4 ms·

I'm actively encouraging the users of the sites I run to encrypt everything. I'm giving advice in private messages about how to use Truecrypt (especially when

by buro9 15y ago

I'm actively encouraging the users of the sites I run to encrypt everything. I'm giving advice in private messages about how to use Truecrypt (especially when using Dropbox or any remote backup or cloud sync service), what a VPN is and how to use Relakks or IPredator, etc. Just basic things, yet the reaction has been extremely positive. One of the sites I run exists by donations, and just for giving this advice 1 person donated £100 to the running of the site because in his words "No-one else is telling me to encrypt or helping me.". The big glaring omission in all of this is email. We all want a secure email system, and one that doesn't involve locking yourself into a single provider (Hushmail), and yet can co-exist with sending email to recipients on webmail and corporate solutions. Talk about a big hole in the market. I've not pitched this to my users as "here's how to pirate", it's just been "privacy is core to democracy, encryption protects your privacy". And additionally I've argued to them that if they were amongst the people who turned their Twitter avatars green last year for Iran, then by not using encryption they leave encryption to "terrorists, criminals and dissidents", who cares for the first two, but if you care for the last you'll encrypt too to ensure that their dissenting opinion can be voiced safely in private. I got the idea for telling my users all of this from HN, and specifically a link to a Canadian site: http://encrypteverything.ca/index.php/Main_Page http://encrypteverything.ca/index.php/Main_Page Then I also shared links to: https://www.eff.org/https-everywhere https://www.eff.org/https-everywhere https://www.relakks.com/?lang=eng https://www.relakks.com/?lang=eng https://ssd.eff.org/tech/encryption https://ssd.eff.org/tech/encryption I truly think that the best response that the people of Britain can give to these proposals is to encrypt everything and take away from the government the ability to pervasively spy on their own populace like this. With most governments and corps it always feels like that ask for a mile, and when we object they concede half a mile. We're happy, but then they do this a few times and they get to where they wanted to be. What better way to halt this for good than to encrypt everything. Now, if someone could just give us email v2, secure by default. I'd happily pay for it. Just make it work, and make it open source and aim for it to be standard... don't give me another closed service to achieve it.

alan_cx 15y ago
A genuine question and not a smart arse comment: Does any of this really stop the snooping, or is it just giving a false sense of security? Then, would deploying all this on a day to day basis suggest to a paranoid snooper that one is hiding something than there for a legitimate target for more snooping?
- buro9 15y ago
  It does several things: 1) It anonymises where the traffic originated ( in the case of a VPN run along the lines of Relakks ) 2) It encrypts, so whilst if you weren't using a VPN they'd still see traffic go from point A to point B, they wouldn't have a record of the contents of the communication Neither of those things is a false sense of security. And yes to the last... if only those who feel that they have something to hide encrypt things, then you might reasonably expect a person who is suspicious of others to reach that conclusion. But I would argue that everyone has something to hide. Privacy isn't just core to democracy and free speech, it's core to intimacy too. So you end up with two strong arguments to encrypt, one is to protect your own privacy, and then from your argument about how only "those with something to hide, encrypt", comes the second which is that most freedoms enjoyed by people were earned through dissent and revolution (and war, but that doesn't help this particular argument)... are such things possible in a society that pervasively spies in it's own citizens? So to protect the future dissidents you should in addition to caring for your own privacy, encrypt to ensure you give protection to those who may one day be fighting for your rights.
gravitronic 15y ago
... Wait, why aren't we talking about PGP? PGP (and it's mathematical foundations to some degree) were invented to solve the secure email problem. Back then the proponents of PGP essentially predicted the situation we're in now. Up until now there's been plausible deniability for any of us normal people to care, so consumer adoption of PGP remains close to nil. Even corporate use I've seen only comes into play when dealing with another company who forces it be used. That's changing fast. Their original use case (secure messaging in a monitored society) is no longer only a tinfoil hat situation. The solution is for all of us HNers to adopt PGP 100%. Everyone who wants to talk to use would have to adopt PGP. The friction to start is rather huge but that is how something like this would get adopted. As for "but it doesn't jive with my gmail nicely".. maybe it's time we give up gmail too. It's value proposition is based on reading your email to be better build a profile on you to sell to advertisers. That's why google plus wanted your real name, so they have a face to put all that mined data to. Switch To PGP Day? edit: relevant links "simple pgp chrome plugin for gmail" - http://news.ycombinator.com/item?id=2918255 http://news.ycombinator.com/item?id=2918255
- buro9 15y ago
  I agree. I want to talk about PGP. But I'm talking to end users who have real trouble setting up a VPN. PGP's big problem back then was that it should be invisible and just work, it was neither. That's what I mean by needing to revisit secure email.
  - gravitronic 15y ago
    I agree with everything you posted above and have no solution better than "hushmail and live with it".
    - DanBC 15y ago
      Hushmail only protects the contents. The new law is aimed at routing data (who sent the email; who it was sent to). Hushmail comply with correctly formed legal requests (they have to) but they go as far as creating back-doored java apps and serving them to specified customers. I guess it's harder for English LEOs to get correct legal documents to an American company for English customers. But I don't know.

