11 ms·

Since I know the skill gap on HN is pretty wide, I just wanted to chime in to say that if this is some kind of counter-intelligence measure, it's not really goi

Since I know the skill gap on HN is pretty wide, I just wanted to chime in to say that if this is some kind of counter-intelligence measure, it's not really going to work considering that the US government is collecting information at layer 1 (i.e. directly gathering information from the wire). A true "alternative internet" would, at this point, require its own infrastructure due to the routers and switches of the Internet using the TCP/IP stack. (assuming that an alternative internet would be a variation on the IP protocol). The entire issue with the government surveillance of today is that they're (allegedly) storing all data, even the encrypted data, and holding it to either brute-force crack, waiting until whichever cipher/protocol gets broken, or waiting until computing power is abundant enough to crack the encryption-du-jour in a reasonable amount of time. This is why ideas like Raspberry Pis on balloons have been proposed as true "alternative" internets. Not to get all tin-foily, but I would assume that any undertaking that ambitious would have government agents working from the inside. If you're transmitting any data that could be illegal, your safest bet is to use some kind of encryption that would take longer than the statute of limitations for whichever crime you're committing to break (you'd probably also have to factor Moore's law into your calculation and pray that quantum computing doesn't become viable in the next x years).

ohwp 13y ago
If you want to transmit illegal data the best option is to take the route where the chance of intersection is minimal. And then Internet is not an option. That's also why I think surveillance programs won't catch the real bad guys. Take a look at how long it took to get Osama.
kimlelly 13y ago
What if the encrypted data streams that flow over decentralized p2p networks like RetroShare (http://retroshare.sourceforge.net/ http://retroshare.sourceforge.net/) would hold up and not be "decryptable" for the time we need to "undo" the mass-surveillance apparatus? I mean, encryption could still be the one tool needed just to get activism going enough to beat the bastards (I mean, without being sabotaged, disinformed, killed, arrested, etc.). Snowden's statement regarding encryption was: "Encryption works. Unfortunately, endpoint security is still weak."
- cmpctyd 13y ago
  Any cryptographic application could be vulnerable and not "hold up". It is wrong and dangerous to suggest that any program or tool is absolute. A court case in Germany not long ago involving RetroShare and its f2f nature did not end well[0]. [0] http://torrentfreak.com/anonymous-file-sharing-ruled-illegal-by-german-court-121123/ http://torrentfreak.com/anonymous-file-sharing-ruled-illegal...
  - mtgx 13y ago
    I think it actually did end well. The guy was acquitted last I heard. I don't think their changes held up in Court.
- baddox 13y ago
  > for the time we need to "undo" the mass-surveillance apparatus You mean the apparatus that the vast majority of Americans are probably unaware of, and the vast majority of aware Americans are probably proponents of? What makes you think there will ever be an undoing on any reasonable time scale?
Jd 13y ago
Additionally, it is worth noting that the weakest target is very often the human element. Although this was noted by Mitnick in his "hacking" (which generally was just clever social engineering), it is equally true when governments are targeting you. The stasi (or other pernicious organizations organized to carry out state censorship) could easily have someone smeared in the press, dismissed from their job, or many other means short of official imprisonment. To the point of encryption, as noted by the NSA (inclusive of present revelations), it actually makes you a target for state surveillance. This is a bizarre catch 22. If you are using facebook and "rah rah-ing" about Obama or the latest political fever you probably are at very little current risk of long term data retention. The government doesn't care about you. If you slip into politically suspect views and/or start encrypting your messages simply because you don't want the government to read them, you attract government attention, including the likely possibility that your communications will be retained. Moreover (and this is where it gets scary, even if it wasn't already), the likelihood is that the many people that are part of your social graph (even if you aren't involved in social networks, some friends likely are and have probably shared their email contacts at the very least), governments can very easily figure out your social circles, and how suspect they may be from any standpoint that the government cares about. Today this may be "terrorism" (itself a vague term, but one that at least nominally includes the threat of violent acts), tomorrow it may simply be having politically incorrect opinions of some variety. As noted by many, even the nominal but legally actionable protections for American citizens have been eroded to the point that the executive branch can hold anyone in infinite detention without trial. A world without borders has become the panopticon, a jail where we are bound by ever-peering eyes of our peers. "What you say, can and will be used against you in a court of law" -- even if you said it 10 years ago when you were drunk in a private message on Facebook. Welcome to the Brave New World.
