8 ms·

Dear USA, my data has left your building

256 points by cpbotha 13y ago

waterlion 13y ago
Dear cpbotha, No it hasn't. -- USA.
- chopin 13y ago
  As for Google - yes it has. If this is done en masse it will hit their bottom line. Only this will make them lobby for better rules. So even if the USA can still snoop there is a chance for change.
lazyjones 13y ago
It's a bit naive to believe that after Google may have deleted your emails (no good reason to trust them, I'm afraid), the NSA also no longer has access to them. They picked them up as they arrived at or left your Gmail account and will keep them forever.
- levosmetalo 13y ago
  But may not get his future email and future data, which is still much better to him than if he stayed with Google.
  - josefresco 13y ago
    may not being the key phrase. Thankfully for the NSA, they can add to his profile this how-to on how he's managing his data moving forward.
    - levosmetalo 13y ago
      "may not" is still better or at the worst case the same as "certainly true" ;)
- jlgaddis 13y ago
  I hate responses (and attitudes) such as this. It's as if you've concluded that anything you do going forward is pointless and a waste of time. I am not yet ready to come to that conclusion and have recently stepped up my efforts to better protect my data -- both at rest and in transit -- and encourage everyone else to do the same.
dcc1 13y ago
Over the last month I have cancelled all our servers in US, setting up a new one this morning in Amsterdam One thing I am worried about is potential liability of having someone sueing us under data protection laws here in Ireland, claiming their data was inspected by US and we couldnt protect their privacy Here in Europe we get to have data protection commisioners and strong laws on the subject unlike across the pond.
- targusman 13y ago
  Yup, there is no way would those data protection commissioners ever, ever be corrupted through offers of money or secret threat like any other civil servant, political appointee, or corporate drone. Those people are perfect!
- toyg 13y ago
  That's been the case ever since the PATRIOT Act was passed, back in 2001. So you were screwed even before Snowden came along ;)
- stekoz 13y ago
  One thing I don't entirely understand is whether having an EU-based server provided by an US company (Rackspace, AWS, Digital Ocean, you name it) makes any difference at all.
  - nl 13y ago
    No one can say - although at the moment you can be sure they are subject to US intercept orders. The companies are incorporated in the US, so subject to US law. But the physical servers are located in other jurisdictions, and sometimes US law conflicts with that law. In practice, so far I suspect that the US law has won out, because other jurisdictions haven't known to fight it. In the future that might change, but... secret orders supported by secret laws enforced by secret courts can be pretty hard for other jurisdictions to fight.
  - arethuza 13y ago
    A server that is located in the EU is almost certainly owned and operated by a EU-based legal entity that is a wholly owned subsidiary of the US parent. So strictly speaking you would be getting your services from a EU company that is owned and controlled from the US but that is subject to all the relevant local laws.
mswe 13y ago
Dear cpbotha, You can run, but you can't hide. - USA
- cpbotha 13y ago
  Dear USA, You are probably correct. My point is that I can make it slightly more complicated for you to sniff around in my data, and that was the whole point of this move. If more people do this, it will get progressively harder for you to do your mass surveillance job as you do it now. I'm sorry I had to leave you, cpbotha
  - josefresco 13y ago
    If you think the USA is alone in their desire to surveille you're going to have a rough time around the world. The USA had the means, but the will is there worldwide.
    - einhverfr 13y ago
      This is true, but outside of the US, China, and probably Europe, few countries' governments have the money to do this or the priorities to do it.
jacquesm 13y ago
Nitpickers aside (yes, what they had they may still have or at least in digest form) this is a single instance of a tidal wave of people doing this. EU datacenters are doing quite well because of the NSA revelations. The economic impact of this could very well counteract any net plus the US had while they were able to spy at will. Likely it's not going to be the same parties that will end up footing the bill. The practical effect from a security point of view of this exodus is likely not very significant, I take it as read that EU pipes & major hubs are also bugged in much the same way, possibly even by the NSA and their friends with tacit approval or blind-eye-turning of local authorities, presumably under some data sharing agreement. Just this morning it was revealed that Belgacom (the Belgian major telco) has concluded that their communications are being spied on and I'm sure that even though the Belgian government is reacting very much upset about this that when the final verdict is in we'll find that that very same government at some level of the bureaucracy knew about this since day one. Plausible deniability will protect those in charge. So, you can move your data around as much as you want, it won't make much more than symbolic difference unless you go to really exotic or lawless places. Maybe Switzerland or Iceland could re-invent themselves as data bastions but that would merely shift the attention to lines running into and out of those places.
