9 ms·

Jimmy Wales threatens to encrypt Wikipedia if UK passes snooping bill

100 points by throwaway1979 14y ago

SoftwareMaven 14y ago
Anybody have a guess of what it would cost for Wikipedia to do 100% SSL for a country like Great Britain?
- TranceMan 14y ago
  Very little, they already have https support - I am sure that they could handle disabling http . that is not the point. I see the point Jimmy Wales was making - it's the old: 'if you have nothing to hide' - and it should stand. If you want to keep something private you have the right to do that....I don't care what I do in public....
  - nullc 14y ago
    Unfortunately Wikipedia chose to go with a separate cluster for SSL. If they ran SSL on their normal front end then it would already scale up to this: The public key crypto is free on hyperthreaded cpus because it can run currently with memory accesses for other requests, and modern CPUs have harware accel for the symmetric crypto that make it ~free.
TranceMan 14y ago
Interesting timing. Hadn't seen your post.......
samarudge 14y ago
Maybe a little bit of a sensationalist title, websites switching to HTTPS only isn't that much of a threat, yes the bill is bad and yes he should be opposing it but Ars seem to frame it as though it's drastic or has a negative effect on anyone. While I disagree with the bill and the concept of monitoring peoples internet, I don't think they're doing it so they can find out what you're reading on Wikipedia or who you're messaging on Facebook.
- csense 14y ago
  > I don't think they're doing it so they can find out what you're reading on Wikipedia or who you're messaging on Facebook. What makes you think that sort of information isn't exactly what they're interested in? Even if they don't care about it right now, once it starts being collected, if any future government decides they do care about it, it'd be very easy for them to get their hands on it.
  - evoxed 14y ago
    This is actually one of the more interesting things about how data is being collected these days... because we (or rather, our machines) now have the capacity to scavenge and parse so much more data than we could've dreamed of before, people, corporations, governments, etc. have already caught on to the idea that you don't actually need to know your angle before you execute. Gathering tons and tons of data may seem completely worthless or missing the point, but the reality is that "the point" no longer exists. It's all just floating data that, when the time comes, either passes through the filter or throws a flag. Basically, the government may not care who you're messaging on facebook now, but if someone discovers a correlation to some other problem in the future they'll be damn pleased that they have that data.
nullc 14y ago
They should do this anyways. It's well known to the technical elite that dragnet surveillance is going on— but it's not known to the general public. It's arguably immoral that the site doesn't switch to https by default and give the public the privacy they think they already have.
- mtgx 14y ago
  That's a very good point. The majority of people have no idea that many Governments are already monitoring and data mining everything they say or do online. Websites should already start switching to HTTPS (or SPDY) to protect their users against this stealth monitoring, of which they know nothing about. But if they don't and if this law passes (I hope it doesn't) maybe some good will come out of it, and it will jumpstart a trend for switching to encrypted connections.
  - MikeCapone 14y ago
    So what do you guys do to counter this? Do you use encrypted VPNs? Any specific ones you'd recommend?
    - adorton 14y ago
      http://lifehacker.com/5940565/why-you-should-start-using-a-vpn-and-how-to-choose-the-best-one-for-your-needs http://lifehacker.com/5940565/why-you-should-start-using-a-v...
    - propercoil 14y ago
      check mullvad. you can pay with cash over mail, bitcoin or whatever. no logs, two external ip's for thousands of customers. google it
      - wamatt 14y ago
        Looks interesting, but who is to say they don't keep logs? A VPN on VPS provider, whom accepts similar payment options is an alternative option.
jiggy2011 14y ago
IIRC, under the bill they would only record which sites you visited , not which pages you visited. So this wouldn't make any difference.
zmmmmm 14y ago
This is one reason why enacting this kind of legislation is such a terrible idea for the very people advocating it. Right now most of the web is ridiculously open and unencrypted. If authorities get the appropriate warrants it's almost guaranteed they will be able to spy on almost anybody doing almost anything because the default mode is unencrypted and nobody really thinks about it. But that default mode is only the default because people think their communications are reasonably private anyway, precisely because this kind of logging is pretty expensive and impractical. Laws to enforce it will motivate everyone to move to encrypted connections, greatly increase use of VPNs for all non-trivial communications, and ensure that criminals become educated about how to encrypt their activities. If governments around the world seriously pursue this, far from reaping the windfall they are hoping for they will actually kill the golden goose that could be helping them solve more crimes than ever.
- leod 14y ago
  This is, of course, assuming, that the government is creating this law for the reason of solving crime and not for some special interests / lobbies.
trips2 14y ago
https://en.wikipedia.org/w/index.php?search=whatever https://en.wikipedia.org/w/index.php?search=whatever Is that not encryption? Or maybe he means make that the default?
gregsq 14y ago
The UK isn't the only trusted western country apparently synchronising internet data mining capability. Australia is seriously considering a two year retention of web traffic by ISP's. http://www.itnews.com.au/News/313178,public-opposes-federal-data-retention-proposal.aspx http://www.itnews.com.au/News/313178,public-opposes-federal-...
- simplexion 14y ago
  Not just that. They also want to make it illegal to not decrypt your data on request. I think lots of people will be forgetting their passwords soon.
islon 14y ago
Go Jimmy! Every site should do that anyway. The doors are closing, it's up to us the let them open.
est 14y ago
Switching to HTTPS won't help as it's just arms race between websites and governments. Jimmy, if you think you have enough technology competance enough, try China's GFW.
candeira 14y ago
"Threatens"? How about "promises"?
oliwarner 14y ago
I can almost hear the politicians now: Oh please, Jimmy, please! Please don't enable SSL! But seriously, what he's suggesting is the truth. Any website that thinks it might be seen as slightly toxic for its users will move to SSL if it wants to stay in use. The problem with this play is that turning on SSL for all Wikipedia users would be really very expensive. Encryption costs a lot of CPU cycles and entropy.

