when they ship you a product they need to provide your address to the courier company. Or when they pay an advertising company to run ads for Apple products targeting certain markets/their own existing customers (not the same thing as selling personal data to an advertiser so that they can run ads for other products using said data - that would be selling personal data) As far as I can tell you're either using a definition of "sell" that is different to mine, or you're claiming Apple is using weaselly language to make it sound like they don't when they do (which is not unheard of of course). But you haven't provided enough information for me to really know what you're talking about - which is it, and why? Also no, making the default search engine google is not selling personal data.
    - dancemethis 6y ago
      It is, alongside limiting what you can do with their leased equipment that people think they bought.
      - gorgoiler 6y ago
        This made me jump. You make one excellent point, with appropriately shocking language: When I can’t do what I want with my phone, I may as well be leasing it. Hmmm. But I don’t believe Apple’s business model is to spy on me.
        adev_ 6y ago
        > But I don’t believe Apple’s business model is to spy on me. Apple business is not spying on you, but Apple business is much easier to do if they do spy on you. Meaning they do it anyway, don't worry.
        sneak 6y ago
        Almost every app in the App Store, per Apple's guidelines, has tons of spyware in it. Apple asserts that you agreed to this experience when you accepted the TOS of the App Store. It's impossible to use an iPhone with any popular apps and not be constantly spied on. Insofar as Apple's business model is to make the (full of spyware) App Store successful, it's Apple's business model to spy on you.
        fsflover 6y ago
        > But I don’t believe Apple’s business model is to spy on me. "Location-Based Apple Ads: Your iPhone will send your location to Apple in order to provide you with geographically relevant ads on Apple News and in the App Store." More: https://support.apple.com/en-us/HT207056 https://support.apple.com/en-us/HT207056 So not exactly "business model", but does it matter?
- Legogris 6y ago
  From what I an tell, this is the goal of matrix.org - though full federation and identity portability is not there yet.
- jpetso 6y ago
  Funny that you should mention Signal as example for joining a federated service when they have actively and vocally moved away from federation. https://signal.org/blog/the-ecosystem-is-moving/ https://signal.org/blog/the-ecosystem-is-moving/
gitgud 6y ago
Looks like this app uses TOR in long-range communication. Although it's annonymous, your connection to the network is detectable and would trigger redflags in government monitoring software...
p1necone 6y ago
I've pondered the merits of someone spreading a virus that just sends (small, but relatively constant and random) amounts of encrypted data (maybe to other infected devices, and various other endpoints). Spread it widely enough and everyone gets to communicate privately with plausible deniability. Of course it doesn't even need to be real data, random gibberish would work too.
- lcuff 6y ago
  Perhaps. Back in the 80's, folks on Usenet would add words like "nuclear", "bomb", "spy", "communist" to their email footers and posting signatures, in hopes of overloading the (suspected/expected) NSA monitoring of traffic. I'm going to guess that sophisticated filters dealt effectively with such things back then, and even more sophisticated filters would deal with your random encrypted bits too.
  - jack1243star 6y ago
    Curious anecdote, some underground Japanese P2P networks have files with contents filled with references to Tiananmen, Tibet and the Uyghurs etc. probably to attract attention from CCP to deter Chinese users from downloading them.
suizi 6y ago
Authoritarian regimes are often far less technologically advanced than free countries. They will often import technology from free countries and be constrained by whatever freedom respecting decisions they've made.
- skrebbel 6y ago
  China is an authoritarian regime that is as technologically advanced as the US and Western Europe, and they will gladly export freedom restricting technology.
- new2628 6y ago
  This is like saying that the weapons advanced countries sell to less advanced countries are more "life-respecting".
  - londons_explore 6y ago
    Imagine a world where a gun sold is by the US to a poor wartorn nation. When the trigger is pulled, it does facial recognition to figure out who it is aimed at, and if it detects someone friendly to US interests, it will refuse to hit them.
    - eeZah7Ux 6y ago
      > Imagine a world where a gun sold is by the US to a poor wartorn nation There is no need to imagine it.
Legogris 6y ago
This is precisely why it's important to make these tools (protocols/applications) part of the core layer of how businesses operate consumer-facing services online; it's only true if the ratio of "interesting" communication over these channels is high enough. In an alternative timeline where ISPs where more strictly regulated and trusted and everything was cleartext HTTP, I'm certain that HTTPS/TLS would face pushback from regulators. There's no way it can be banned today, though. Similarly, you won't be marked as suspicious just from opening an encrypted TLS connecting over port 443 to an arbitrary endpoint. I don't think it's too late. There is a significant probability that today's centralized incumbents will Myspace at some point in the future. These federated, decentralized and secure solutions could be the next iteration after that.
- mpartel 6y ago
  Oppressors can (and I think some already do) subvert HTTPS by mandating installation of government-issued certs so they can do their MITM.
  - Legogris 6y ago
    I know there have been attempts (was it Iran and Kazakhstan that was in the news last year?), but is anyone aware of this actually being done in practice today? My understanding is that they were forced to roll back for practical reasons (which highlights my point).
  - mosselman 6y ago
    That is an irrelevant detail. The comment you are responding to isn’t saying that https is foolproof. They are saying that it would help people to be more free of digital control if privacy respecting technology is so common that it isn’t suspicious when you use it.
    - mpartel 6y ago
      I agree that it helps (though I'm probably more pessimistic about how much it helps). I wanted to counter the assertion that "There's no way it can be banned today, though" (which I should have quoted). Even a disconcertingly non-trivial number of western lawmakers make regular noises about requiring all encryption to be backdoored.
ajuc 6y ago
Yup. In communist Poland even having a typing machine was a big no-no unless you were a registered writer (because why would you have it if not to make leaflets, and if you're making leaflets you are clearly anti-government). If you're getting mail from abroad you're already on a list. If you're getting encrypted mail - you'll probably disappear.
castevictim 6y ago
When someone reads the above comment and thinks 'Oh well, it is a risk the user is willing to take by using these apps in an Authoritarian regime' should think again. Targeting users who rely upon secure apps is becoming common in flawed democracies as well and more countries are eager to join that list. Several people, including minors were arrested in Kashmir when police found VPN app on their mobile during routine checks[0]. Government's logic being 'Why use VPN, if you are not a terrorist?' At the same time journalists, activists are heavily dependent upon secure apps like this to make their voice heard outside, all the more reason for all of us who are lucky to not have gestapo knocking our doors because we used a VPN to watch PornHub to make usage of such secure apps (messaging, email, VPN etc.) very common. [0]https://scroll.in/article/954711/in-kashmir-a-spree-of-arrests-for-alleged-misuse-of-social-media-and-vpns https://scroll.in/article/954711/in-kashmir-a-spree-of-arres...

