15 ms·
On Confirmed Assumptions or, Not Trusting Google is a Good Idea
- __hudson__ 13y agoI wonder if donating to wikileaks or even sending an email to wikileaks offering to volunteer would be enough to interest someone in government in getting all your 1's & 0's.
- smokeyj 13y agoYes, along with picking your nose and tying your shoes -- but that should only matter to a coward.
- __hudson__ 13y agoI wasn't trying to sound paranoid or cowardly. I was just curious what opinions people had on the level of involvement with Wikileaks that would be enough to get the governments attention.
- coolhandluke 13y agoI don't think it would take very much "involvement" at all. Let's say you sent such an e-mail. It was noticed by the NSA and triggered... whatever and now they've decided that they want to monitor you. How much difficulty is involved? From what I've read recently, it seems that it's fairly trivial to start monitoring an individual and continue to do so for a period of time. I would imagine that the easier it is, the higher the chances are of it happening. If it's a matter of hitting a few keystrokes to begin the monitoring, there's little cost involved so why not? They could monitor you for a while, analyze the data, and then decide if they need to keep monitoring you. If it's extremely difficult, costly, or time-consuming to begin the process, well, I'd imagine they would be less likely to do so (by how much I won't begin to guess). Basically, if they can start monitoring you and gathering data on you with little effort or cost required, it's probably a given that they would keep an eye on you. If there's a bunch of paperwork, warrants, etc., involved, the chances would be lower, I think.
- marshray 13y ago> email to wikileaks offering to volunteer It's hard to imagine anything more interesting to the NSA, but for not just the obvious reason. Wikileaks set itself up as a nexus of exchange for state secrets of a great many states. Any state with an intelligence operation would want to penetrate that organization to have access to raw data and advance notice of anything interesting about to go down. I've often wondered if such organizations (not naming names) ever wondered why they get approximately one volunteer from each European nation.
- signed0 13y agoIf Google has records of all emails that have been sent and deleted, presumably even if you don't have a Gmail account the government could ask Google for all emails that had ever been sent to your account. Just as the Syrian government is unlikely to be able to get Google to give them information on particular dissidents, it would be wise for American activists to choose a email provider that is not located in the United States.
- coolhandluke 13y agoIndeed. Once I manage to anonymously acquire some Bitcoins, I will be looking for a reputable VPS host based in Europe (that I can pay with Bitcoins) where I can run my own mail system.
- sneak 13y agoWhy, so that all the emails you send and receive can go right back to american PRISM partners? There's little point to that when everyone you email uses gmail.
- dmix 13y agoThe only option is for the creation of a user-friendly and encrypted alternative that people can transition to. Right now that doesn't exist.
- dmix 13y agoI recommend https://countermail.com/ https://countermail.com/
- deleted 13y ago[deleted]
- tantalor 13y agoPresumably the same justification/reasoning could be used to serve a home/business search warrant.
- daviddoran 13y agoWould a judge approve the warrant though? Just because this person communicated with Assange?
- betterunix 13y agoGee, it sure would be nice to know what happens at a FISC hearing...
- rayiner 13y agoCan the FISC grant Article III warrants?
- betterunix 13y agoCan information gathered under a FISA warrant be used to get another court to grant an Article III warrant, and can such information be critical to getting an Article III warrant? If a rubber stamp like FISC enables the government to get Article III warrants that it would not otherwise get, then FISC might as well just hand out Article III warrants.
- rayiner 13y agoIt's not a rhetorical question, I don't know the answer to it one way or the other. As to your second sentence, I think it's very reductionist. I see a FISC warrant as functioning like a subpoena. Say the SEC subpoena's your company's financial records from your accountant, and finds in there evidence that is sufficient to get a proper warrant to get documents from your company's premises. Does that mean there is no protection or purpose to the SEC not just being able to give itself Article III warrants?
- 13y ago
- Semiapies 13y ago"Not trusting" in this case is more of an operational than moral/ethical judgement, and more general than Google - you can't rely on privacy from any company if the government can send them a letter saying, "Gimme everything on this guy, bitches." And, well, if you don't want to run to Hong Kong, you're pretty much the government's bitch in that circumstance...