- DanielBMarkham 13y ago
  More to the point, this is a problem of layers. It's not just where you decide to host. Most every national government is probably involved in data sniffing to one degree or another, major hubs are/can be bugged, and undersea fiber connections are especially vulnerable. This, in addition to all of the insecurities found in common consumer gear. There's probably a tidal wave of folks moving, but I agree: the move is nothing more than hugely symbolic. The only thing you might accomplish is change the organization that's capturing your data and perhaps the method. But that's about it.
  - mbesto 13y ago
    You can also encrypt the data before it gets to the server by a third-party who holds the key in your own country. (these services do exist btw) The question is then if those companies chose to give up the key to decrypt the information.
pastylegs 13y ago
It's interesting to see people doing this as it's something I've been planning to try. I've backed the Lima project on Kickstarter which will hopefully become my Dropbox replacement: http://www.kickstarter.com/projects/cloud-guys/plug-the-brain-of-your-devices?ref=live http://www.kickstarter.com/projects/cloud-guys/plug-the-brai... and the Mailpile project on Indiegogo which will hopefully work as my email frontend on a local server: http://www.indiegogo.com/projects/mailpile-taking-e-mail-back http://www.indiegogo.com/projects/mailpile-taking-e-mail-bac... I'm planning on buying a small server for running all my services on a VPN (mail server, GitLab, Mailpile etc.) and a decent NAS with RAID'ed backups of server + lima drives + time machine and if possible send that to a safe off-site backup.
- cones688 13y ago
  I have a HP ProLiant N40L and couldnt recommend it enough.
rsync 13y ago
Obviously we[1] sympathize with this, since we've been running a swiss location since 2006 - one that has become increasingly busy in the last 3-4 months. However, I personally don't store my data there - even though I am deeply disturbed by the recent revelations and invoke all manner of security precautions in my own digital life. First of all, it appears that intra-US Internet traffic is subject to less scrutiny and open to a much more narrow interpretation of the laws that (supposedly) allow this snooping to happen. Once your traffic leaves the US, the 4A (and other) protections seem to relax significantly. Let's set aside for the moment the bad behavior of other global and national "observers" on the network, which we have to assume are at least as bad as the US NSA ... and let's just concern ourselves with the US side of things. From that perspective, moving your traffic out of the US appears to have a lot of unintended consequences. Second, it really shouldn't matter. SSH is SSH and duplicity is duplicity and storing a fragmented TC container is ... well you get the idea. If I have the right toolset[2], I should be able to store my data on a USB stick that I leave in the NSA lobby every night. You should ask yourself how large and unwieldy your digital life has become if you can't just trust the math. Oh, and also ...[3] [1] rsync.net [2] SSL/PKI is not the right toolset. gmail is not the right toolset. Weirdo walled garden dropbox gdrive non-standard private API garbage is not the right toolset. [3] We support synology devices perfectly, right out of the box, and right through their GUI config. Just saying.
- MattJ100 13y ago
  I have a Synology device (exact same model as the article author actually, and likewise I love it). However I'm having trouble finding a way to back it up securely. The built-in backup methods don't seem to account for encrypting the backups (even if the volume is encrypted). Any suggestions?
  - ansible 13y ago
    However I'm having trouble finding a way to back it up securely. The built-in backup methods don't seem to account for encrypting the backups (even if the volume is encrypted). Any suggestions? Two suggestions: A) Download the source [1], and see if it is complete and then you can port in cryptsetup and the LUKS stuff from Linux. B) Run Linux. If you're at the point where you're worried about encrypted backups, then you should probably be running some form of Linux instead. You can get a small form factor PC that includes the motherboard and processor for not much more than the Synology box. That'll give you a lot more options for software and services too. We're using this for all the offsite backup drives, and it wasn't too hard to get going. If you (or anyone reading this) can't figure out cryptsetup, just PM me and I'll help you out. [1] http://sourceforge.net/projects/dsgpl/files/?source=navbar http://sourceforge.net/projects/dsgpl/files/?source=navbar
stef25 13y ago
It's not clear to me if you dropped your gmail address? Running email outside of gmail is easy enough, but changing email address to another domain is a total pain.
- cpbotha 13y ago
  Fortunately I've been using my own domains on top of gmail for the past few years. I still have my gmail account to see what mail ends up in there (and then notify people), and to use google+ (not going to stop that yet). Already probably about 98% of important mail is going directly to addresses on my own domains.
- fphilipe 13y ago
  He could have been using Google Apps with a custom domain.
- fulafel 13y ago
  It' odd that perma-address providers like pobox.com aren't more popular.
  - nodata 13y ago
    pobox is US-based.
sneak 13y ago