giancarlostoro 6y ago

If only Google and Apple would make a fully end to end encrypted chatting platform to take place of SMS that is fully federated and not controlled by a single entity, something the likes of Signal could support / join in on and other chat apps. When you turn crypto into something the masses use seamlessly it gets a little more complicated to figure out who the suspects are. Also default to not synching to the cloud, and explain why syncing to the cloud could be compromised.

andrepd 6y ago
If spying on you is their business model, why would they build an app to prevent you from being spied?
- LeoPanthera 6y ago
  Spying on you is not Apple's business model.
  - shaniamama 6y ago
    Oh indeed it is. I spent years reading apple reports and my conclusion was that they want the data for themselves so they can sell it. Devices don't make much profit when you factor in how much is spent buying up almost all old devices that hit the market.
    - p1necone 6y ago
      Do you have any evidence of Apple selling user data?
      - slivanes 6y ago
        It's right in Apple's privacy policy, see Disclosure to Third Parties section: https://www.apple.com/legal/privacy/en-ww/ https://www.apple.com/legal/privacy/en-ww/ They obviously sell user data in aggregate - not at a personal level, but which of the big tech companies sell personal data (maybe FB / Cambridge Analytica?) Also, Apple has Google as the default search engine which Google pays billions for. Is that selling your personal data?
        p1necone 6y ago
        You mean the disclosure to third parties section that explicitly says "Apple does not sell personal information"? I can't see anything in that section that says that they sell information to third parties, personally identifiable or aggregate (I would consider the latter to be "personal" data as well fwiw). Is there a specific sentence you're thinking of? It seems to be talking about the necessary sharing of data that happens when Apple contracts with third party services to run their own business. E.g. when they ship you a product they need to provide your address to the courier company. Or when they pay an advertising company to run ads for Apple products targeting certain markets/their own existing customers (not the same thing as selling personal data to an advertiser so that they can run ads for other products using said data - that would be selling personal data) As far as I can tell you're either using a definition of "sell" that is different to mine, or you're claiming Apple is using weaselly language to make it sound like they don't when they do (which is not unheard of of course). But you haven't provided enough information for me to really know what you're talking about - which is it, and why? Also no, making the default search engine google is not selling personal data.
  - dancemethis 6y ago
    It is, alongside limiting what you can do with their leased equipment that people think they bought.
    - gorgoiler 6y ago
      This made me jump. You make one excellent point, with appropriately shocking language: When I can’t do what I want with my phone, I may as well be leasing it. Hmmm. But I don’t believe Apple’s business model is to spy on me.
      - adev_ 6y ago
        > But I don’t believe Apple’s business model is to spy on me. Apple business is not spying on you, but Apple business is much easier to do if they do spy on you. Meaning they do it anyway, don't worry.
      - sneak 6y ago
        Almost every app in the App Store, per Apple's guidelines, has tons of spyware in it. Apple asserts that you agreed to this experience when you accepted the TOS of the App Store. It's impossible to use an iPhone with any popular apps and not be constantly spied on. Insofar as Apple's business model is to make the (full of spyware) App Store successful, it's Apple's business model to spy on you.
      - fsflover 6y ago
        > But I don’t believe Apple’s business model is to spy on me. "Location-Based Apple Ads: Your iPhone will send your location to Apple in order to provide you with geographically relevant ads on Apple News and in the App Store." More: https://support.apple.com/en-us/HT207056 https://support.apple.com/en-us/HT207056 So not exactly "business model", but does it matter?
Legogris 6y ago
From what I an tell, this is the goal of matrix.org - though full federation and identity portability is not there yet.
jpetso 6y ago
Funny that you should mention Signal as example for joining a federated service when they have actively and vocally moved away from federation. https://signal.org/blog/the-ecosystem-is-moving/ https://signal.org/blog/the-ecosystem-is-moving/

gitgud 6y ago

Looks like this app uses TOR in long-range communication. Although it's annonymous, your connection to the network is detectable and would trigger redflags in government monitoring software...