- rasterizer 13y agoAbit harsh on Google. I mean what are they to do?
- betterunix 13y agoMaybe engineer a service that is harder to wiretap? It is not easy, but they have some of the best computer scientists on this planet working for them. If I were them, I would start somewhere around here: http://crypto.stanford.edu/adnostic/adnostic.pdf http://crypto.stanford.edu/adnostic/adnostic.pdf
- walls 13y agoWire tapping is completely irrelevant to the question.
- betterunix 13y agoWiretapping in this context refers to both getting information on the wire and getting information stored on Google's servers. At this point the distinction between the two is completely pedantic.
- tptacek 13y agoIt's not directly apropos this particular thread, but Google has engineered an email service that is particularly difficult to wiretap. To wit: (a) They're the Internet's foremost adopter and proponent of DHE ciphersuites, which drastically reduce the impact of losing the RSA key that underpins most site's TLS security, and, just as importantly, forces adversaries to actively MITM every connection in order to decrypt them. (b) They're a pioneer in key pinning, which bakes the identity of their key into the Chrome browser binary, meaning that when your Chrome browser talks to Google's mail service, it's unlikely to trust any otherwise- valid- looking certificate presented by a MITM attacker. Google's mail service is better encrypted than most banks.
- grinich 13y agoIn these particular instances, though, information is much more valuable than money.
- mtgx 13y agoThey keep the deleted e-mails too? So even if you want to escape that 180 days law that says after 180 days it's free for all for authorities to get your e-mails, then deleting them before that time passes won't do you much good. So basically the authorities will have access to your e-mails anyway. It's just that they won't get them in the first 180 days. And of course this just applies to police/FBI, as NSA can get them from the day you sent them.
- signed0 13y agoNot necessarily. Just because the government asks for them doesn't mean they exist. I'd be surprised if they were actually deleted though.
- gohrt 13y agoGoogle doesn't 100% say that the data is totally totally gone, but seems to say that it is no longer indexed for lookup by your accounr, after 60days after deletion: https://support.google.com/mail/answer/7401?hl=en https://support.google.com/mail/answer/7401?hl=en
- saalweachter 13y agoI don't have any personal knowledge of this but if I were to recklessly speculate, I would wager "deleting stuff is hard". The typical concern is data loss, so to delete something completely you need to unwind your entire data loss prevention stack. Delete a file, delete a row from a database, wipe a cache from another server, scrub any ZFS-style filesystem versioning of data, mirror the changes to any off-site on-line backups and scrub everything there, retrieve any off-site off-line backups and wipe those... It's a non-trivial engineering task. If you want an email service which can readily delete your email, you need to find one with non-redundant, completely un-mirrored databases, fragile filesystems, and no backups. But that is not what most people are clamoring for in a service provider.
- embolism 13y ago
- digitalengineer 13y ago"Google is, however, allowed to tell me what account is involved, and I can do whatever I want with the information Google gave me" So Google was allowed, not required. Looks like they did the right thing by at least telling OP what they were forced to do. Shouldn't the title be "Not trusting your Government"?
- eliben 13y agoNo, because blaming Google is trendy lately and will bring more traffic to the site.
- kybernetyk 13y agoMaybe "not trusting Google with your data" would be a better fit.
- digitalengineer 13y agoHow about "not trusting 3rd party with your (unencrypted) data"?
- embolism 13y agoWhy are you trying to deflect attention away from Google?
- jamesaguilar 13y agoBecause the problem is not specific to Google. (Not to put words in the gp's mouth, but that seems like an obvious reason to broaden the focus to me.)
- embolism 13y agoTrue, but Google is by far the most dangerous aggregation of personal information, and the topic of this conversation. It's also a company that spends a lot of effort telling people to trust them when that is clearly unjustified.
- andrewljohnson 13y agoGoogle should invent a distributed, encrypted email protocol and make that network an option in GMail for storage and message sending. That would be a great PR move - if there is no central server, and no central message pipe, it's a little hard for anyone to think Google wants to be complicit in spying.
