4 ms·

> if you use an alternative to the major services...doesn't that make it easier to find you? You've effectively joined a much smaller haystack. No. Because th

by tankbot 13y ago

> if you use an alternative to the major services...doesn't that make it easier to find you? You've effectively joined a much smaller haystack. No. Because the 'haystack' you are (accidentally) referring to is a ginormous indexed/searchable database. All of their data goes to the same place, so it doesn't matter where it comes from. Your argument through analogy is not applicable but let me clarify for you: They are not watching you. They are watching the Ramada and everyone who enters, exits, and everything they do while there. All of this information goes into organized storage until they need to dig it up. They can't watch the bed and breakfast because the windows are blacked out (encryption). So you are safer there. Security through obscurity is an awful policy to start with and only fails harder when applied to a situation like this.

danso 13y ago
Security through obscurity is never a great mindset, but neither is the mindset that security doesn't come without significant tradeoffs, tradeoffs that may reveal you inadvertently. And you misunderstand the analogy. They don't need to watch you having an affair (through the windows). They only need to see that you're driving to an out-of-the-way B&B. They don't even have to interrogate you directly, just any one else who comes out of that small venue. Ergo, the "haystack" is smaller. To use another analogy: what do you think former CIA director David Petraeus was done in by? The fact that he used GMail and that activity on his account triggered an FBI omnisearch? Or that his mistress engaged in illegal activity and did not take the steps to separate her real-life identity from the anonymous GMail account?
- tankbot 13y ago
  I guess the point I'm making is there is no obscurity to be gained by throwing your actions in with a pool of others' because it is all itemized and catalogued. So what's better? A detailed account of everything you did, or the knowledge that you went to a place, but nobody knows for sure what happened there. EDIT: To answer your question about Petraeus - "The fact that he used Gmail" is enough. You can stop there.
  - danso 13y ago
    > EDIT: To answer your question about Petraeus - "The fact that he used Gmail" is enough. You can stop there. Well, this is where you and I will have to disagree. Assuming there wasn't a more ordered conspiracy (i.e. Petraeus was outed because of world-level politics), then Petraeus's exposure had nothing to do with the email service he used. His mistress drew attention to herself by sending anonymous threats that made reference to him and did not do enough to separate herself (such as using a different IP) from those messages. The point is, surveillance is not solely something in the digital domain, and so making a service change is not automatically a beneficial tradeoff. People used these popular services for a reason: mostly because of their ease and power. When they switch to a less powerful version, that may introduce behavior changes that cause slip ups. And I thought this could go without saying, but we all know that social engineering is by far the biggest cause for security breaches. And if the teenage script-kiddies can exploit that with ease, what makes you think the NSA can't? The relevant part to this discussion is that, again, less-used services have less-built in precautions against such identity attacks.
    - tankbot 13y ago
      You are arguing about what shows up on the NSA's radar that causes them to go searching, I'm talking about limiting what they can easily find. You're right about Broadwell's actions triggering the investigation, I'm saying his email wouldn't have been part of that investigation if he hadn't used Gmail and instead opted to secure the messages. And let's be honest: The director of the CIA should know better! It doesn't matter what causes the NSA to go looking, what matters is what they find. Edward Snowden makes this point himself in the original interview. They have collected data on you for years, just sitting there waiting to be scrutinized for whatever reason. Your second and third paragraphs are irrelevant to the point of condescension. We're talking about warrantless digital surveillance of US citizens not possible maybes and what-ifs.
      - danso 13y ago
        > It doesn't matter what causes the NSA to go looking, what matters is what they find. Sorry, but I disagree with that. It is very much about what causes them to go looking, because NSA analyst time is finite. If you remember from Snowden's interview, he said this: http://www.newyorker.com/online/blogs/closeread/2013/06/edward-snowden-the-nsa-leaker-comes-forward.html http://www.newyorker.com/online/blogs/closeread/2013/06/edwa... > “I, sitting at my desk, certainly had the authorities to wiretap anyone, from you or your accountant, to a federal judge or even the President, if I had a personal e-mail,” Note the qualifier at the end. He's claiming that the NSA can read the emails of anyone once they know the address. The implications are that investigation and surveillance are done when a target is specified. If President Obama doesn't use barack.obama@gmail.com from a known IP address, then his emails are essentially hidden from the NSA. If you are in a situation where the NSA knows of the identities you are using, no matter what service, and they choose to target you, then you are screwed no matter what.

