8 ms·

Downside of trading privacy for security: anything that makes a network connection creates metadata about you, and the metadata is the real danger for analyzing

by Lammy 2y ago

Downside of trading privacy for security: anything that makes a network connection creates metadata about you, and the metadata is the real danger for analyzing your social connections: https://kieranhealy.org/blog/archives/2013/06/09/using-metadata-to-find-paul-revere/ https://kieranhealy.org/blog/archives/2013/06/09/using-metad... The problem isn't about the big corporations themselves but about the fact that the network itself is always listening and the systems the big corporations build tend to incentivize making as many metadata-leaking connections as possible, either in the name of advertising to you or in the name of Keeping You Safe™: https://en.wikipedia.org/wiki/Five_Eyes https://en.wikipedia.org/wiki/Five_Eyes Transparent WWW caching is one example of a pro-privacy setup that used to be possible and is no longer feasible due to pervasive TLS. I used to have this kind of setup in the late 2000s when I had a restrictive Comcast data cap. I had a FreeBSD gateway machine and had PF tied in to Squid so every HTTP request got cached on my edge and didn't hit the WAN at all if I reloaded the page or sent the link to a roommate. It's still technically possible if one can trust their own CA on every machine on their network, but in the age of unlimited data who would bother? Other example: the Mac I'm typing this on phones home every app I open in the name of “““protecting””” me from malware. Everyone found this out the hard way in November 2020 and the only result was to encrypt the OCSP check in later versions. Later versions also exempt Apple-signed binaries from filters like Little Snitch so it's now even harder to block. Sending those requests at all effectively gives interested parties the ability to run a “Hey Siri, make a list of every American who has used Tor Browser” type of analysis if they wanted to: https://lapcatsoftware.com/articles/ocsp-privacy.html https://lapcatsoftware.com/articles/ocsp-privacy.html