- embolism 13y agoThat would be the antithesis of what Google does - they give away services for free in exchange for access to personal information that they use to sell more precise targeting to advertisers. Google's business relies on them being able to examine your personal data. That's how Gmail is paid for. Perhaps someone who has a different business model e.g. Samsung, Microsoft, or Apple should do this.
- jmillikin 13y agoHow would you implement a secure web interface to distributed encrypted storage? The moment a user wants to view email in their browser, it needs to be decrypted by Google's server (or decrypted by Javscript served from Google's server, which is equivalent from a security perspective). For users who are willing to give up the web interface, there are many open-source email clients that provide strong encryption (e.g. Thunderbird + GPG).
- embolism 13y ago
- throwaway10001 13y agoGoogle shouldn't be trusted with everything you have. Between Analytics, Android, Google Search, Documents and E-mail they know what you are thinking and virtually everything you do, online and offline. Even if the current management are saints--I doubt it--the next team will push the envelope to monetize it even more. And then there is the NSA and FBI and the local divorce lawyer. If it's there they will get it. So try things like blocking analytics at host level, using either gmail or search etc etc. Makes it harder for NSA. Can you imagine yourself in a trial trying to explain why you visited certain sites or searched for certain keywords 3 years ago? Were you really researching what you saw on CSI or were you preparing the perfect murder of your wife?
- burntsushi 13y agoThis just seems like a variation of the argument that you should get out of the way of the bullet instead of demanding that the gunman not shoot you in the first place. I should be able to give whatever data I want to Google without worrying that the government is going to take it from Google in secret.
- embolism 13y agoThat is a laudable and idealistic goal, but we don't live in that world. Furthermore Google itself knows more than we do about how easily governments can access the data it accumulates. If it chose to, Google could protect users by developing services that do not rely on Google itself examining their personal data. Google understands the risks better than its users but chooses to expose them because doing so is aligned with its business model and philosophy whereas protecting them is not. It's a bit like recommending someone travel through a war zone on a bicycle when a tank is an available alternative, because the bike carries advertising you profit from and the tank does not.
- loup-vaillant 13y agoStill, you do want to remove that dangerous war zone itself. The problem is, to do that, a few group of people at best needs to stick their neck out for the benefit of everyone else. The way I see it, the problem is that mass cooperation just isn't going to happen. Incentives and benefits must be found at the individual level (altruism counts as a weak incentive), and drawbacks must be dealt with, starting with the gazillion trivial inconveniences that an otherwise privacy aware citizen would have to put up with. There's a reason why I don't encrypt my hard drive: my OS doesn't do it by default, and taking the time to set it up is just such a drag.
- gnosis 13y agoGoogle is spyware. This has been obvious for a long time. Most other "free" web services aren't much better. It's sad that it's taken so long for people to start realizing and caring about this, but better late than never.
- kostya-kow 13y ago>Most other "free" web services aren't much better. Most non-free web services are equally happy giving away your data to the government. Apple, MS and all the other companies are no better than Google. And Google is not the problem -- it is just a symptom. The problem is the government that does not respect the rights of people.
- gnosis 13y agoMy use of the term "free" was not intended to imply that "non-free" web services were any better. I used the term to highlight that what most people consider "free" web services actually have a price. That price is usually your privacy.
- spankalee 13y agoFree has nothing to do with it. Go ahead and pay for the same services, but it'll do nothing to protect your data from a search warrant.
- gnosis 13y agoActually, it does have something to do with it. When you don't pay for a service in money, the company providing that service has to find some other way of generating money. Often they do this by collecting and selling data about you. Now, that doesn't mean that just because you paid for a service they won't do the same thing. But they'll will have more incentive to protect their paying customers than some service which consider you and your data as the commodity.
- 13y ago
- tptacek 13y agoHow, in short, is this shit valid under the U.S. Bill of Rights? I’d really like someone to explain that to me. With a straight face. Preferably without making me want to punch them in the process. Well, he's going to want to punch me, but here's what I think(?) the answer is: (a) He's not a US person, but instead a well-known citizen of Iceland, living abroad, and is thus not protected by the Fourth Amendment, at least to the extent that anything in the Fourth Amendment conflicts with any interest of the US. (b) He's a person of interest in the investigation of one of the most significant leaks of national security information in US history.