The problem is that all of your email conversations are with people who still use gmail. Game over.
- cpbotha 13y ago
  You are correct. However, I am simply taking all MY email out of gmail, so that MY database is not the one that's used to get information about others. Besides this, because I'm not using gmail anymore, I'm using OpenPGP more often to sign and encrypt emails. I agree that it's a drop in the bucket, but it's a drop that I had to add.
- frank_boyd 13y ago
  > Game over. Never surrender. "Educate" your friends. Provide them with the facts/sources they need so they open their eyes.
- icebraining 13y ago
  At least you're not informing on other non-Gmail users. http://betabeat.com/2011/12/in-which-eben-moglen-like-legit-yells-at-me-for-being-on-facebook/ http://betabeat.com/2011/12/in-which-eben-moglen-like-legit-...
dshep 13y ago
Can anyone recommend a linux VPS host outside the US as an alternative to Linode or Digitalocean?
- bornhuetter 13y ago
  I've been using http://www.cheapvps.co.uk/ http://www.cheapvps.co.uk/ for bots and simple websites, and am pretty happy with it. EDIT: as other people pointed out elsewhere, the UK may not be that much better (if at all better) than the US. The question is, though, where is safer?
- timw6n 13y ago
  http://www.bigv.io/ http://www.bigv.io/ is UK based and seems rather popular.
  - sschueller 13y ago
    I think the UK is just as bad as the US when it comes to spying.
  - shiven 13y ago
    Why is a US lapdog country like the UK, any better in the context of this post?
- tdec 13y ago
  You can check out http://www.ovh.com http://www.ovh.com and http://www.hetzner.de http://www.hetzner.de
- sdoering 13y ago
  If you are speaking German (site is in German) you could try http://uberspace.de http://uberspace.de. I am one happy customer of these guys.
  - skrause 13y ago
    I'm also a happy Uberspace user, but they don't offer any VPS. They're more like a standard webhosting provider with shell access.
dutchbrit 13y ago
You forgot the backdoors in your hardware. Yours faithfully, The United States of America
- devx 13y ago
  Maybe it's time EU, Latin America, and most of the Asian countries start banning US hardware, too - you know, just like US started banning Huawei, for the same reasons.
  - GFischer 13y ago
    So, would we use Chinese hardware? It probably has backdoors too.. And at least here in Latin America I believe there aren't enough hardware providers to build anything resembling a modern computer.
    - dingaling 13y ago
      > So, would we use Chinese hardware? It probably has backdoors too.. Indeed, but at least the backdoors aren't used to feed an establishment that has a track record of rendition, UAV assassination and technology-based lethal sabotage.
a3n 13y ago
It's the bottom line that's important. As long as the current surveillance regime is in place, there's nowhere you can be online that isn't watchable by them. The NSA is the largest practitioner and consumer of surveillance among its allies and other targets, and likely drives and influences most surveillance activity among its allies and other targets. The NSA gets its funding from US tax collections, and those taxes are controlled by US politicians. So at the least, non-US citizens and corporations should move their data and activity out of US-controlled or affiliated corporations. There is only one way that this surveillance can be changed at all, and that's by US corporations and their rich executives and shareholders feeling a rumbling in their bottom lines. This will rouse them to direct the recipients of their political and lobbying dollars to cut this shit out. I'm sorry, but we citizens of the US have long lost control of our government. It's money. Vote with your feet. Don't fund the US surveillance state.
- einhverfr 13y ago
  This is true, but there is also some reason to think that surveillance may be somewhat more difficult if outside the immediate operational reach of the US government. So yes they can listen. But if you make it as hard as you can, you make them spend more effort for less. If we could make the internet run more secure encryption generally, then the NSA, forced to target specific end-points, would howl in frustration....
- hershel 13y ago
  In most cases I'll agree with you, money controls the us government. In this case thought, the nsa might have secret knowledge on politicians, it's job might be critical to national security or at least seem so, and I bet there's some support from the military industrial complex. It would be quite hard for tech companies fight this fight.
- a3n 13y ago
  Actually, there's a potential error in what I said. If corporate America benefits from economic espionage (e.g. spying on PetroBras), then it will never stop.
scrrr 13y ago
I suspected there was going to be a mass exodus. NSA basically killed cloud-computing. I don't think it will come back soon. And while on the subject, consider selling your Microsoft stock. How many enterprise customers will choose Microsoft products again after 2013?
- jacquesm 13y ago