by buro9 15y ago

alan_cx 15y ago

A genuine question and not a smart arse comment: Does any of this really stop the snooping, or is it just giving a false sense of security? Then, would deploying all this on a day to day basis suggest to a paranoid snooper that one is hiding something than there for a legitimate target for more snooping?

buro9 15y ago
It does several things: 1) It anonymises where the traffic originated ( in the case of a VPN run along the lines of Relakks ) 2) It encrypts, so whilst if you weren't using a VPN they'd still see traffic go from point A to point B, they wouldn't have a record of the contents of the communication Neither of those things is a false sense of security. And yes to the last... if only those who feel that they have something to hide encrypt things, then you might reasonably expect a person who is suspicious of others to reach that conclusion. But I would argue that everyone has something to hide. Privacy isn't just core to democracy and free speech, it's core to intimacy too. So you end up with two strong arguments to encrypt, one is to protect your own privacy, and then from your argument about how only "those with something to hide, encrypt", comes the second which is that most freedoms enjoyed by people were earned through dissent and revolution (and war, but that doesn't help this particular argument)... are such things possible in a society that pervasively spies in it's own citizens? So to protect the future dissidents you should in addition to caring for your own privacy, encrypt to ensure you give protection to those who may one day be fighting for your rights.

gravitronic 15y ago

... Wait, why aren't we talking about PGP? PGP (and it's mathematical foundations to some degree) were invented to solve the secure email problem. Back then the proponents of PGP essentially predicted the situation we're in now. Up until now there's been plausible deniability for any of us normal people to care, so consumer adoption of PGP remains close to nil. Even corporate use I've seen only comes into play when dealing with another company who forces it be used. That's changing fast. Their original use case (secure messaging in a monitored society) is no longer only a tinfoil hat situation. The solution is for all of us HNers to adopt PGP 100%. Everyone who wants to talk to use would have to adopt PGP. The friction to start is rather huge but that is how something like this would get adopted. As for "but it doesn't jive with my gmail nicely".. maybe it's time we give up gmail too. It's value proposition is based on reading your email to be better build a profile on you to sell to advertisers. That's why google plus wanted your real name, so they have a face to put all that mined data to. Switch To PGP Day? edit: relevant links "simple pgp chrome plugin for gmail" - http://news.ycombinator.com/item?id=2918255 http://news.ycombinator.com/item?id=2918255

buro9 15y ago
I agree. I want to talk about PGP. But I'm talking to end users who have real trouble setting up a VPN. PGP's big problem back then was that it should be invisible and just work, it was neither. That's what I mean by needing to revisit secure email.
- gravitronic 15y ago
  I agree with everything you posted above and have no solution better than "hushmail and live with it".
  - DanBC 15y ago
    Hushmail only protects the contents. The new law is aimed at routing data (who sent the email; who it was sent to). Hushmail comply with correctly formed legal requests (they have to) but they go as far as creating back-doored java apps and serving them to specified customers. I guess it's harder for English LEOs to get correct legal documents to an American company for English customers. But I don't know.