- ef4 13y agoThe legal theory that the bill of rights only applies to US citizens is dangerous and wrong. It applies to actions of the United States government. It is a list of things they may not do.
- rgbrenner 13y agoNo, tptacek is right... if you are a foreigner living abroad, the bill of rights does not apply to you: In 1957, the court changed its position, overturning decades of precedent to declare that American citizens are in fact protected against U.S. government misbehavior by the Bill of Rights even outside the country. Unfortunately for the rest of the world, the court limited its ruling to U.S. citizens. Foreigners remained stuck with the old rule that the Bill of Rights doesn't apply abroad.[0] So US citizens are protected whether they are within US borders or abroad. And foreigners are protected if they are within US borders... but once they leave, it no longer applies. [0]. http://articles.latimes.com/2005/dec/16/opinion/oe-raustiala16 http://articles.latimes.com/2005/dec/16/opinion/oe-raustiala...
- tptacek 13y agoIt's also pretty hard to argue that prior to 1957, anyone in the USG needed to get a warrant to collect intelligence information from foreign soil.
- fady 13y agooff-topic: you need some line-height for that post.. very hard to read. https://www.dropbox.com/s/602d01t8ahqw1km/Screenshot%202013-06-21%20at%202.29.10%20PM.png https://www.dropbox.com/s/602d01t8ahqw1km/Screenshot%202013-...
- lettergram 13y agoWhy not just keep all your data on your own computer? No need to have a cloud and if it's email your worried about, well, it's assured if the U.S. government wants your conversations they will get it unless you jump through some pretty large hoops.
- tyrion 13y agoIsn't all "this shit" in violation of the International Bill of Human Rights? "No one shall be subjected to arbitrary interference with his privacy, family, home or correspondence, nor to attacks upon his honour and reputation. Everyone has the right to the protection of the law against such interference or attacks." -- International Bill of Human Rights, article 12. I also found interesting to read the "CCPR General Comment No. 16" [1] on the right to privacy. [1] http://www.unhchr.ch/tbs/doc.nsf/(Symbol)/23378a8724595410c12563ed004aeecd?Opendocument http://www.unhchr.ch/tbs/doc.nsf/(Symbol)/23378a8724595410c1...
- jkrems 13y agoI think the US government showed in the last ten years that they don't care much about those "basic human rights". I'm pretty sure torture, drone killings, locking innocent people away without due process, and silencing dissidents also kind of violates the IBoHR.
- pbhjpbhj 13y agoI'm not saying I approve but the key word is "arbitrary". The USG would presumably say this isn't arbitrary interference as it's in the course of a criminal investigation.
- thrownaway2424 13y agoHow, exactly, is it a violation of that? They have a warrant. It's due process.
- ethanazir 13y agothe gmail network effect pulls in people who would rather not be grokked.
- contingencies 13y agoRight. This is why we need encryption.
- mpyne 13y agoWe have encryption. We need to use it.
- sneak 13y agoMy using encryption doesn't suddenly make all of the hundred people I regularly communicate with on gmail suddenly have PGP keys or smartphones that support encrypted messages.
- mpyne 13y agoHence why I said, "we". Every encryption scheme you propose will actually need to be used by other people to make the system work overall.
- deleted 13y ago[deleted]
- zenbowman 13y ago"I believe that organisations don’t really have a right to secrecy and I believe that the more open a society, a society where people have more information is a society where we can take more informed decisions and where we perhaps won’t need the gatekeepers that are currently in place as much" -Herbert Snorrason If he doesn't believe organizations have a right to secrecy, then why does he believe that he is entitled to secrecy. Privacy and secrecy are the same thing, claiming to be pro-privacy but against secrecy is dishonest.
- PavlovsCat 13y agoPrivacy and secrecy are the same thing No, they aren't (e.g. that I want to be alone when going to the bathroom doesn't mean it's a secret what I am doing there). Even if they were, persons and organizations are not the same thing either.
- Andrew_Quentin 13y agoWhy don't you sue and find out?