- grey-area 13y ago
  If you are using facebook and "rah rah-ing" about Obama or the latest political fever you probably are at very little current risk of long term data retention. I'd go further and say that at present everyone (rah-rahing Obama supporters included) is currently at risk of long term data retention, given the facilities currently being built and the policies of the NSA/GCHQ/DGSE etc. In the UK at least the ambition is complete surveillance, and the present reality is the ingestion of ALL data entering and existing the UK, so the vast majority of internet traffic is already monitored, and stored for as long as they can manage. Snowden claimed in another video released today that the same situation pertains to the US, though I don't think we've seen documentary proof of that yet, just that they're collecting all metadata, which is bad enough. They can probably store metadata indefinitely already, and why wouldn't they? In the next few years as long as they can manage will be 1 year, then 10, then soon after lifetimes - that will easily happen within the lifetime of a person alive today, if the current policies persist. And one day as you say all that data will be used. So to extend Obama's assertion and make it less untruthful - no-one is listening to your phone calls, but someone will, one day.
kmicklas 13y ago
> If you're transmitting any data that could be illegal, your safest bet is to use some kind of encryption that would take longer than the statute of limitations for whichever crime you're committing to break (you'd probably also have to factor Moore's law into your calculation and pray that quantum computing doesn't become viable in the next x years). Not all crypto algorithms are breakable by quantum computers. Just use one of the ones that is not. (Because the most common algorithms are based on integer factorization, which can be done efficiently with quantum computers, there seems to be a widespread belief that quantum computing makes encryption with normal computers impossible.)
- alecrn 13y ago
  For those wondering about this, this comment from another thread might help. https://news.ycombinator.com/item?id=4931899 https://news.ycombinator.com/item?id=4931899
peterwwillis 13y ago
Wired networks are a lot more difficult to attack than wireless. It's way more cost-effective to just use existing infrastructure. Layer 1 doesn't give anyone any information, and Layer 2 is hardly usable across networks, and you can encapsulate layers 2-7 in a tunnel, so really there is no need for new infrastructure. We just need a critical mass of network nodes.
- rmrfrmrf 13y ago
  You're misunderstanding the crux of the issue. Think of the NSA as a man in the middle. Every signal you send is allegedly stored for later processing. At that point, it doesn't matter how many layers you have encapsulating your data -- it can still be analyzed and decrypted given enough time and resources.
  - peterwwillis 13y ago
    The crux of the issue is that somebody thinks the NSA is limited to using existing infrastructure. They aren't. You will be more successful in your aim by simply using the existing infrastructure in a way that is impractical to attack. The most secure method of transmitting a message is a one-time pad. There is no way to analyze or decrypt it without its mated random pad. However, for internet traffic, this is horribly impractical. So you use alternate methods with some tradeoffs to achieve security that is practically impossible to attack. The only benefit to alternate infrastructure is to work around government-imposed sanctions on traditional internet services, such as Iran, Egypt and other countries shutting off internet access. Project Byzantium is one way to work around this.
    - arnoooooo 13y ago
      Either way, I'm afraid that this approach is only going to cost more taxpayer dollars, and not address the real issue. How about using our technological leverage to educate about the issue instead of waging a war against an enemy that should'nt be one ?
    - mindslight 13y ago
DennisP 13y ago
There are some other methods, some listed in the OP: - Commotion Wireless uses p2p wireless between mobile devices, which pretty much qualifies as a separate physical infrastructure - If you're ok with the NSA knowing that you sent a message to someone on the network, as long as they don't know who received it, you can post encrypted messages to Usenet. Lots of people receive them, only one can decrypt. I think Bitmessage works this way too. - Although not listed at OP, there's some academic work on scaling up Dining Cryptographer networks, which maintain anonymity even assuming an adversary who monitors the entire network. For example: https://www.usenix.org/conference/osdi12/strong-scalable-anonymity-safetynet https://www.usenix.org/conference/osdi12/strong-scalable-ano... Also I don't think it's been established that the NSA is recording all internet transmission, though that's a good working assumption.
api 13y ago
