6 ms·

It's easy to opine about things like educating the public or engineering 'crypto' for the common man. In my opinion that would be an exercise in futility. I t

by melito 14y ago

It's easy to opine about things like educating the public or engineering 'crypto' for the common man. In my opinion that would be an exercise in futility. I think a proper response to this issue is to simply promote social depravity on a grand scale. Everybody should just constantly read/watch/listen to media involving things like methamphetamine manufacturing, nuclear & home made weapons/chemicals, illegal currencies, human trafficking, hardcore pornography, armed rebellions, the middle east, famous terrorists, serial killers, bon jovi, etc All of those are a lot more interesting to the common man than lessons on how to use PGP....which is theoretically breakable thanks to the advent of quantum computing. If everything is being sniffed and stored, there have to be a number of very specific topics that are being sought after in that data.....in my opinion it'd be far worse if the government wasn't searching for things like human trafficking and nuclear weapons (things, hopefully, we can all agree are not good). Television series like "Breaking Bad" are already pulling weekly audience number of around 3 million plus. One could argue that you wouldn't even have to do much promotion, as these topics already seem to be mainstays in much present day pop culture

Karunamon 14y ago
Business idea: A "chaff box" that can be sold to the public. Given a list of dodgy search keywords, youtube links, etc etc etc, regularly updated from a central location (think like a websense blocklist but in reverse), uses a configurable amount of bandwidth. Hits these sites with a human-like usage pattern when HTTP traffic from your LAN IP is detected (so it only works when you're actually browsing the web). Plug it in and gain plausible deniability from most forms of government shenaniganery. Given critical mass, makes most forms of government behavioral analysis (and possibly advertiser behavioral analysis) useless. Build it on the raspberry pi or similar platform. Materials cost is $35 plus shipping materials. Main time investment is limited to maintaining the blocklist and the central servers. Hmm. Wonder how this could sell to the soccer mom crowd... Would also raise some interesting and thorny questions for the server side. If enough people are using the box for the effect to be meaningful, then a lot of sites are going to have a lot of useless web traffic; yet allowing sites to "opt out" or having an identifier of some kind of the box's traffic completely defeats the purpose of the system.
- melito 14y ago
  I think there are already a couple products like that....in fact I have a few in my house. I call them my cable modem and tivo
- dtromero 14y ago
  In theory, couldn't an interested party filter out the blocklist from the all other traffic? It would be more interesting to have a dynamic list that gets updated based on actual user behavior. That way, the interested party wouldn't be able to filter out the blocklist without potentially filtering out actual traffic. This of course would create all kinds of legal issues.
  - Karunamon 14y ago
    In theory yes, but everything hinges on the "given critical mass" thing - once a large amount of the sites the government would look askance at you for visiting are on the chaffbox's list and thefore being browsed by a large amount of people, it serves to protect someone who wants to view one of these sites legitimately. A dynamic list would be better,granted, but a much harder nut to crack.
- cbhl 14y ago
  You'd want it to be decentralized. Centralized servers are so 2000.
  - g8oz 14y ago
    Tell that to everyone storing their emails and music in the cloud.
- andrewflnr 14y ago
  I'll admit I don't know all that much about machine learning and statistics, but it seems like it would be pretty hard to simulate human activity in a way that was really indistinguishable (highly sporadic, with trends of connected ideas, for a start). More immediately, most people are never going to get on board with making it look like they're into "bad stuff". It's icky, and they don't think they have that much to lose.