by tankbot 13y ago

danso 13y ago

Security through obscurity is never a great mindset, but neither is the mindset that security doesn't come without significant tradeoffs, tradeoffs that may reveal you inadvertently. And you misunderstand the analogy. They don't need to watch you having an affair (through the windows). They only need to see that you're driving to an out-of-the-way B&B. They don't even have to interrogate you directly, just any one else who comes out of that small venue. Ergo, the "haystack" is smaller. To use another analogy: what do you think former CIA director David Petraeus was done in by? The fact that he used GMail and that activity on his account triggered an FBI omnisearch? Or that his mistress engaged in illegal activity and did not take the steps to separate her real-life identity from the anonymous GMail account?

tankbot 13y ago
I guess the point I'm making is there is no obscurity to be gained by throwing your actions in with a pool of others' because it is all itemized and catalogued. So what's better? A detailed account of everything you did, or the knowledge that you went to a place, but nobody knows for sure what happened there. EDIT: To answer your question about Petraeus - "The fact that he used Gmail" is enough. You can stop there.
- danso 13y ago
  > EDIT: To answer your question about Petraeus - "The fact that he used Gmail" is enough. You can stop there. Well, this is where you and I will have to disagree. Assuming there wasn't a more ordered conspiracy (i.e. Petraeus was outed because of world-level politics), then Petraeus's exposure had nothing to do with the email service he used. His mistress drew attention to herself by sending anonymous threats that made reference to him and did not do enough to separate herself (such as using a different IP) from those messages. The point is, surveillance is not solely something in the digital domain, and so making a service change is not automatically a beneficial tradeoff. People used these popular services for a reason: mostly because of their ease and power. When they switch to a less powerful version, that may introduce behavior changes that cause slip ups. And I thought this could go without saying, but we all know that social engineering is by far the biggest cause for security breaches. And if the teenage script-kiddies can exploit that with ease, what makes you think the NSA can't? The relevant part to this discussion is that, again, less-used services have less-built in precautions against such identity attacks.
  - tankbot 13y ago
    You are arguing about what shows up on the NSA's radar that causes them to go searching, I'm talking about limiting what they can easily find. You're right about Broadwell's actions triggering the investigation, I'm saying his email wouldn't have been part of that investigation if he hadn't used Gmail and instead opted to secure the messages. And let's be honest: The director of the CIA should know better! It doesn't matter what causes the NSA to go looking, what matters is what they find. Edward Snowden makes this point himself in the original interview. They have collected data on you for years, just sitting there waiting to be scrutinized for whatever reason. Your second and third paragraphs are irrelevant to the point of condescension. We're talking about warrantless digital surveillance of US citizens not possible maybes and what-ifs.
    - danso 13y ago
      > It doesn't matter what causes the NSA to go looking, what matters is what they find. Sorry, but I disagree with that. It is very much about what causes them to go looking, because NSA analyst time is finite. If you remember from Snowden's interview, he said this: http://www.newyorker.com/online/blogs/closeread/2013/06/edward-snowden-the-nsa-leaker-comes-forward.html http://www.newyorker.com/online/blogs/closeread/2013/06/edwa... > “I, sitting at my desk, certainly had the authorities to wiretap anyone, from you or your accountant, to a federal judge or even the President, if I had a personal e-mail,” Note the qualifier at the end. He's claiming that the NSA can read the emails of anyone once they know the address. The implications are that investigation and surveillance are done when a target is specified. If President Obama doesn't use barack.obama@gmail.com from a known IP address, then his emails are essentially hidden from the NSA. If you are in a situation where the NSA knows of the identities you are using, no matter what service, and they choose to target you, then you are screwed no matter what.