These are all really cool and can be very useful, but personally I think decentralization and meshnets are to some extent a "false god" from a political and activism point of view. The fact is that any nation state can trivially attack the physical Internet. It can order any corporation operating under its jurisdiction to cooperate. It can force any operator to install filtering software or equipment. Come hell or high water, it can physically unplug things, force power companies to turn off power, etc. Given a political worst case scenario the wired Internet (and that includes things like 4G) will not and cannot be any safer from state tampering than any other infrastructure. Completely anarchistic decentralized meshnets that operate over things like peer to peer wireless have another problem. I am not aware of any existing totally decentralized meshnet protocol that isn't vulnerable to some form of attack against its trust system. There's the sybil attack: http://en.wikipedia.org/wiki/Sybil_attack http://en.wikipedia.org/wiki/Sybil_attack Then there's "long con" attacks where a group of malicious nodes joins the network and pretends to be friendly for a long period of time, adding a lot of resources and gaining a lot of trust, only to finally use that trust to fragment, DOS, snoop, or otherwise harm the network. Any of these attacks are well within the technical capability of a well-funded nation state. In addition, any wireless mesh can have its users located through frequency triangulation. A nation state wouldn't even have to arrest everyone. It could simply isolate the most important nodes, locate them, and confiscate the equipment or pressure, arrest, or pay off their operators. For a fee some trusted operators might be transformed into double agents. The reason I call it a "false god" is that I fear for some it can act as a substitute for real political activism. The fact is that in a political worst case scenario, nothing is safe. Thus the real battle to be fought is not in the technical sphere but in the human political sphere. We must preserve our liberties or they will be taken from us, period, and no amount of clever tech will truly stop that once the enemy is upon us.
- mindslight 13y ago
  > Thus the real battle to be fought is not in the technical sphere but in the human political sphere Most people only analyze immediate effects - they don't go out of their way to think in abstract models and worst-case scenarios. If they're being told that the panopticon is necessary for catching scary bad guys and see no immediate negative effects for them or their tribe, they're going to believe it. Only by becoming acquainted with privacy-preserving technology will they ever come to expect communications privacy, realize the government is working against them, and organize to preserve their autonomy.
personlurking 13y ago
"Not to get all tin-foily, but I would assume that any undertaking that ambitious would have government agents working from the inside." It's my suspicion that people will slowly stop saying "not to get tin-foily, but" as more and more is revealed re:NSA et al. Seems like a natural shift, given current and likely near-future circumstances. On to the point, the part I quoted is why I think revolts are bottom-up and revolutions are guided, even if the former progresses into the latter, at some point things get diverted. What makes all this scary, though, is the most powerful reason behind the existence of currency: the ability to create and (financially) back an army. Meanwhile, the gen. pop. has lived their entire lives kept in a dialectic, watching shadows dance in a cave, and consuming bread and circuses. I'm not for anarchy, but it seems short of something akin to the final scene in Fight Club, there's not much to be done about it. Unfortunately, the following options are all that's left: accept the status quo, pretend/believe you can change it or move.
rodolphoarruda 13y ago
I like the idea of using raspberry pis + baloons + cellphones to create an alternative/parallel network. But you'd always face issues when trying to go international. The scenario that comes to my mind is someone (or a group) very rich and somewhat influential building a small scale worldwide private network completely segregated from the current Internet. Any attempt to install backdoors, "Y" devices etc would be detected and mitigated. Infiltrated "agents" would be tracked by their behavior and exposed to public attention. But then comes the real reason for building such new network: communications, content sharing and services. The current availability of those 3 elements should be present. Are organizations willing to maintain two instances of their existing services, one in the current internet, another in the new one? Quite a challenge. Maybe having the new network solely for secure P2P communication via voice, chat and email would be a good start.
- dirkk0 13y ago
  I just understood what http://www.google.com/loon/ http://www.google.com/loon/ is all about.
tootie 13y ago
I doubt they're waiting to crack all that data. More likely they hold and if/when the owner is implicated in a crime, they will compel him to give up the password. Courts have compelled defendants to decrypt data seized in a legal search before. They could also maybe extract the password surreptitiously with more traditional investigation. Like looking over their shoulder when they type it.
jaakl 13y ago
Is there any reason why this new physical level infrastructure would not be wiretapped by NSA right away?