100 points by throwaway1979 14y ago

SoftwareMaven 14y ago

Anybody have a guess of what it would cost for Wikipedia to do 100% SSL for a country like Great Britain?

TranceMan 14y ago
Very little, they already have https support - I am sure that they could handle disabling http . that is not the point. I see the point Jimmy Wales was making - it's the old: 'if you have nothing to hide' - and it should stand. If you want to keep something private you have the right to do that....I don't care what I do in public....
- nullc 14y ago
  Unfortunately Wikipedia chose to go with a separate cluster for SSL. If they ran SSL on their normal front end then it would already scale up to this: The public key crypto is free on hyperthreaded cpus because it can run currently with memory accesses for other requests, and modern CPUs have harware accel for the symmetric crypto that make it ~free.

TranceMan 14y ago

Interesting timing. Hadn't seen your post.......

samarudge 14y ago

Maybe a little bit of a sensationalist title, websites switching to HTTPS only isn't that much of a threat, yes the bill is bad and yes he should be opposing it but Ars seem to frame it as though it's drastic or has a negative effect on anyone. While I disagree with the bill and the concept of monitoring peoples internet, I don't think they're doing it so they can find out what you're reading on Wikipedia or who you're messaging on Facebook.

csense 14y ago
> I don't think they're doing it so they can find out what you're reading on Wikipedia or who you're messaging on Facebook. What makes you think that sort of information isn't exactly what they're interested in? Even if they don't care about it right now, once it starts being collected, if any future government decides they do care about it, it'd be very easy for them to get their hands on it.
- evoxed 14y ago
  This is actually one of the more interesting things about how data is being collected these days... because we (or rather, our machines) now have the capacity to scavenge and parse so much more data than we could've dreamed of before, people, corporations, governments, etc. have already caught on to the idea that you don't actually need to know your angle before you execute. Gathering tons and tons of data may seem completely worthless or missing the point, but the reality is that "the point" no longer exists. It's all just floating data that, when the time comes, either passes through the filter or throws a flag. Basically, the government may not care who you're messaging on facebook now, but if someone discovers a correlation to some other problem in the future they'll be damn pleased that they have that data.