anthk 2y ago
[flagged]
- Lammy 2y ago
  It's my work computer — not my choice. At home I use a Corebooted 51nb neo-ThinkPad.
  - amatecha 2y ago
    Oh damn, that escalated quickly. Nice! How is that 51nb board? I totally forgot they were a thing. I have many ThinkPads but unfortunately am at the cap of coreboot-able (X230)... It's sadly getting to the point where the web, of all things, is gradually creeping out of reach.
    - Lammy 2y ago
      It is the best computer I have ever used but parts availability can be an issue. For example I had the eDisplayPort flex-PCB go bad in my X210 and had to homebrew my own replacement. I have an entire spare machine just in case, since I couldn't just go out and buy one if I needed it Right Now.
      - amatecha 2y ago
        Nice, that's cool to hear (best computer), but yeah I suppose it has some inherent "rarity" to it. One of the nice things about the ThinkPads is their popularity/"ubiquitousness" (is that a word?) - I have like, five X230's at this point! So easy to find an amazing deal on one if you're patient. But yeah, these are really starting to show their age. Still fine to use overall, but it can be pretty limiting at times.
- hammock 2y ago
  I thought Macs were better for privacy?
  - samatman 2y ago
    Better than what, is the question. Where people stand on this question ultimately lies in whether they trust what Apple says. For example, Gatekeeper / OCSP, the service mentioned in the GP. Apple says the following: > Gatekeeper performs online checks to verify if an app contains known malware and whether the developer’s signing certificate is revoked. We have never combined data from these checks with information about Apple users or their devices. We do not use data from these checks to learn what individual users are using on their devices. https://support.apple.com/en-us/102445 https://support.apple.com/en-us/102445 That's either true or it isn't. If it's true, then the GP comment is wrong about "Hey Siri who is using Tor", if it's not true, they are correct. Blocking the service using a hosts file works, and does not prevent applications from opening, a case can be made that this should be even easier with a system preferences setting, but we come back to the same question: if you trust what Apple says about the service, making it easy to disable (and blocking a DNS entry is not especially difficult) would be foolish, because the threat landscape does include malware, and does not include Apple sharing information (they claim that) they don't have, about what programs users open. If Apple is lying, or one thinks Apple is lying, then the problems do not end with Gatekeeper. They could be logging every key I type, faking E2EE through some clever obfuscated code, and so on. Blocking the OSCP server will do nothing, they can exfiltrate anything they want from an operating system which they alone control. I happen to believe Apple's privacy claims are honest. This is based on a couple of things: primarily, privacy is a valuable (to them) and emphasized part of their brand, and any discovered breach of trust would be hugely detrimental to their bottom line. Also, there's a dog which didn't bark, in the form of an absence of whistleblowers reporting on how Apple's privacy claims are bullshit and they actually pwn everything. TL;DR there are OSes which claim to offer more privacy than Apple, but now you're trusting ~everyone who has contributed software to those operating systems instead. I also happen to think that e.g. Qubes and Tails do improve on privacy over the macOS etc. baseline, but I can't prove that, anymore than I can demonstrate that Apple isn't lying. It is physically impossible to audit all the code we run personally. It just can't be done. So trust is a non-optional component of making decisions about privacy and security. It will always be thus.
kmeisthax 2y ago
Transparent HTTP caching as a way to avoid leaking metadata is not pro-privacy. It only works because the network is always listening, to both metadata and message content. The reason why people worry about metadata is because it's a way to circumvent encryption (and the law). Metadata is holographic[0] to message content, so you need to protect it with the same zeal content is protected. But letting everyone have the message content so that metadata doesn't leak isn't helpful. Maybe in the context it was deployed, where pervasive deep packet inspection was only something China wasted their CPU cycles on, your proxy made sense. But it doesn't make sense today. [0] X is holographic to Y when the contents of X can be used to completely reconstruct Y.
- SketchySeaBeast 2y ago
  How it metadata holographic? Sure, you can know when I communicated to a particular individual, and even the format and size of the message, but it doesn't include the exact message, right?
  - some_furry 2y ago
    "We kill people based on metadata." https://www.justsecurity.org/10318/video-clip-director-nsa-cia-we-kill-people-based-metadata/ https://www.justsecurity.org/10318/video-clip-director-nsa-c...
    - SketchySeaBeast 2y ago
      It's certainly powerful, but that wasn't the claim I'm asking about.
  - wood_spirit 2y ago
    Gordon Welchman first productionized “traffic analysis” in WW2 at Bletchley Park. When in his retirement he tried to write about it, it was his work on traffic analysis more than his disclosing that the allies had cracked enigma that most worried the NSA who tried to stop him publishing. Traffic analysis is in many ways more valuable than the contents of the messages. https://en.m.wikipedia.org/wiki/Gordon_Welchman https://en.m.wikipedia.org/wiki/Gordon_Welchman
2OEH8eoCRo0 2y ago
I don't see metadata as a danger, I think it's a great compromise between police work and privacy. Some of thi requirements I see here seem crazy. I want carte blanche access to the global network of other peoples computers and I want perfect privacy and I want perfect encryption... Yeah, no
- agiacalone 2y ago
  Maybe you don’t, but for some people, it’s lethal. https://www.justsecurity.org/10318/video-clip-director-nsa-cia-we-kill-people-based-metadata/ https://www.justsecurity.org/10318/video-clip-director-nsa-c...
  - 2OEH8eoCRo0 2y ago
    Good. Im glad the NSA is doing it's job. I don't want terrorists to feel safe while using our systems.
    - ziddoap 2y ago
      >“We kill people based on metadata” >“metadata absolutely tells you everything about somebody’s life. If you have enough metadata, you don’t really need content.” Your response to the above quotes is so short-sighted that I don't even know where to begin. As long as it's the people you don't like dying, I guess it's cool. Good thing the NSA is the only group in the world that has access to metadata at scale.
    - throwaway19972 2y ago