  > NSA basically killed cloud-computing. I don't think the current disgust will last too long. A lot of people will move, at some point they'll realize the grass isn't all that much greener on the other side. There is a definite activation energy required for such a move and I'm sure that the NSA debacle provided just that for a fairly large number of parties but in the very long term the difference will be small. (In the short term it will be quite significant, at least as long as this issue is on the front-burner in the media). The response to things like this is usually an impulse with a strong attenuation over time. It'll never quite become 0 but it will get close to 0 in a fairly short time. The reason why right now we are seeing all this movement is because Glenn Greenwald specifically is doing an extremely good job of keeping the focus on this subject. Mainstream media would normally have completely passed an issue like this by as too technical and not enough human interest to spend a lot of time on (both of those are negatives in a news cycle that thrives on eyeballs and associated advertising). The longer this story is kept in the public eye the bigger the fall-out will be. For now, I'm very impressed with how they are managing this, considering the adversary.
  - scrrr 13y ago
    Greenwald somewhere mentioned that there's material for months to come if I am not mistaken. So besides that he's doing a good job (agreed), I think Snowden simply provided a huge amount of information.
    - jbigelow76 13y ago
      If there really is months more worth of information I wonder if the public, US or otherwise (as we find more countries with intelligence agencies working as accessories), will experience outrage fatigue. I guess it will depend on how bad each revelation is but I could easily imagine a lot people picking the one revelation that really bothered them and then framing all others relative to that: "they're doing Y too? What's the point when they are already doing X?" My armchair quarterback opinion, reveal the rest now and hope for a critical mass of outrage.
leokun 13y ago
Just as a thought exercise, this might not be a good trend for US businesses, but perverse reversion of this is that the less foreigners store their data at US companies, the less rational the NSA has to snoop there, meaning we may only have to worry about FBI, DEA, etc and they aren't as sophisticated as the NSA at this. I actually don't have a problem with any of these agencies personally, just a thought.
pekk 13y ago
Technical decision, or just nationalism? Some people never get over old historical issues.
nileshtrivedi 13y ago
I recently deleted my Google+ profile. I have to say that Google is among the nice ones out there. They have a no-nonsense process with tools in place to export the data and delete accounts. Facebook/Quora make it really difficult to delete your data. It's ironic that it's easier to leave the good corporations than the bad ones.
- mike-cardwell 13y ago
  Was your data actually deleted, or does Google still have it?
  - nileshtrivedi 13y ago
    They said that they will delete the data "over a few days". I only deleted my Google+ profile, not the entire Google account and I had manually emptied the profile anyway.
- skrause 13y ago
  Facebook doesn't really make it difficult either: https://www.facebook.com/help/delete_account https://www.facebook.com/help/delete_account
- hoffcoder 13y ago
  Since when Quora too make the cut to the baddies?
dirktheman 13y ago
As much as I love Synology NAS, I wouldn't trust it for keeping what's essentially my entire life (email, photos, music, files, everything). The author has a backup system which involves two laptops, a workstation and a separate file drive. However, at the bottom he/she adds "I will probably add an extra external drive to the mix and try to keep that off site." My advice: do it. Now. Murphy's law states that a flood/power surge will hit your house as soon as pull the plug on your external storages. I don't want the NSA to snoop through my email and family photos, but the fear of data loss easily trumps my fear of not having privacy. To me, that's the tradeoff for using public services like dropbox/Gmail: I get more redundancy at the cost of privacy.
- moocowduckquack 13y ago
  free cloud services!=backup
  - dirktheman 13y ago
    No, you're absolutely right. And I didn't state they are, nor that they are free. For backup purposes, I use my NAS, an external hard drive that I use off site, and Amazon Glacier for when things go really bad. (With Glacier, you pay mere pennies for storing gigabytes, but you pay a lot if you ever need the files). What I meant is that the author is so focused on privacy issues that he/she forgets about redundancy.
- jlgaddis 13y ago
  I currently backup to (encrypted volumes on) external USB drives at home. I just recently moved and now have much more upstream bandwidth (FTTH, yay!) so I wanted to do off-site backups as well. After careful consideration, I decided to occasionally make an "encrypted full backup" and then permanently archive those to Amazon's Glacier service. Edit: Just read your comment further down where you also mention using Glacier. Have you restored any data from it to test it out yet? If so, are you happy with it? Thanks.
nodata 13y ago
dirvish is dead. Use obnam http://liw.fi/obnam/ http://liw.fi/obnam/
peterkelly 13y ago
Actually, your data is still in their building. You've only removed the particular copy that you had access to.
wlj 13y ago
"The loss of GMail conversation view was initially really REALLY painful." I recently experienced the same pain with Thunderbird after moving away from the new Gmail compose interface however I've since moved on to Airmail [1] which deals with conversations (and other Gmail behaviours (shortcuts etc) in a very similar way to Gmail and am extremely happy with the move. [1] http://airmailapp.com http://airmailapp.com
- cpbotha 13y ago