p1necone 6y ago

I've pondered the merits of someone spreading a virus that just sends (small, but relatively constant and random) amounts of encrypted data (maybe to other infected devices, and various other endpoints). Spread it widely enough and everyone gets to communicate privately with plausible deniability. Of course it doesn't even need to be real data, random gibberish would work too.

lcuff 6y ago
Perhaps. Back in the 80's, folks on Usenet would add words like "nuclear", "bomb", "spy", "communist" to their email footers and posting signatures, in hopes of overloading the (suspected/expected) NSA monitoring of traffic. I'm going to guess that sophisticated filters dealt effectively with such things back then, and even more sophisticated filters would deal with your random encrypted bits too.
- jack1243star 6y ago
  Curious anecdote, some underground Japanese P2P networks have files with contents filled with references to Tiananmen, Tibet and the Uyghurs etc. probably to attract attention from CCP to deter Chinese users from downloading them.

suizi 6y ago

Authoritarian regimes are often far less technologically advanced than free countries. They will often import technology from free countries and be constrained by whatever freedom respecting decisions they've made.

skrebbel 6y ago
China is an authoritarian regime that is as technologically advanced as the US and Western Europe, and they will gladly export freedom restricting technology.
new2628 6y ago
This is like saying that the weapons advanced countries sell to less advanced countries are more "life-respecting".
- londons_explore 6y ago
  Imagine a world where a gun sold is by the US to a poor wartorn nation. When the trigger is pulled, it does facial recognition to figure out who it is aimed at, and if it detects someone friendly to US interests, it will refuse to hit them.
  - eeZah7Ux 6y ago
    > Imagine a world where a gun sold is by the US to a poor wartorn nation There is no need to imagine it.

Legogris 6y ago

This is precisely why it's important to make these tools (protocols/applications) part of the core layer of how businesses operate consumer-facing services online; it's only true if the ratio of "interesting" communication over these channels is high enough. In an alternative timeline where ISPs where more strictly regulated and trusted and everything was cleartext HTTP, I'm certain that HTTPS/TLS would face pushback from regulators. There's no way it can be banned today, though. Similarly, you won't be marked as suspicious just from opening an encrypted TLS connecting over port 443 to an arbitrary endpoint. I don't think it's too late. There is a significant probability that today's centralized incumbents will Myspace at some point in the future. These federated, decentralized and secure solutions could be the next iteration after that.

mpartel 6y ago
Oppressors can (and I think some already do) subvert HTTPS by mandating installation of government-issued certs so they can do their MITM.
- Legogris 6y ago
  I know there have been attempts (was it Iran and Kazakhstan that was in the news last year?), but is anyone aware of this actually being done in practice today? My understanding is that they were forced to roll back for practical reasons (which highlights my point).
- mosselman 6y ago
  That is an irrelevant detail. The comment you are responding to isn’t saying that https is foolproof. They are saying that it would help people to be more free of digital control if privacy respecting technology is so common that it isn’t suspicious when you use it.
  - mpartel 6y ago
    I agree that it helps (though I'm probably more pessimistic about how much it helps). I wanted to counter the assertion that "There's no way it can be banned today, though" (which I should have quoted). Even a disconcertingly non-trivial number of western lawmakers make regular noises about requiring all encryption to be backdoored.

ajuc 6y ago

Yup. In communist Poland even having a typing machine was a big no-no unless you were a registered writer (because why would you have it if not to make leaflets, and if you're making leaflets you are clearly anti-government). If you're getting mail from abroad you're already on a list. If you're getting encrypted mail - you'll probably disappear.

castevictim 6y ago

When someone reads the above comment and thinks 'Oh well, it is a risk the user is willing to take by using these apps in an Authoritarian regime' should think again. Targeting users who rely upon secure apps is becoming common in flawed democracies as well and more countries are eager to join that list. Several people, including minors were arrested in Kashmir when police found VPN app on their mobile during routine checks[0]. Government's logic being 'Why use VPN, if you are not a terrorist?' At the same time journalists, activists are heavily dependent upon secure apps like this to make their voice heard outside, all the more reason for all of us who are lucky to not have gestapo knocking our doors because we used a VPN to watch PornHub to make usage of such secure apps (messaging, email, VPN etc.) very common. [0]https://scroll.in/article/954711/in-kashmir-a-spree-of-arrests-for-alleged-misuse-of-social-media-and-vpns https://scroll.in/article/954711/in-kashmir-a-spree-of-arres...