ohwp 13y ago

If you want to transmit illegal data the best option is to take the route where the chance of intersection is minimal. And then Internet is not an option. That's also why I think surveillance programs won't catch the real bad guys. Take a look at how long it took to get Osama.

kimlelly 13y ago

What if the encrypted data streams that flow over decentralized p2p networks like RetroShare (http://retroshare.sourceforge.net/ http://retroshare.sourceforge.net/) would hold up and not be "decryptable" for the time we need to "undo" the mass-surveillance apparatus? I mean, encryption could still be the one tool needed just to get activism going enough to beat the bastards (I mean, without being sabotaged, disinformed, killed, arrested, etc.). Snowden's statement regarding encryption was: "Encryption works. Unfortunately, endpoint security is still weak."

cmpctyd 13y ago
Any cryptographic application could be vulnerable and not "hold up". It is wrong and dangerous to suggest that any program or tool is absolute. A court case in Germany not long ago involving RetroShare and its f2f nature did not end well[0]. [0] http://torrentfreak.com/anonymous-file-sharing-ruled-illegal-by-german-court-121123/ http://torrentfreak.com/anonymous-file-sharing-ruled-illegal...
- mtgx 13y ago
  I think it actually did end well. The guy was acquitted last I heard. I don't think their changes held up in Court.
baddox 13y ago
> for the time we need to "undo" the mass-surveillance apparatus You mean the apparatus that the vast majority of Americans are probably unaware of, and the vast majority of aware Americans are probably proponents of? What makes you think there will ever be an undoing on any reasonable time scale?

Jd 13y ago

Additionally, it is worth noting that the weakest target is very often the human element. Although this was noted by Mitnick in his "hacking" (which generally was just clever social engineering), it is equally true when governments are targeting you. The stasi (or other pernicious organizations organized to carry out state censorship) could easily have someone smeared in the press, dismissed from their job, or many other means short of official imprisonment. To the point of encryption, as noted by the NSA (inclusive of present revelations), it actually makes you a target for state surveillance. This is a bizarre catch 22. If you are using facebook and "rah rah-ing" about Obama or the latest political fever you probably are at very little current risk of long term data retention. The government doesn't care about you. If you slip into politically suspect views and/or start encrypting your messages simply because you don't want the government to read them, you attract government attention, including the likely possibility that your communications will be retained. Moreover (and this is where it gets scary, even if it wasn't already), the likelihood is that the many people that are part of your social graph (even if you aren't involved in social networks, some friends likely are and have probably shared their email contacts at the very least), governments can very easily figure out your social circles, and how suspect they may be from any standpoint that the government cares about. Today this may be "terrorism" (itself a vague term, but one that at least nominally includes the threat of violent acts), tomorrow it may simply be having politically incorrect opinions of some variety. As noted by many, even the nominal but legally actionable protections for American citizens have been eroded to the point that the executive branch can hold anyone in infinite detention without trial. A world without borders has become the panopticon, a jail where we are bound by ever-peering eyes of our peers. "What you say, can and will be used against you in a court of law" -- even if you said it 10 years ago when you were drunk in a private message on Facebook. Welcome to the Brave New World.