  Thanks for the tip! I use Linux on all my laptops and workstation, so unfortunately I can't use airmail or postbox (windows + osx) for this.
  - takluyver 13y ago
    Geary is a mail client for Linux with a similar interface to conversation view. It's still fairly young, so not entirely polished, but it is usable. Edit: usable, but seemingly with no support for encryption/signing, among various other things. Maybe it needs a bit more time to be ready.
frank_boyd 13y ago
> On my Android telephone (whoops…) I am using the Kaiten IMAP client. Check out: http://www.ubuntu.com/phone http://www.ubuntu.com/phone Devices supported: https://wiki.ubuntu.com/Touch/Devices https://wiki.ubuntu.com/Touch/Devices Currently, the Galaxy Nexus seems to be the best option; see its hardware support progress here: https://docs.google.com/spreadsheet/ccc?key=0ArLs7UPtu-hJdDZDNWliMmV1YUJ3Zk1pQlpDdGp4VFE#gid=0 https://docs.google.com/spreadsheet/ccc?key=0ArLs7UPtu-hJdDZ... (column "Maguro")
- ubergesundheit 13y ago
  Even better: Firefox OS
  - frank_boyd 13y ago
    The only thing I'd miss there is the lack of support for "native apps" (meaning everything runs in the browser). But it's still great to have another open-source mobile OS alternative.
plg 13y ago
"My webhoster (WebFaction) receives mail for all my domains. My Synology retrieves mail every 5 minutes via POP (you can set this up via Roundcube on the Synology) and deletes it from WebFaction." but even if you can delete your mail from your mailhost after downloading it to your private machine, isn't the point that the NSA probably collected the email before it even hit your mailhost?
- tokenizer 13y ago
  I think you're right. Even moving your mail or web server to another country won't help deter the actual collection with prism. However, I think responses like this create tension between the companies agreeing to give their information, and the government. If google, yahoo, and facebook start to lose money they might potentially fight legislation like this going forward and may advocate in reverting these policies.
  - reustle 13y ago
    This is probably the biggest thing we need to work towards. Sure, leaving gmail might be painful and it might not really help us out in the end (regarding preventing spying) but hurting the big players enough for them to move into offense mode is a great scenario.
    - chronolitus 13y ago
      Reading this comment made me feel uneasy, and I couldn't tell why. After giving it some thought, I found the reason. There is nothing wrong with the argument, it is sound logic, and reasonable. In fact, I agree with it. No, this comment made me recoil because for a second, it made me envision a reality where our political influence, as people, can only be exercised through corporations. And, (maybe, I confess, because I am so deep into the lecture of cloud atlas) I can't help but sense that it is a dangerous road to be embarked on. But these are just my two cents...
- pja 13y ago
  That probably depends on whether your ISP's mailserver uses opportunistic encryption. Any email I send to Google from my mailserver is always sent over a TLS-encrypted connection for instance, because Google's mailservers agree to encrypt where possible. In this scenario, the NSA wiretaps will get direct access to any email sent over unencrypted connections to the ISP mailserver, but they'll have to work harder to get at the encrypted data. Of course, as we know they've suborned the encryption used by many, many organisations so this is no guarantee of protection against an NSA fishing expedition, but it's a lot better than nothing.
educating 13y ago
Great post. Appreciate all of the details of how to leave Google vs just a rant.
blahbl4hblah 13y ago
I think its cute that this guy thinks that running his own gear will keep a nation state out of his email. YET ANOTHER SELF-ABSORBED NSA BLOG POST. I bet in all the ensuing conversation that covered how to use double blind file system encryption an GPG encrypted toast that no one said..."we should get involved in the political process and do something about this!"...because you're stupid and you just want to circle jerk about it...
ianstallings 13y ago
Yeah, because nothing protects you from the NSA like being outside the USA. Edit: Oh I see I've been voted down. I guess that makes my statement untrue.. My point was that outside the USA the NSA has free reign. Only inside the USA does the NSA have restrictions. Obviously they crossed some lines and we are still fighting for privacy around the globe. But moving data outside will not stop them.
zobzu 13y ago
all major nations do exactly the same as the nsa. yes france. yes germany. becauqe theyve not been exposes as publicly does not mean nobody is watching. source: used to work in eu intelligence agencies
mergy 13y ago
This used to be called setting up a mailserver and fileserver back in the day. Some people never gave up the goods and kept their personal files and email accounts on their own hardware.
bayesianhorse 13y ago
I don't believe that there is enough information yet to take action, for example moving data out of US Datacenters. Too little is know about what the NSA is actually doing with the stuff, what they do and don't have access to, and what kind of risks businesses are incurring as a result. The most important question is whether or not the NSA or other agencies in the US are actively committing industrial espionage, meaning not only that they are spying on foreign companies but also passing on data to US competitors.
mcdougle 13y ago
