14 ms·

My Privacy Plan

58 points by benrmatthews 13y ago

mtct 13y ago
This is a good start, but in the end the NSA can bypass any of these measure if needed (even the cryptography). The only think that really can change this situation is a protest versus your political representatives.
- jiggy2011 13y ago
  You think NSA has a way to break AES/RSA?
  - mtct 13y ago
    https://sslimgs.xkcd.com/comics/security.png https://sslimgs.xkcd.com/comics/security.png
    - dageshi 13y ago
      I don't think that scales very well...
      - UVB-76 13y ago
        Alas, the NSA can afford a million dollar cluster to crack your password...
        riquito 13y ago
        All the computers in the world wouldn't be able to brute force AES with a strong key in less than 10 quadrillion years [1]. They would be better off spending millions in four-leaf clovers and faceroll the password. That said if they knew a way to crack AES or RSA it would be a different story (a nightmare). [1] http://blog.agilebits.com/2013/03/09/guess-why-were-moving-to-256-bit-aes-keys/ http://blog.agilebits.com/2013/03/09/guess-why-were-moving-t...
        jiggy2011 13y ago
        A million dollar cluster won't make a dent in cracking an AES key of a proper size. Not unless the NSA have managed to solve some pretty baffling math problems and keep it secret.
        IanChiles 13y ago
        The NSA is currently the largest employer of mathematicians in the US. To think they haven't found anything of use would be naive at best. http://www.nsa.gov/research/tech_transfer/advanced_math/ http://www.nsa.gov/research/tech_transfer/advanced_math/
        riquito 13y ago
        AES is a specification of the U.S. National Institute of Standards and Technology (NIST). USA use it to encrypt the most sensitive informations. It's hard to think that they would use a broken cryptographyc algorithm themselves
        sweedy 13y ago
        the common xkcd-answer when it comes to cryptography.. http://xkcd.com/538/ http://xkcd.com/538/
      - noerps 13y ago
        It simply does not need to scale very well to scare the few people which understand crypto and plausible deniability.
frisco 13y ago
I feel like this is a rather porous plan for privacy. > 1. Sign up to relevant pressure groups Ok, I like this one. No reason not to. Support the EFF. > 2. Install HTTPS Everywhere Since I believe that the NSA likely already have all of the relevant private keys, I'm not sure about this one. HTTPS is still better than no HTTPS, but don't overestimate it. > 3. Install Adblock Plus Yep ok. Making it harder to be tracked across the internet is good. > 4. Review my browser use Sure. Use Chrome + best practices. > 5. Review web services I use and switch if necessary Suddenly this appears: a catch-all "change everything I do on the internet". Stop using Facebook, Skype, Gmail, etc. Probably not going to happen. I'll come back to this in a second. > 6. Download and Use Tor Given my belief that the government is probably running enough nodes to reconstruct Tor identities, I'm not convinced that this helps much. > 7. Use the Onion Browser on my mobile See #6. > 8. Run "host-proof" Web applications This is an extension of #5. I like the idea, but this is hard. Startups like Ciphercloud and Social Fortress are ostensibly working on it; I look forward to when they're available. I imagine that if any significant percentage of people start using, say, Social Fortress on Facebook, Facebook will make it against the TOS. I do think that the NSA has probably broken RSA. It's notable that they haven't approved it for securing classified data, despite the fact that it would significantly simplify the DOD's current pains around key distribution. This, of course, takes SSL with it, but importantly takes PGP, too. Running GPGMail on a desktop isn't enough. ### My privacy plan will involve learning more about politics. Who are our representatives? What districts play disproportionate roles here? How are the oversight committees formed? Who's on them and why? What can we do to be involved? This is a much longer timescale play -- it's a lifetime of being involved, rather than a quick technological fix now. I'm not confusing a personal interest here with having influence -- I'm just one person, and not a high-profile one, and alone I won't have much impact. But, I don't believe that there's any substitute for a politically engaged constituency. I don't believe that Washington is fundamentally corrupt or irreversibly damaged. In the Snowden video he spoke about how these decisions are viewed as policy and not law -- so a future president may decide to go off the deep end into despotism. But since it's still policy, there are systems for this. It's not ok to simply complain that the system will defend itself and there's nothing you can do. Apply the same mindset that drives you through the multiple brick walls that are a startup to changing Washington.
- 13y ago
u2328 13y ago
Well, I don't think I've ever felt so paranoid. Thanks President Obama, this is the exact opposite thing we wanted you to do when we voted for you.