blhack 14y ago
A friend of mine built a thing like this. http://www.haystackproject.org/ http://www.haystackproject.org/
- mylittlepony 14y ago
  That's awesome, thanks for sharing. I'll send it to my friends.
Jach 14y ago
> PGP....which is theoretically breakable thanks to the advent of quantum computing. This is a minor quibble with your overall point, but what I've quoted is wrong. The underlying encryption algorithms for modern PGP implementations are breakable with Shor's algorithm on a quantum computer, but not all encryption algorithms are vulnerable and a PGP implementation in the future could use such an algorithm as default instead. (For instance, http://en.wikipedia.org/wiki/McEliece_cryptosystem http://en.wikipedia.org/wiki/McEliece_cryptosystem)
siculars 14y ago
This. Increase the noise. Like a raspberry pi noise maker.
peteretep 14y ago
I suspect that an organization with the computational resources and mathematical clout of the NSA are going to have little trouble distinguishing between people clicking around on "J0llY R0g3rs Gu1d3 to NUKELERA WEPONS" and people creating specific, repeated trails to suspicious resources.
- jlgreco 14y ago
  The idea, if nothing else, is that such an analysis is possible it is also expensive enough to make it hard to do for everyone at once. If everyone superficially appears to be searching for verboten stuff, then their job becomes harder than just "carefully investigate whoever is hitting naughty keywords".
cpeterso 14y ago
Emacs' M-x spook command will paste some suitable words into the current buffer: Croatian nuclear FBI colonel plutonium Ortega Waco, Texas Panama CIA DES jihad fissionable quiche terrorist World Trade Center assassination DES NORAD Delta Force Waco, Texas SDI explosion Serbian Panama Uzi Ft. Meade SEAL Team 6 Honduras PLO NSA terrorist Ft. Meade strategic supercomputer $400 million in gold bullion quiche Honduras BATF colonel Treasury domestic disruption SEAL Team 6 class struggle smuggle [Hello to all my fans in domestic surveillance] http://www.cypherspace.org/rsa/spook.html http://www.cypherspace.org/rsa/spook.html
jandrewrogers 14y ago
As much as I hate to disappoint everyone, chaffing with lots of keywords, made up searches, and arbitrary blocks of suggestive text will not trigger any kind of flag except "people trying (poorly) to chaff NSA". The algorithms used for text mining are much more contextual and semantic than what would be fooled by the simple gags I commonly see on the Internet. Those gags might send a message of sorts but they don't make anyone's job more difficult. For a start, they know you are not a terrorist or whatever; nothing about your life as modeled across myriad data sources suggests that. Instead, you will be some random person pretending to stick it to The Man, which they don't care about and never lands in front of a person. To chaff the state-of-the-art data mining would require some sophisticated computer science and sophisticated operations. You would (1) have to understand the state-of-the-art algorithms used and (2) devise a way to break those algorithms transparently. It is not a trivial task by any means even for someone that understands what is involved. Superficial attempts to chaff surveillance systems might feel good but they won't accomplish much against a sophisticated adversary. The tech these days is much too good. Even leaving a minimal footprint for analysis is becoming nigh impossible.
- unfamiliar 14y ago
  What if I create a new hotmail account which I use exclusively for emailing a random address in Pakistan, and after a few months delete all of my Facebook/gmail accounts and go completely off the grid save for this one email account which I start accessing from internet cafes dotted around the country, where I also look up information on Arabic websites about fertiliser... would that get their attention?
  - notdrunkatall 14y ago
    Yes.
  - hooo 14y ago
    You've already got their attention.
    - rapind 14y ago
aw3c2 14y ago
http://cs.nyu.edu/trackmenot/ http://cs.nyu.edu/trackmenot/
Graham24 14y ago
bon jovi?