grey-area 13y ago
If you are using facebook and "rah rah-ing" about Obama or the latest political fever you probably are at very little current risk of long term data retention. I'd go further and say that at present everyone (rah-rahing Obama supporters included) is currently at risk of long term data retention, given the facilities currently being built and the policies of the NSA/GCHQ/DGSE etc. In the UK at least the ambition is complete surveillance, and the present reality is the ingestion of ALL data entering and existing the UK, so the vast majority of internet traffic is already monitored, and stored for as long as they can manage. Snowden claimed in another video released today that the same situation pertains to the US, though I don't think we've seen documentary proof of that yet, just that they're collecting all metadata, which is bad enough. They can probably store metadata indefinitely already, and why wouldn't they? In the next few years as long as they can manage will be 1 year, then 10, then soon after lifetimes - that will easily happen within the lifetime of a person alive today, if the current policies persist. And one day as you say all that data will be used. So to extend Obama's assertion and make it less untruthful - no-one is listening to your phone calls, but someone will, one day.

kmicklas 13y ago

> If you're transmitting any data that could be illegal, your safest bet is to use some kind of encryption that would take longer than the statute of limitations for whichever crime you're committing to break (you'd probably also have to factor Moore's law into your calculation and pray that quantum computing doesn't become viable in the next x years). Not all crypto algorithms are breakable by quantum computers. Just use one of the ones that is not. (Because the most common algorithms are based on integer factorization, which can be done efficiently with quantum computers, there seems to be a widespread belief that quantum computing makes encryption with normal computers impossible.)

alecrn 13y ago
For those wondering about this, this comment from another thread might help. https://news.ycombinator.com/item?id=4931899 https://news.ycombinator.com/item?id=4931899

peterwwillis 13y ago

Wired networks are a lot more difficult to attack than wireless. It's way more cost-effective to just use existing infrastructure. Layer 1 doesn't give anyone any information, and Layer 2 is hardly usable across networks, and you can encapsulate layers 2-7 in a tunnel, so really there is no need for new infrastructure. We just need a critical mass of network nodes.

rmrfrmrf 13y ago
You're misunderstanding the crux of the issue. Think of the NSA as a man in the middle. Every signal you send is allegedly stored for later processing. At that point, it doesn't matter how many layers you have encapsulating your data -- it can still be analyzed and decrypted given enough time and resources.
- peterwwillis 13y ago
  The crux of the issue is that somebody thinks the NSA is limited to using existing infrastructure. They aren't. You will be more successful in your aim by simply using the existing infrastructure in a way that is impractical to attack. The most secure method of transmitting a message is a one-time pad. There is no way to analyze or decrypt it without its mated random pad. However, for internet traffic, this is horribly impractical. So you use alternate methods with some tradeoffs to achieve security that is practically impossible to attack. The only benefit to alternate infrastructure is to work around government-imposed sanctions on traditional internet services, such as Iran, Egypt and other countries shutting off internet access. Project Byzantium is one way to work around this.
  - arnoooooo 13y ago
    Either way, I'm afraid that this approach is only going to cost more taxpayer dollars, and not address the real issue. How about using our technological leverage to educate about the issue instead of waging a war against an enemy that should'nt be one ?
  - mindslight 13y ago

DennisP 13y ago

There are some other methods, some listed in the OP: - Commotion Wireless uses p2p wireless between mobile devices, which pretty much qualifies as a separate physical infrastructure - If you're ok with the NSA knowing that you sent a message to someone on the network, as long as they don't know who received it, you can post encrypted messages to Usenet. Lots of people receive them, only one can decrypt. I think Bitmessage works this way too. - Although not listed at OP, there's some academic work on scaling up Dining Cryptographer networks, which maintain anonymity even assuming an adversary who monitors the entire network. For example: https://www.usenix.org/conference/osdi12/strong-scalable-anonymity-safetynet https://www.usenix.org/conference/osdi12/strong-scalable-ano... Also I don't think it's been established that the NSA is recording all internet transmission, though that's a good working assumption.