> The loss of GMail conversation view was initially really REALLY painful Considering all the shit going down lately... we've seen a recent surge in use of things like DuckDuckGo and OwnCloud, but no good replacement for the Gmail UI. I'm surprised no one's seen that opportunity and created something similar, but installable on your own personal server so that you can have access to a good web UI from anywhere. If I can make the time, I'd love to do something like this.
flatfilefan 13y ago
The author is an ignorant puppy. [\ad hominem] What's the use of all those spendings if his email is not encrypted and hosted on his own hardened server behind a firewall he knows how to configure himself? And even then, if his counterparts are not doing the same, we're back to the original problem.
- chadk 13y ago
  > And even then, if his counterparts are not doing the same, we're back to the original problem. Not necessarily. It means he removes the "trove" aspect of his email inbox. Putting together all his communications from the recipients adds to the difficulty (not impossible since "they" have all the metadata and others are probably compromised), but at least he removes the major point of failure.
deleted 13y ago
[deleted]
joshdance 13y ago
The problem is the "normals" don't know the spying is going on, don't know what it means, and don't know how to roll their own solution.
superuser2 13y ago
GCHQ is not exactly any rosier than the NSA. I don't know why OP imagines that WebFaction (UK company) is immune to spying in a way that Google isn't. I'm afraid this will be characteristic of the anticipated mass exodus. People will move away from US services because it makes them feel good, but their destinations are going to be either Five Eyes territory or countries that don't even feel a need to hide their surveillance apparatus.
- takluyver 13y ago
  At least for e-mail, I think the idea is to ensure that a cloud provider doesn't have a long backlog of his e-mails. Of course, if the NSA take an interest in him, they'll still find a way to monitor his current e-mails, but this makes it harder for them to pull all his past e-mails. I doubt WebFaction is secretly storing all the e-mail he has deleted, because that costs money, and they can't show advertising next to it.
  - superuser2 13y ago
    We know that the Five Eyes have ISP-level taps. Why do we think they aren't reading SMTP as it flows across WebFaction's datacenter?
    - takluyver 13y ago
      They are quite probably reading it, and I think I read something about a buffer of a few days that they kept things for. But they're probably not keeping all of everyone's communications in case they want to refer to them in five years time. Whereas on GMail they can dig back through years of old e-mails as well. At the very least, it adds a small per-person cost to their surveillance, because they have to store copies of e-mails themselves rather than getting Google to do it.
gcv 13y ago
All well and good — I suspect that OpenPGP is one of the few reliable tools out there for file and email security — but BitTorrent Sync is closed-source. We have no way of knowing that it doesn't automatically provide copies of all data to interested third parties. Better put those cat pictures in TrueCrypt (another tool which probably works) volumes before syncing them out. (Assuming your hardware doesn't compromise the encryption.)
pinaceae 13y ago
7bn people on earth, but the NSA has a direct interest in cpbotha hence his actions make total sense. because if the US intelligence services took interest in him, moving his data to other servers would totally stop them. i can see the agents shaking their fists at the sky, helplessly staring at the server just beyond their reach. so fulfilling to finally act out those ultimate nerd fantasies. just as awesome as the PGP mail users in college back in the days. sending plain text mails with pgp signatures, because somenone else could forge your identity - riiiiight. i wonder if there is a direct correlation between this mindset and stuff mounted on the belts of said users. giant keyrings, led flashlights, multitools, etc - always prepared for the movie in your head.
speedyrev 13y ago
If your data, encrypted or not, travels through the US or any of it's allies, don't you think they already have access if they want it. Privacy is an illusion.
devx 13y ago
I strongly suggest watching Jakob Appelbaum's speech at the NSA hearing in the European Parliament: https://www.youtube.com/watch?v=Cu6accTBjfs&feature=youtu.be&t=2h23m1s https://www.youtube.com/watch?v=Cu6accTBjfs&feature=youtu.be... Here's a question he asks to people who think that because they're Americans they're "more protected" against NSA spying than foreigners: Who would be me more afraid to call someone like Appelbaum or Julian Assange? Someone from US, or a foreigner? I think everyone knows the answer to that question, and you also have your answer for how protected Americans really are against this total surveillance.
runjake 13y ago
Where are you going to move your data where it's less likely reachable by the NSA and the GCHQ? Another UKUSA member country? Any country in Europe? A third world nation? You're only shifting eyes from western intelligence to a third world dictatorship, or Russia's FAPSI and GRU units. And in some cases, moving your data out of the US may subject it to even more scrutiny or dragnets.
Sami_Lehtinen 13y ago
For me everything was clear before these NSA leaks. That's why I have hosted my own services and servers already for 15 years.