- pvdm 13y ago
  I think people are beginning to realize that the demorepublican party is two sides of the same coin. Tails you lose, heads they win.
  - u2328 13y ago
    Ha, no. Save possibly Rand Paul, I still think the Republicans are way worse.
    - pvdm 13y ago
      There are good guys and bad guys in every movie. They are all actors in a movie that gives the illusion that they are actually governing in people's interest. Read Chomsky's Manufactured Consent and see beyond the illusion.
      - u2328 13y ago
        I've read Chomsky. I get the argument, but I reject it. It fails to address that I actually agree with a lot of things the Obama Administration has made progress on, especially regarding domestic policy. Health care, gay rights are some big ones. I think a Republican administration would have would have been way worse on those issues, and not much different on civil liberties or privacy.
        cmsmith 13y ago
        Obama 'started' supporting gay marriage in 2011. Given the current trajectory of public opinion, I would be surprised if the GOP candidate for president in 2020 or 2024 doesn't support gay marriage. I have a difficult time getting excited that one party changes their mind when 51% of voters support something, while the other party waits until 60% support it. You can repeat that story with the drug war (fighting over the 18:1 or 200:1 disparity in crack:powder cocaine sentences without actually reexamining what the hell we're doing) or fiscal policy (should we cut taxes for 99% of people or 100% of people, and should we cut government spending by $1T or $1.1T) or even health care (where no one has the stomach to even mention the words 'single payer').
noerps 13y ago
Learn and understand crypto, develop and follow procedure to embrace secure end-to-end communications with your peers.
jd007 13y ago
If everyone uses Adblock, it could be detrimental to a lot of free web services that are supported solely on ad revenue. I am not sure if there is a good solution here...
lake99 13y ago
There's one more thing all Tor users with good bandwidth should consider: start relaying. I relay when I can, which is not very often because I am mostly behind a NAT which I have no control over.
RexRollman 13y ago
In today's environment, the most secure person computing set-up might be Richard Stallman's. I don't think I could do it though, as it is too restrictive. http://stallman.org/stallman-computing.html http://stallman.org/stallman-computing.html
Hyrum_Graff 13y ago
Here's what I did. http://www.battle-school.co.uk/Blog/2013/06/08/its-our-own-fault-deal-with-it/ http://www.battle-school.co.uk/Blog/2013/06/08/its-our-own-f... Got rid of every cloud based service I use.
- jafaku 13y ago
  I use Dropbox with encfs. But now I'm wondering if the client could have a backdoor, since it's a binary.
yekko 13y ago
Move out of the US.
- sneak 13y ago
  I did that five years ago after coming to the conclusion that the US didn't care about any of these abuses and that decades of surveillance state would go by without any improvement. I implored everyone that would listen to leave; I thought that was the end of it. After Snowden proved me absolutely and indelibly wrong, I decided this week to come back. These people operate in secret because they can't justify their actions in a free and open debate. The secrecy has now been lifted. There's a war coming. It's time to fight.
dkokelley 13y ago
There is a fundamental problem with being truly secure online. That flaw is that the sites and services we use are compromised. In order to me to write this comment, I'm relying on the free wifi at Starbucks to not log my actions. I'm relying on their ISP to not log the traffic to HN's servers. I'm relying on Google's Chrome browser to correctly recognize HN's certificate and encrypt my packets properly, and I'm relying on Entrust Certification Authority to correctly assert that I am actually sending my data to HN and not an intermediary. Then I'm relying on HN to receive my data and store it securely (well, as secure as I should expect a public forum to be, but the scenario applies just as well to banks and email providers). Finally, I'm relying on all software installed on my laptop (including the operating system) to respect my privacy by not logging keystrokes. Any 3-letter agency that wanted to track my internet usage only needs to collude with one of these services to compromise my privacy. I think the solution to privacy is a combination between government transparency and accountability, and our own due diligence to carefully vet the programs and services we use.
- eurleif 13y ago
  >In order to me to write this comment, I'm relying on the free wifi at Starbucks to not log my actions. No, you aren't. Hacker News is HTTPS-exclusive.
  - dkokelley 13y ago
    They still know where to send my packets, and it's possible that they are proxying the SSL (although that requires a secondary breach in Chrome's CA list and/or Entrust).

