5 ms·

Assuming this level of unconstitutional surveillance continues, what can we do? Here are some of my ideas: Send encrypted emails, to communicate long distances

Assuming this level of unconstitutional surveillance continues, what can we do? Here are some of my ideas: Send encrypted emails, to communicate long distances. Use the internet way less. Use cell phones only to arrange real life meetups. Hang out & talk to people in real life. Never have a meaningful discussion "over the air".

jlgreco 13y ago
PGP/GPG adoption needs to go way up, but I am concerned by the rise of "non-owned" devices. I would put way less trust in running PGP/GPG from a client-side mail client on a smartphone with OTA updates, apparent carrier spyware, etc than I would in PGP/GPG running on OSX, for instance. Maybe one way to partially mitigate these concerns is to push for only storing/using private keys on these devices on a TPM.
alan_cx 13y ago
In general, I am using the internet and electronic communications less and lees. Often I am now asking myself if what I am going to do is necessary or does it have to be electronic. As well as altering my choice to use, I am adding more and more security options. Mainly silly small things like the add-on that chooses HTTPS, ad blockers, or using Iron in stead of chrome, and so on. So, where I have an easy or ultimately seamless choice, Im choosing to encrypt and block. Nothing major, I know I am not secure, but more of my traffic is encrypted. Lastly, while I have used Linux servers for years, Im now trying to make Linux work for me as a Windows replacement. Partly because of the awful Windows 8 which I will down grade to from Vista (!!!), but more so because of these security issues. So, nothing big, but a general move. But one key thing is that is people are anything like me, what we will see is more and more internet traffic become encrypted. Not sure what that with do to spy paranoia. Probably makes us default guilty. The other plan is to use NO defenses what so ever. Open one's self up, but never ever do anything other then the tedious benign on the internet. Show the world how open and nonthreatening you are. Keep all the evil stuff like joint smoking, porn watching, political opinion, medical questions, employment details, etc off the electronic spy.
lawnchair_larry 13y ago
In general, plaintext protocols of any form should be met with the same derision as something like telnet would today. Encrypt all the things. We need the very idea of sending something like plain ASCII beyond your computer to be offensive at its core. Considering passwords are often stored in plaintext and companies think this is no big deal, I'm not sure how well that will work. Without proper trust models in place, this won't solve all the problems, but I feel like that's what the culture of communication on the Internet has to look like. It has to be done by the engineers at the protocol level, and application developers have to adopt it. Servers and other peer-to-peer clients should refuse to speak plaintext. Focusing on things like getting people to use PGP, OTR, etc, is hopeless and will only work with other privacy geeks.
mark-r 13y ago
Since much of the information is used to find out who you hang out with, your strategy doesn't help as much as you think. Guilt by association, you know.
- bediger4000 13y ago
  "Much of the information"? Given that the metadata (a.k.a. "CDR" or Call Data Record) is getting hoovered up in all this, about the only thing such a mass of data can be used for is guilt by association. The telco's don't match up CDR with a captured audio stream, so that's done by the NSA (or whoever). They're not going to be able to do that matching, or the semantic analysis of what's said, very often. Therefore, the ONLY thing the metadata can do is determine guilt by association.
- deleted 13y ago
  [deleted]
at-fates-hands 13y ago
This actually made me think about what kinds of analog communication equipment could we use and encrypt transmissions with? I know Motorola makes some two way radios that have encryption, just not sure how good it is. It would be interesting if people started to revert back to less and less digital communication and went back to doing what you're talking about. It's almost like another counter revolution taking shape.
- varjag 13y ago
  A scrambler can be used in audio band, although I'm not sure how well it will mate with a GSM codec. Still it's an inferior solution to purely digital P2P VoIP systems (like e.g. Skype before the supernodes).
kamjam 13y ago
How about sending all that meaningless bullsht emails with an additional notice, like we have for confidentially along the lines of, and then suing the US government if your stuff ever turns up (yes, I know, it's difficult). This message and any attachments are intended only for the use of the intended recipient(s), are confidential, and may be privileged... If you are the NSA then please note I am a US citizen and under 4th Amendment rights you are not lawfully allowed to store records of this message (I am not a US citizen, so fix as required)
- mpyne 13y ago
  Wouldn't matter, I'm afraid. Even if the NSA put free text detection algorithms to look for such a disclaimer (since they claim messages themselves are not examined without a warrant), they'd ignore the disclaimer anyways as anyone could easily claim they were a US citizen.
forgotAgain 13y ago
Those are all passive responses. Not meaning to be critical but they are the best case response that the government could hope for. How about picketing outside the office of your Congressman/woman? We're invisible with passive responses. I think as a people we need to get over the sense of embarrassment we feel when we gather as group for a political cause.
claudius 13y ago
That depends on who does the surveillance. Stopping to use American services is a simple start, and it is much easier to act against surveillance in your own country than it is to act against surveillance by the US. Of course, this only helps if your ‘home area’, i.e. the area you trust to not intercept your messages and where you can act meaningfully to ban such interception, is sufficiently large – given the size of the EU (for example) even after Britain is out, that shouldn’t be too much a problem. For everything going outside this green zone, encrypted communication is the go-to-response, be that PGP, OTR or at the very least HTTPS.
noonespecial 13y ago
I'm going to have to go with "no". Or perhaps "yes and". We should not be forced to curtail our use of one of mankind's greatest triumphs because a few cold-war troglodytes think that they are somehow entitled to read all of our mail and arrest us for word-crimes. These people don't deserve the power given to them in trust. We should remove it from them. Nothing less than that will do.
gorbachev 13y ago
Encrypting your emails won't help at all, because what's being snooped is the header information. Who sent to whom, when and from where and where to. You can't hide that information. Don't send email and don't use the phone is the only alternative. Snail mail may be safe.
- a3n 13y ago
  I assume snail mail metadata (from, to, date, weight, form factor) can and is collected, with modern USPS equipment.