      If only the NSA or the people designating who terrorists are vs who our allies are had such pure, pro-human intentions.
      - 2OEH8eoCRo0 2y ago
        A hypothetical problem that we can tackle when (or if) it's actually a problem. Thanks for your metadata, regardless.
thadt 2y ago
One man's meta is another mans data. The classification of 'data' and 'metadata' into discrete bins makes it sound like metadata is somehow not also just 'data'. If every morning I got in my car and left for work and my neighbor followed me, writing down every place I went, what time I got there, how long I stayed, and the name of everyone I called, it would be incredibly intrusive surveillance data, and I'd probably be somewhat freaked out. If that neighbor were my cell phone provider, it would be Monday. What we allow companies and governments to do (and not do) with this data isn't something we can solve in the technical realm. We have to decide how we want our data handled, and then make laws respecting that.
- ryandv 2y ago
  > If every morning I got in my car and left for work and my neighbor followed me, writing down every place I went, what time I got there, how long I stayed, and the name of everyone I called, it would be incredibly intrusive surveillance data, and I'd probably be somewhat freaked out. It's not "surveillance data," you are in a public place and have no expectation of privacy. It's only through such neighbourhood watch and open-source intelligence initiatives that our communities can be kept safe from criminals and terrorists. Why are you so protective of your goings-on and the names of everyone you call? Are you calling terrorists or engaging in illicit activity at the places you visit? What is it that you have to hide? I would actually take the premise of (national) security even further and extend collection to not only metadata, but data as well. Further, these capabilities should be open-sourced and made available to all private citizens. Our current law enforcement systems are not powerful enough, nor do they move quickly enough to catch criminals - by the time sufficient information has been gathered on a suspect, it may already be too late.
  - jvan 2y ago
    >What is it that you have to hide? An argument so cliche, it has its own Wikipedia page[1]. In the US, we currently have a presidential candidate from a major party threatening harm to people based on their political, social, and biological qualities, which outsiders often determine by inference from data such as who people are in contact with and where they travel. Further, I would argue the need for individual privacy is innate in humans; as every child matures they find a need to do things without their parents over their shoulder, even without their peers, no matter how innocent the activity and it is a need that does not vanish in adulthood. We generally agree that things like removing bedroom doors as punishment is abusive because it robs the person of privacy. The same goes for installing monitoring software on your partner's phone, or a GPS tracker on their car. Privacy means we are able to be ourselves without our lives being scrutinized, criticized, judged, rated, shamed, blamed, or defamed by every person on the street. I close the door when I defecate, I draw the blinds when I copulate, I don't tell people my passwords, and I don't scan my grocery receipt to earn points because there are some things other people don't need to know. [1] https://en.wikipedia.org/wiki/Nothing_to_hide_argument#Criticism https://en.wikipedia.org/wiki/Nothing_to_hide_argument#Criti...
stouset 2y ago
I am struggling to comprehend how allowing everyone between you and the services you use to view not only the metadata but the content as well could possibly be considered privacy-preserving.
- natch 2y ago
  It’s kind of an unorthodox take, but I’m guessing the idea is that if corporations perceived that they didn’t have secure ways to protect stuff, they would refrain from gathering as much stuff, because they would be afraid of the liability. And btw the perception / reality distinction is important here in supporting this theory.
  - janalsncm 2y ago
    I disagree. What makes corporations afraid of liability are laws enforcing liability. We never got those, and I don’t see why weaker encryption would’ve created them. We could, for example, have meaningful penalties when a company leaks passwords in plain text.
    - natch 2y ago
      I didn't say there weren't other things that make companies worry about liability. Not sure you read what I said though.
- 1oooqooq 2y ago
  because you're comparing it wrong! in your mind, ssl won't leak anything. and non ssl leaks everything. make a list of everything you can infer without a cert looking on a ssl connection. then add on top of that all the things people with the cert or control over CAs can see and make a list of them all when you're done you notice ssl is not perfect as you think and the extra request and no cache compound all that.
  - Lammy 2y ago
    > make a list of everything you can infer without a cert looking on a ssl connection This exactly, and not just connection but connections, plural. If the network observes my encrypted connection to ocsp.apple.com followed by another encrypted connection to adobegenuine.com, an analyst could reasonably assume I'd just opened an Adobe Creative Suite app. Or if they see ocsp.apple.com followed by update.code.visualstudio.com, I probably just opened VSCode. Auto-updaters are the same kind of privacy scourge and every additional connection makes it worse. Citations: - https://helpx.adobe.com/enterprise/kb/network-endpoints.html https://helpx.adobe.com/enterprise/kb/network-endpoints.html - https://code.visualstudio.com/docs/setup/network https://code.visualstudio.com/docs/setup/network
cryptonector 2y ago
> Downside of trading privacy for security: > Transparent WWW caching is one example of a pro-privacy setup that used to be possible and is no longer feasible due to pervasive TLS. What? You're kidding. If we didn't have pervasive TLS we'd have neither privacy nor security. Sure, a caching proxy would add a measure of privacy, but not relative to the proxy's operator, and the proxy's operator would be the ISP, and the ISP has access to all sorts of metadata about you. Therefore pervasive TLS did not hurt privacy, and it did improve security. You're making the same mistake as Meredith Whittaker. It's a category mistake. > Other example: the Mac I'm typing this on phones home every app I open in the name of “““protecting””” me from malware. What does this have to do with secure cryptography? That's what TFA is about. You are conflating security as-in cryptography with security as-in operating system security. More category errors. These are serious errors because if we accept this nonsense then we accept weak cryptography -- that's DJB's point.