58 points by benrmatthews 13y ago

mtct 13y ago

This is a good start, but in the end the NSA can bypass any of these measure if needed (even the cryptography). The only think that really can change this situation is a protest versus your political representatives.

jiggy2011 13y ago
You think NSA has a way to break AES/RSA?
- mtct 13y ago
  https://sslimgs.xkcd.com/comics/security.png https://sslimgs.xkcd.com/comics/security.png
  - dageshi 13y ago
    I don't think that scales very well...
    - UVB-76 13y ago
      Alas, the NSA can afford a million dollar cluster to crack your password...
      - riquito 13y ago
        All the computers in the world wouldn't be able to brute force AES with a strong key in less than 10 quadrillion years [1]. They would be better off spending millions in four-leaf clovers and faceroll the password. That said if they knew a way to crack AES or RSA it would be a different story (a nightmare). [1] http://blog.agilebits.com/2013/03/09/guess-why-were-moving-to-256-bit-aes-keys/ http://blog.agilebits.com/2013/03/09/guess-why-were-moving-t...
      - jiggy2011 13y ago
        A million dollar cluster won't make a dent in cracking an AES key of a proper size. Not unless the NSA have managed to solve some pretty baffling math problems and keep it secret.
        IanChiles 13y ago
        The NSA is currently the largest employer of mathematicians in the US. To think they haven't found anything of use would be naive at best. http://www.nsa.gov/research/tech_transfer/advanced_math/ http://www.nsa.gov/research/tech_transfer/advanced_math/
        riquito 13y ago
        AES is a specification of the U.S. National Institute of Standards and Technology (NIST). USA use it to encrypt the most sensitive informations. It's hard to think that they would use a broken cryptographyc algorithm themselves
      - sweedy 13y ago
        the common xkcd-answer when it comes to cryptography.. http://xkcd.com/538/ http://xkcd.com/538/
    - noerps 13y ago
      It simply does not need to scale very well to scare the few people which understand crypto and plausible deniability.

frisco 13y ago

I feel like this is a rather porous plan for privacy. > 1. Sign up to relevant pressure groups Ok, I like this one. No reason not to. Support the EFF. > 2. Install HTTPS Everywhere Since I believe that the NSA likely already have all of the relevant private keys, I'm not sure about this one. HTTPS is still better than no HTTPS, but don't overestimate it. > 3. Install Adblock Plus Yep ok. Making it harder to be tracked across the internet is good. > 4. Review my browser use Sure. Use Chrome + best practices. > 5. Review web services I use and switch if necessary Suddenly this appears: a catch-all "change everything I do on the internet". Stop using Facebook, Skype, Gmail, etc. Probably not going to happen. I'll come back to this in a second. > 6. Download and Use Tor Given my belief that the government is probably running enough nodes to reconstruct Tor identities, I'm not convinced that this helps much. > 7. Use the Onion Browser on my mobile See #6. > 8. Run "host-proof" Web applications This is an extension of #5. I like the idea, but this is hard. Startups like Ciphercloud and Social Fortress are ostensibly working on it; I look forward to when they're available. I imagine that if any significant percentage of people start using, say, Social Fortress on Facebook, Facebook will make it against the TOS. I do think that the NSA has probably broken RSA. It's notable that they haven't approved it for securing classified data, despite the fact that it would significantly simplify the DOD's current pains around key distribution. This, of course, takes SSL with it, but importantly takes PGP, too. Running GPGMail on a desktop isn't enough. ### My privacy plan will involve learning more about politics. Who are our representatives? What districts play disproportionate roles here? How are the oversight committees formed? Who's on them and why? What can we do to be involved? This is a much longer timescale play -- it's a lifetime of being involved, rather than a quick technological fix now. I'm not confusing a personal interest here with having influence -- I'm just one person, and not a high-profile one, and alone I won't have much impact. But, I don't believe that there's any substitute for a politically engaged constituency. I don't believe that Washington is fundamentally corrupt or irreversibly damaged. In the Snowden video he spoke about how these decisions are viewed as policy and not law -- so a future president may decide to go off the deep end into despotism. But since it's still policy, there are systems for this. It's not ok to simply complain that the system will defend itself and there's nothing you can do. Apply the same mindset that drives you through the multiple brick walls that are a startup to changing Washington.