by melito 14y ago

Karunamon 14y ago

Business idea: A "chaff box" that can be sold to the public. Given a list of dodgy search keywords, youtube links, etc etc etc, regularly updated from a central location (think like a websense blocklist but in reverse), uses a configurable amount of bandwidth. Hits these sites with a human-like usage pattern when HTTP traffic from your LAN IP is detected (so it only works when you're actually browsing the web). Plug it in and gain plausible deniability from most forms of government shenaniganery. Given critical mass, makes most forms of government behavioral analysis (and possibly advertiser behavioral analysis) useless. Build it on the raspberry pi or similar platform. Materials cost is $35 plus shipping materials. Main time investment is limited to maintaining the blocklist and the central servers. Hmm. Wonder how this could sell to the soccer mom crowd... Would also raise some interesting and thorny questions for the server side. If enough people are using the box for the effect to be meaningful, then a lot of sites are going to have a lot of useless web traffic; yet allowing sites to "opt out" or having an identifier of some kind of the box's traffic completely defeats the purpose of the system.

melito 14y ago
I think there are already a couple products like that....in fact I have a few in my house. I call them my cable modem and tivo
dtromero 14y ago
In theory, couldn't an interested party filter out the blocklist from the all other traffic? It would be more interesting to have a dynamic list that gets updated based on actual user behavior. That way, the interested party wouldn't be able to filter out the blocklist without potentially filtering out actual traffic. This of course would create all kinds of legal issues.
- Karunamon 14y ago
  In theory yes, but everything hinges on the "given critical mass" thing - once a large amount of the sites the government would look askance at you for visiting are on the chaffbox's list and thefore being browsed by a large amount of people, it serves to protect someone who wants to view one of these sites legitimately. A dynamic list would be better,granted, but a much harder nut to crack.
cbhl 14y ago
You'd want it to be decentralized. Centralized servers are so 2000.
- g8oz 14y ago
  Tell that to everyone storing their emails and music in the cloud.
andrewflnr 14y ago
I'll admit I don't know all that much about machine learning and statistics, but it seems like it would be pretty hard to simulate human activity in a way that was really indistinguishable (highly sporadic, with trends of connected ideas, for a start). More immediately, most people are never going to get on board with making it look like they're into "bad stuff". It's icky, and they don't think they have that much to lose.

blhack 14y ago

A friend of mine built a thing like this. http://www.haystackproject.org/ http://www.haystackproject.org/

mylittlepony 14y ago
That's awesome, thanks for sharing. I'll send it to my friends.

Jach 14y ago

> PGP....which is theoretically breakable thanks to the advent of quantum computing. This is a minor quibble with your overall point, but what I've quoted is wrong. The underlying encryption algorithms for modern PGP implementations are breakable with Shor's algorithm on a quantum computer, but not all encryption algorithms are vulnerable and a PGP implementation in the future could use such an algorithm as default instead. (For instance, http://en.wikipedia.org/wiki/McEliece_cryptosystem http://en.wikipedia.org/wiki/McEliece_cryptosystem)

siculars 14y ago

This. Increase the noise. Like a raspberry pi noise maker.

peteretep 14y ago

I suspect that an organization with the computational resources and mathematical clout of the NSA are going to have little trouble distinguishing between people clicking around on "J0llY R0g3rs Gu1d3 to NUKELERA WEPONS" and people creating specific, repeated trails to suspicious resources.

jlgreco 14y ago
The idea, if nothing else, is that such an analysis is possible it is also expensive enough to make it hard to do for everyone at once. If everyone superficially appears to be searching for verboten stuff, then their job becomes harder than just "carefully investigate whoever is hitting naughty keywords".

cpeterso 14y ago

Emacs' M-x spook command will paste some suitable words into the current buffer: Croatian nuclear FBI colonel plutonium Ortega Waco, Texas Panama CIA DES jihad fissionable quiche terrorist World Trade Center assassination DES NORAD Delta Force Waco, Texas SDI explosion Serbian Panama Uzi Ft. Meade SEAL Team 6 Honduras PLO NSA terrorist Ft. Meade strategic supercomputer $400 million in gold bullion quiche Honduras BATF colonel Treasury domestic disruption SEAL Team 6 class struggle smuggle [Hello to all my fans in domestic surveillance] http://www.cypherspace.org/rsa/spook.html http://www.cypherspace.org/rsa/spook.html

jandrewrogers 14y ago

As much as I hate to disappoint everyone, chaffing with lots of keywords, made up searches, and arbitrary blocks of suggestive text will not trigger any kind of flag except "people trying (poorly) to chaff NSA". The algorithms used for text mining are much more contextual and semantic than what would be fooled by the simple gags I commonly see on the Internet. Those gags might send a message of sorts but they don't make anyone's job more difficult. For a start, they know you are not a terrorist or whatever; nothing about your life as modeled across myriad data sources suggests that. Instead, you will be some random person pretending to stick it to The Man, which they don't care about and never lands in front of a person. To chaff the state-of-the-art data mining would require some sophisticated computer science and sophisticated operations. You would (1) have to understand the state-of-the-art algorithms used and (2) devise a way to break those algorithms transparently. It is not a trivial task by any means even for someone that understands what is involved. Superficial attempts to chaff surveillance systems might feel good but they won't accomplish much against a sophisticated adversary. The tech these days is much too good. Even leaving a minimal footprint for analysis is becoming nigh impossible.

unfamiliar 14y ago
What if I create a new hotmail account which I use exclusively for emailing a random address in Pakistan, and after a few months delete all of my Facebook/gmail accounts and go completely off the grid save for this one email account which I start accessing from internet cafes dotted around the country, where I also look up information on Arabic websites about fertiliser... would that get their attention?
- notdrunkatall 14y ago
  Yes.
- hooo 14y ago
  You've already got their attention.
  - rapind 14y ago

aw3c2 14y ago

http://cs.nyu.edu/trackmenot/ http://cs.nyu.edu/trackmenot/

Graham24 14y ago

bon jovi?