by Lammy 2y ago

anthk 2y ago

[flagged]

Lammy 2y ago
It's my work computer — not my choice. At home I use a Corebooted 51nb neo-ThinkPad.
- amatecha 2y ago
  Oh damn, that escalated quickly. Nice! How is that 51nb board? I totally forgot they were a thing. I have many ThinkPads but unfortunately am at the cap of coreboot-able (X230)... It's sadly getting to the point where the web, of all things, is gradually creeping out of reach.
  - Lammy 2y ago
    It is the best computer I have ever used but parts availability can be an issue. For example I had the eDisplayPort flex-PCB go bad in my X210 and had to homebrew my own replacement. I have an entire spare machine just in case, since I couldn't just go out and buy one if I needed it Right Now.
    - amatecha 2y ago
      Nice, that's cool to hear (best computer), but yeah I suppose it has some inherent "rarity" to it. One of the nice things about the ThinkPads is their popularity/"ubiquitousness" (is that a word?) - I have like, five X230's at this point! So easy to find an amazing deal on one if you're patient. But yeah, these are really starting to show their age. Still fine to use overall, but it can be pretty limiting at times.
hammock 2y ago
I thought Macs were better for privacy?
- samatman 2y ago
  Better than what, is the question. Where people stand on this question ultimately lies in whether they trust what Apple says. For example, Gatekeeper / OCSP, the service mentioned in the GP. Apple says the following: > Gatekeeper performs online checks to verify if an app contains known malware and whether the developer’s signing certificate is revoked. We have never combined data from these checks with information about Apple users or their devices. We do not use data from these checks to learn what individual users are using on their devices. https://support.apple.com/en-us/102445 https://support.apple.com/en-us/102445 That's either true or it isn't. If it's true, then the GP comment is wrong about "Hey Siri who is using Tor", if it's not true, they are correct. Blocking the service using a hosts file works, and does not prevent applications from opening, a case can be made that this should be even easier with a system preferences setting, but we come back to the same question: if you trust what Apple says about the service, making it easy to disable (and blocking a DNS entry is not especially difficult) would be foolish, because the threat landscape does include malware, and does not include Apple sharing information (they claim that) they don't have, about what programs users open. If Apple is lying, or one thinks Apple is lying, then the problems do not end with Gatekeeper. They could be logging every key I type, faking E2EE through some clever obfuscated code, and so on. Blocking the OSCP server will do nothing, they can exfiltrate anything they want from an operating system which they alone control. I happen to believe Apple's privacy claims are honest. This is based on a couple of things: primarily, privacy is a valuable (to them) and emphasized part of their brand, and any discovered breach of trust would be hugely detrimental to their bottom line. Also, there's a dog which didn't bark, in the form of an absence of whistleblowers reporting on how Apple's privacy claims are bullshit and they actually pwn everything. TL;DR there are OSes which claim to offer more privacy than Apple, but now you're trusting ~everyone who has contributed software to those operating systems instead. I also happen to think that e.g. Qubes and Tails do improve on privacy over the macOS etc. baseline, but I can't prove that, anymore than I can demonstrate that Apple isn't lying. It is physically impossible to audit all the code we run personally. It just can't be done. So trust is a non-optional component of making decisions about privacy and security. It will always be thus.