api 13y ago

These are all really cool and can be very useful, but personally I think decentralization and meshnets are to some extent a "false god" from a political and activism point of view. The fact is that any nation state can trivially attack the physical Internet. It can order any corporation operating under its jurisdiction to cooperate. It can force any operator to install filtering software or equipment. Come hell or high water, it can physically unplug things, force power companies to turn off power, etc. Given a political worst case scenario the wired Internet (and that includes things like 4G) will not and cannot be any safer from state tampering than any other infrastructure. Completely anarchistic decentralized meshnets that operate over things like peer to peer wireless have another problem. I am not aware of any existing totally decentralized meshnet protocol that isn't vulnerable to some form of attack against its trust system. There's the sybil attack: http://en.wikipedia.org/wiki/Sybil_attack http://en.wikipedia.org/wiki/Sybil_attack Then there's "long con" attacks where a group of malicious nodes joins the network and pretends to be friendly for a long period of time, adding a lot of resources and gaining a lot of trust, only to finally use that trust to fragment, DOS, snoop, or otherwise harm the network. Any of these attacks are well within the technical capability of a well-funded nation state. In addition, any wireless mesh can have its users located through frequency triangulation. A nation state wouldn't even have to arrest everyone. It could simply isolate the most important nodes, locate them, and confiscate the equipment or pressure, arrest, or pay off their operators. For a fee some trusted operators might be transformed into double agents. The reason I call it a "false god" is that I fear for some it can act as a substitute for real political activism. The fact is that in a political worst case scenario, nothing is safe. Thus the real battle to be fought is not in the technical sphere but in the human political sphere. We must preserve our liberties or they will be taken from us, period, and no amount of clever tech will truly stop that once the enemy is upon us.

mindslight 13y ago
> Thus the real battle to be fought is not in the technical sphere but in the human political sphere Most people only analyze immediate effects - they don't go out of their way to think in abstract models and worst-case scenarios. If they're being told that the panopticon is necessary for catching scary bad guys and see no immediate negative effects for them or their tribe, they're going to believe it. Only by becoming acquainted with privacy-preserving technology will they ever come to expect communications privacy, realize the government is working against them, and organize to preserve their autonomy.

personlurking 13y ago

"Not to get all tin-foily, but I would assume that any undertaking that ambitious would have government agents working from the inside." It's my suspicion that people will slowly stop saying "not to get tin-foily, but" as more and more is revealed re:NSA et al. Seems like a natural shift, given current and likely near-future circumstances. On to the point, the part I quoted is why I think revolts are bottom-up and revolutions are guided, even if the former progresses into the latter, at some point things get diverted. What makes all this scary, though, is the most powerful reason behind the existence of currency: the ability to create and (financially) back an army. Meanwhile, the gen. pop. has lived their entire lives kept in a dialectic, watching shadows dance in a cave, and consuming bread and circuses. I'm not for anarchy, but it seems short of something akin to the final scene in Fight Club, there's not much to be done about it. Unfortunately, the following options are all that's left: accept the status quo, pretend/believe you can change it or move.

rodolphoarruda 13y ago

I like the idea of using raspberry pis + baloons + cellphones to create an alternative/parallel network. But you'd always face issues when trying to go international. The scenario that comes to my mind is someone (or a group) very rich and somewhat influential building a small scale worldwide private network completely segregated from the current Internet. Any attempt to install backdoors, "Y" devices etc would be detected and mitigated. Infiltrated "agents" would be tracked by their behavior and exposed to public attention. But then comes the real reason for building such new network: communications, content sharing and services. The current availability of those 3 elements should be present. Are organizations willing to maintain two instances of their existing services, one in the current internet, another in the new one? Quite a challenge. Maybe having the new network solely for secure P2P communication via voice, chat and email would be a good start.

dirkk0 13y ago
I just understood what http://www.google.com/loon/ http://www.google.com/loon/ is all about.

tootie 13y ago

I doubt they're waiting to crack all that data. More likely they hold and if/when the owner is implicated in a crime, they will compel him to give up the password. Courts have compelled defendants to decrypt data seized in a legal search before. They could also maybe extract the password surreptitiously with more traditional investigation. Like looking over their shoulder when they type it.

jaakl 13y ago

Is there any reason why this new physical level infrastructure would not be wiretapped by NSA right away?