nullc 14y ago

They should do this anyways. It's well known to the technical elite that dragnet surveillance is going on— but it's not known to the general public. It's arguably immoral that the site doesn't switch to https by default and give the public the privacy they think they already have.

mtgx 14y ago
That's a very good point. The majority of people have no idea that many Governments are already monitoring and data mining everything they say or do online. Websites should already start switching to HTTPS (or SPDY) to protect their users against this stealth monitoring, of which they know nothing about. But if they don't and if this law passes (I hope it doesn't) maybe some good will come out of it, and it will jumpstart a trend for switching to encrypted connections.
- MikeCapone 14y ago
  So what do you guys do to counter this? Do you use encrypted VPNs? Any specific ones you'd recommend?
  - adorton 14y ago
    http://lifehacker.com/5940565/why-you-should-start-using-a-vpn-and-how-to-choose-the-best-one-for-your-needs http://lifehacker.com/5940565/why-you-should-start-using-a-v...
  - propercoil 14y ago
    check mullvad. you can pay with cash over mail, bitcoin or whatever. no logs, two external ip's for thousands of customers. google it
    - wamatt 14y ago
      Looks interesting, but who is to say they don't keep logs? A VPN on VPS provider, whom accepts similar payment options is an alternative option.

jiggy2011 14y ago

IIRC, under the bill they would only record which sites you visited , not which pages you visited. So this wouldn't make any difference.

zmmmmm 14y ago

This is one reason why enacting this kind of legislation is such a terrible idea for the very people advocating it. Right now most of the web is ridiculously open and unencrypted. If authorities get the appropriate warrants it's almost guaranteed they will be able to spy on almost anybody doing almost anything because the default mode is unencrypted and nobody really thinks about it. But that default mode is only the default because people think their communications are reasonably private anyway, precisely because this kind of logging is pretty expensive and impractical. Laws to enforce it will motivate everyone to move to encrypted connections, greatly increase use of VPNs for all non-trivial communications, and ensure that criminals become educated about how to encrypt their activities. If governments around the world seriously pursue this, far from reaping the windfall they are hoping for they will actually kill the golden goose that could be helping them solve more crimes than ever.

leod 14y ago
This is, of course, assuming, that the government is creating this law for the reason of solving crime and not for some special interests / lobbies.

trips2 14y ago

https://en.wikipedia.org/w/index.php?search=whatever https://en.wikipedia.org/w/index.php?search=whatever Is that not encryption? Or maybe he means make that the default?

gregsq 14y ago

The UK isn't the only trusted western country apparently synchronising internet data mining capability. Australia is seriously considering a two year retention of web traffic by ISP's. http://www.itnews.com.au/News/313178,public-opposes-federal-data-retention-proposal.aspx http://www.itnews.com.au/News/313178,public-opposes-federal-...

simplexion 14y ago
Not just that. They also want to make it illegal to not decrypt your data on request. I think lots of people will be forgetting their passwords soon.

islon 14y ago

Go Jimmy! Every site should do that anyway. The doors are closing, it's up to us the let them open.

est 14y ago

Switching to HTTPS won't help as it's just arms race between websites and governments. Jimmy, if you think you have enough technology competance enough, try China's GFW.

candeira 14y ago

"Threatens"? How about "promises"?

oliwarner 14y ago

I can almost hear the politicians now: Oh please, Jimmy, please! Please don't enable SSL! But seriously, what he's suggesting is the truth. Any website that thinks it might be seen as slightly toxic for its users will move to SSL if it wants to stay in use. The problem with this play is that turning on SSL for all Wikipedia users would be really very expensive. Encryption costs a lot of CPU cycles and entropy.