kmeisthax 2y ago

Transparent HTTP caching as a way to avoid leaking metadata is not pro-privacy. It only works because the network is always listening, to both metadata and message content. The reason why people worry about metadata is because it's a way to circumvent encryption (and the law). Metadata is holographic[0] to message content, so you need to protect it with the same zeal content is protected. But letting everyone have the message content so that metadata doesn't leak isn't helpful. Maybe in the context it was deployed, where pervasive deep packet inspection was only something China wasted their CPU cycles on, your proxy made sense. But it doesn't make sense today. [0] X is holographic to Y when the contents of X can be used to completely reconstruct Y.

SketchySeaBeast 2y ago
How it metadata holographic? Sure, you can know when I communicated to a particular individual, and even the format and size of the message, but it doesn't include the exact message, right?
- some_furry 2y ago
  "We kill people based on metadata." https://www.justsecurity.org/10318/video-clip-director-nsa-cia-we-kill-people-based-metadata/ https://www.justsecurity.org/10318/video-clip-director-nsa-c...
  - SketchySeaBeast 2y ago
    It's certainly powerful, but that wasn't the claim I'm asking about.
- wood_spirit 2y ago
  Gordon Welchman first productionized “traffic analysis” in WW2 at Bletchley Park. When in his retirement he tried to write about it, it was his work on traffic analysis more than his disclosing that the allies had cracked enigma that most worried the NSA who tried to stop him publishing. Traffic analysis is in many ways more valuable than the contents of the messages. https://en.m.wikipedia.org/wiki/Gordon_Welchman https://en.m.wikipedia.org/wiki/Gordon_Welchman

2OEH8eoCRo0 2y ago

I don't see metadata as a danger, I think it's a great compromise between police work and privacy. Some of thi requirements I see here seem crazy. I want carte blanche access to the global network of other peoples computers and I want perfect privacy and I want perfect encryption... Yeah, no

agiacalone 2y ago
Maybe you don’t, but for some people, it’s lethal. https://www.justsecurity.org/10318/video-clip-director-nsa-cia-we-kill-people-based-metadata/ https://www.justsecurity.org/10318/video-clip-director-nsa-c...
- 2OEH8eoCRo0 2y ago
  Good. Im glad the NSA is doing it's job. I don't want terrorists to feel safe while using our systems.
  - ziddoap 2y ago
    >“We kill people based on metadata” >“metadata absolutely tells you everything about somebody’s life. If you have enough metadata, you don’t really need content.” Your response to the above quotes is so short-sighted that I don't even know where to begin. As long as it's the people you don't like dying, I guess it's cool. Good thing the NSA is the only group in the world that has access to metadata at scale.
  - throwaway19972 2y ago
    If only the NSA or the people designating who terrorists are vs who our allies are had such pure, pro-human intentions.
    - 2OEH8eoCRo0 2y ago
      A hypothetical problem that we can tackle when (or if) it's actually a problem. Thanks for your metadata, regardless.

thadt 2y ago

One man's meta is another mans data. The classification of 'data' and 'metadata' into discrete bins makes it sound like metadata is somehow not also just 'data'. If every morning I got in my car and left for work and my neighbor followed me, writing down every place I went, what time I got there, how long I stayed, and the name of everyone I called, it would be incredibly intrusive surveillance data, and I'd probably be somewhat freaked out. If that neighbor were my cell phone provider, it would be Monday. What we allow companies and governments to do (and not do) with this data isn't something we can solve in the technical realm. We have to decide how we want our data handled, and then make laws respecting that.