jlgreco 13y ago

PGP/GPG adoption needs to go way up, but I am concerned by the rise of "non-owned" devices. I would put way less trust in running PGP/GPG from a client-side mail client on a smartphone with OTA updates, apparent carrier spyware, etc than I would in PGP/GPG running on OSX, for instance. Maybe one way to partially mitigate these concerns is to push for only storing/using private keys on these devices on a TPM.

alan_cx 13y ago

In general, I am using the internet and electronic communications less and lees. Often I am now asking myself if what I am going to do is necessary or does it have to be electronic. As well as altering my choice to use, I am adding more and more security options. Mainly silly small things like the add-on that chooses HTTPS, ad blockers, or using Iron in stead of chrome, and so on. So, where I have an easy or ultimately seamless choice, Im choosing to encrypt and block. Nothing major, I know I am not secure, but more of my traffic is encrypted. Lastly, while I have used Linux servers for years, Im now trying to make Linux work for me as a Windows replacement. Partly because of the awful Windows 8 which I will down grade to from Vista (!!!), but more so because of these security issues. So, nothing big, but a general move. But one key thing is that is people are anything like me, what we will see is more and more internet traffic become encrypted. Not sure what that with do to spy paranoia. Probably makes us default guilty. The other plan is to use NO defenses what so ever. Open one's self up, but never ever do anything other then the tedious benign on the internet. Show the world how open and nonthreatening you are. Keep all the evil stuff like joint smoking, porn watching, political opinion, medical questions, employment details, etc off the electronic spy.

lawnchair_larry 13y ago

In general, plaintext protocols of any form should be met with the same derision as something like telnet would today. Encrypt all the things. We need the very idea of sending something like plain ASCII beyond your computer to be offensive at its core. Considering passwords are often stored in plaintext and companies think this is no big deal, I'm not sure how well that will work. Without proper trust models in place, this won't solve all the problems, but I feel like that's what the culture of communication on the Internet has to look like. It has to be done by the engineers at the protocol level, and application developers have to adopt it. Servers and other peer-to-peer clients should refuse to speak plaintext. Focusing on things like getting people to use PGP, OTR, etc, is hopeless and will only work with other privacy geeks.

mark-r 13y ago

Since much of the information is used to find out who you hang out with, your strategy doesn't help as much as you think. Guilt by association, you know.

bediger4000 13y ago
"Much of the information"? Given that the metadata (a.k.a. "CDR" or Call Data Record) is getting hoovered up in all this, about the only thing such a mass of data can be used for is guilt by association. The telco's don't match up CDR with a captured audio stream, so that's done by the NSA (or whoever). They're not going to be able to do that matching, or the semantic analysis of what's said, very often. Therefore, the ONLY thing the metadata can do is determine guilt by association.
deleted 13y ago
[deleted]

at-fates-hands 13y ago

This actually made me think about what kinds of analog communication equipment could we use and encrypt transmissions with? I know Motorola makes some two way radios that have encryption, just not sure how good it is. It would be interesting if people started to revert back to less and less digital communication and went back to doing what you're talking about. It's almost like another counter revolution taking shape.

varjag 13y ago
A scrambler can be used in audio band, although I'm not sure how well it will mate with a GSM codec. Still it's an inferior solution to purely digital P2P VoIP systems (like e.g. Skype before the supernodes).

kamjam 13y ago

How about sending all that meaningless bullsht emails with an additional notice, like we have for confidentially along the lines of, and then suing the US government if your stuff ever turns up (yes, I know, it's difficult). This message and any attachments are intended only for the use of the intended recipient(s), are confidential, and may be privileged... If you are the NSA then please note I am a US citizen and under 4th Amendment rights you are not lawfully allowed to store records of this message (I am not a US citizen, so fix as required)

mpyne 13y ago
Wouldn't matter, I'm afraid. Even if the NSA put free text detection algorithms to look for such a disclaimer (since they claim messages themselves are not examined without a warrant), they'd ignore the disclaimer anyways as anyone could easily claim they were a US citizen.

forgotAgain 13y ago

Those are all passive responses. Not meaning to be critical but they are the best case response that the government could hope for. How about picketing outside the office of your Congressman/woman? We're invisible with passive responses. I think as a people we need to get over the sense of embarrassment we feel when we gather as group for a political cause.

claudius 13y ago

That depends on who does the surveillance. Stopping to use American services is a simple start, and it is much easier to act against surveillance in your own country than it is to act against surveillance by the US. Of course, this only helps if your ‘home area’, i.e. the area you trust to not intercept your messages and where you can act meaningfully to ban such interception, is sufficiently large – given the size of the EU (for example) even after Britain is out, that shouldn’t be too much a problem. For everything going outside this green zone, encrypted communication is the go-to-response, be that PGP, OTR or at the very least HTTPS.

noonespecial 13y ago

I'm going to have to go with "no". Or perhaps "yes and". We should not be forced to curtail our use of one of mankind's greatest triumphs because a few cold-war troglodytes think that they are somehow entitled to read all of our mail and arrest us for word-crimes. These people don't deserve the power given to them in trust. We should remove it from them. Nothing less than that will do.

gorbachev 13y ago

Encrypting your emails won't help at all, because what's being snooped is the header information. Who sent to whom, when and from where and where to. You can't hide that information. Don't send email and don't use the phone is the only alternative. Snail mail may be safe.

a3n 13y ago
I assume snail mail metadata (from, to, date, weight, form factor) can and is collected, with modern USPS equipment.