13y ago

u2328 13y ago

Well, I don't think I've ever felt so paranoid. Thanks President Obama, this is the exact opposite thing we wanted you to do when we voted for you.

pvdm 13y ago
I think people are beginning to realize that the demorepublican party is two sides of the same coin. Tails you lose, heads they win.
- u2328 13y ago
  Ha, no. Save possibly Rand Paul, I still think the Republicans are way worse.
  - pvdm 13y ago
    There are good guys and bad guys in every movie. They are all actors in a movie that gives the illusion that they are actually governing in people's interest. Read Chomsky's Manufactured Consent and see beyond the illusion.
    - u2328 13y ago
      I've read Chomsky. I get the argument, but I reject it. It fails to address that I actually agree with a lot of things the Obama Administration has made progress on, especially regarding domestic policy. Health care, gay rights are some big ones. I think a Republican administration would have would have been way worse on those issues, and not much different on civil liberties or privacy.
      - cmsmith 13y ago
        Obama 'started' supporting gay marriage in 2011. Given the current trajectory of public opinion, I would be surprised if the GOP candidate for president in 2020 or 2024 doesn't support gay marriage. I have a difficult time getting excited that one party changes their mind when 51% of voters support something, while the other party waits until 60% support it. You can repeat that story with the drug war (fighting over the 18:1 or 200:1 disparity in crack:powder cocaine sentences without actually reexamining what the hell we're doing) or fiscal policy (should we cut taxes for 99% of people or 100% of people, and should we cut government spending by $1T or $1.1T) or even health care (where no one has the stomach to even mention the words 'single payer').

noerps 13y ago

Learn and understand crypto, develop and follow procedure to embrace secure end-to-end communications with your peers.

jd007 13y ago

If everyone uses Adblock, it could be detrimental to a lot of free web services that are supported solely on ad revenue. I am not sure if there is a good solution here...

lake99 13y ago

There's one more thing all Tor users with good bandwidth should consider: start relaying. I relay when I can, which is not very often because I am mostly behind a NAT which I have no control over.

RexRollman 13y ago

In today's environment, the most secure person computing set-up might be Richard Stallman's. I don't think I could do it though, as it is too restrictive. http://stallman.org/stallman-computing.html http://stallman.org/stallman-computing.html

Hyrum_Graff 13y ago

Here's what I did. http://www.battle-school.co.uk/Blog/2013/06/08/its-our-own-fault-deal-with-it/ http://www.battle-school.co.uk/Blog/2013/06/08/its-our-own-f... Got rid of every cloud based service I use.

jafaku 13y ago
I use Dropbox with encfs. But now I'm wondering if the client could have a backdoor, since it's a binary.

yekko 13y ago

Move out of the US.

sneak 13y ago
I did that five years ago after coming to the conclusion that the US didn't care about any of these abuses and that decades of surveillance state would go by without any improvement. I implored everyone that would listen to leave; I thought that was the end of it. After Snowden proved me absolutely and indelibly wrong, I decided this week to come back. These people operate in secret because they can't justify their actions in a free and open debate. The secrecy has now been lifted. There's a war coming. It's time to fight.

dkokelley 13y ago

There is a fundamental problem with being truly secure online. That flaw is that the sites and services we use are compromised. In order to me to write this comment, I'm relying on the free wifi at Starbucks to not log my actions. I'm relying on their ISP to not log the traffic to HN's servers. I'm relying on Google's Chrome browser to correctly recognize HN's certificate and encrypt my packets properly, and I'm relying on Entrust Certification Authority to correctly assert that I am actually sending my data to HN and not an intermediary. Then I'm relying on HN to receive my data and store it securely (well, as secure as I should expect a public forum to be, but the scenario applies just as well to banks and email providers). Finally, I'm relying on all software installed on my laptop (including the operating system) to respect my privacy by not logging keystrokes. Any 3-letter agency that wanted to track my internet usage only needs to collude with one of these services to compromise my privacy. I think the solution to privacy is a combination between government transparency and accountability, and our own due diligence to carefully vet the programs and services we use.

eurleif 13y ago
>In order to me to write this comment, I'm relying on the free wifi at Starbucks to not log my actions. No, you aren't. Hacker News is HTTPS-exclusive.
- dkokelley 13y ago
  They still know where to send my packets, and it's possible that they are proxying the SSL (although that requires a secondary breach in Chrome's CA list and/or Entrust).