ryandv 2y ago
> If every morning I got in my car and left for work and my neighbor followed me, writing down every place I went, what time I got there, how long I stayed, and the name of everyone I called, it would be incredibly intrusive surveillance data, and I'd probably be somewhat freaked out. It's not "surveillance data," you are in a public place and have no expectation of privacy. It's only through such neighbourhood watch and open-source intelligence initiatives that our communities can be kept safe from criminals and terrorists. Why are you so protective of your goings-on and the names of everyone you call? Are you calling terrorists or engaging in illicit activity at the places you visit? What is it that you have to hide? I would actually take the premise of (national) security even further and extend collection to not only metadata, but data as well. Further, these capabilities should be open-sourced and made available to all private citizens. Our current law enforcement systems are not powerful enough, nor do they move quickly enough to catch criminals - by the time sufficient information has been gathered on a suspect, it may already be too late.
- jvan 2y ago
  >What is it that you have to hide? An argument so cliche, it has its own Wikipedia page[1]. In the US, we currently have a presidential candidate from a major party threatening harm to people based on their political, social, and biological qualities, which outsiders often determine by inference from data such as who people are in contact with and where they travel. Further, I would argue the need for individual privacy is innate in humans; as every child matures they find a need to do things without their parents over their shoulder, even without their peers, no matter how innocent the activity and it is a need that does not vanish in adulthood. We generally agree that things like removing bedroom doors as punishment is abusive because it robs the person of privacy. The same goes for installing monitoring software on your partner's phone, or a GPS tracker on their car. Privacy means we are able to be ourselves without our lives being scrutinized, criticized, judged, rated, shamed, blamed, or defamed by every person on the street. I close the door when I defecate, I draw the blinds when I copulate, I don't tell people my passwords, and I don't scan my grocery receipt to earn points because there are some things other people don't need to know. [1] https://en.wikipedia.org/wiki/Nothing_to_hide_argument#Criticism https://en.wikipedia.org/wiki/Nothing_to_hide_argument#Criti...

stouset 2y ago

I am struggling to comprehend how allowing everyone between you and the services you use to view not only the metadata but the content as well could possibly be considered privacy-preserving.

natch 2y ago
It’s kind of an unorthodox take, but I’m guessing the idea is that if corporations perceived that they didn’t have secure ways to protect stuff, they would refrain from gathering as much stuff, because they would be afraid of the liability. And btw the perception / reality distinction is important here in supporting this theory.
- janalsncm 2y ago
  I disagree. What makes corporations afraid of liability are laws enforcing liability. We never got those, and I don’t see why weaker encryption would’ve created them. We could, for example, have meaningful penalties when a company leaks passwords in plain text.
  - natch 2y ago
    I didn't say there weren't other things that make companies worry about liability. Not sure you read what I said though.
1oooqooq 2y ago
because you're comparing it wrong! in your mind, ssl won't leak anything. and non ssl leaks everything. make a list of everything you can infer without a cert looking on a ssl connection. then add on top of that all the things people with the cert or control over CAs can see and make a list of them all when you're done you notice ssl is not perfect as you think and the extra request and no cache compound all that.
- Lammy 2y ago
  > make a list of everything you can infer without a cert looking on a ssl connection This exactly, and not just connection but connections, plural. If the network observes my encrypted connection to ocsp.apple.com followed by another encrypted connection to adobegenuine.com, an analyst could reasonably assume I'd just opened an Adobe Creative Suite app. Or if they see ocsp.apple.com followed by update.code.visualstudio.com, I probably just opened VSCode. Auto-updaters are the same kind of privacy scourge and every additional connection makes it worse. Citations: - https://helpx.adobe.com/enterprise/kb/network-endpoints.html https://helpx.adobe.com/enterprise/kb/network-endpoints.html - https://code.visualstudio.com/docs/setup/network https://code.visualstudio.com/docs/setup/network

cryptonector 2y ago

> Downside of trading privacy for security: > Transparent WWW caching is one example of a pro-privacy setup that used to be possible and is no longer feasible due to pervasive TLS. What? You're kidding. If we didn't have pervasive TLS we'd have neither privacy nor security. Sure, a caching proxy would add a measure of privacy, but not relative to the proxy's operator, and the proxy's operator would be the ISP, and the ISP has access to all sorts of metadata about you. Therefore pervasive TLS did not hurt privacy, and it did improve security. You're making the same mistake as Meredith Whittaker. It's a category mistake. > Other example: the Mac I'm typing this on phones home every app I open in the name of “““protecting””” me from malware. What does this have to do with secure cryptography? That's what TFA is about. You are conflating security as-in cryptography with security as-in operating system security. More category errors. These are serious errors because if we accept this nonsense then we accept weak cryptography -- that's DJB's point.