256 points by cpbotha 13y ago

waterlion 13y ago

Dear cpbotha, No it hasn't. -- USA.

chopin 13y ago
As for Google - yes it has. If this is done en masse it will hit their bottom line. Only this will make them lobby for better rules. So even if the USA can still snoop there is a chance for change.

lazyjones 13y ago

It's a bit naive to believe that after Google may have deleted your emails (no good reason to trust them, I'm afraid), the NSA also no longer has access to them. They picked them up as they arrived at or left your Gmail account and will keep them forever.

levosmetalo 13y ago
But may not get his future email and future data, which is still much better to him than if he stayed with Google.
- josefresco 13y ago
  may not being the key phrase. Thankfully for the NSA, they can add to his profile this how-to on how he's managing his data moving forward.
  - levosmetalo 13y ago
    "may not" is still better or at the worst case the same as "certainly true" ;)
jlgaddis 13y ago
I hate responses (and attitudes) such as this. It's as if you've concluded that anything you do going forward is pointless and a waste of time. I am not yet ready to come to that conclusion and have recently stepped up my efforts to better protect my data -- both at rest and in transit -- and encourage everyone else to do the same.

dcc1 13y ago

Over the last month I have cancelled all our servers in US, setting up a new one this morning in Amsterdam One thing I am worried about is potential liability of having someone sueing us under data protection laws here in Ireland, claiming their data was inspected by US and we couldnt protect their privacy Here in Europe we get to have data protection commisioners and strong laws on the subject unlike across the pond.

targusman 13y ago
Yup, there is no way would those data protection commissioners ever, ever be corrupted through offers of money or secret threat like any other civil servant, political appointee, or corporate drone. Those people are perfect!
toyg 13y ago
That's been the case ever since the PATRIOT Act was passed, back in 2001. So you were screwed even before Snowden came along ;)
stekoz 13y ago
One thing I don't entirely understand is whether having an EU-based server provided by an US company (Rackspace, AWS, Digital Ocean, you name it) makes any difference at all.
- nl 13y ago
  No one can say - although at the moment you can be sure they are subject to US intercept orders. The companies are incorporated in the US, so subject to US law. But the physical servers are located in other jurisdictions, and sometimes US law conflicts with that law. In practice, so far I suspect that the US law has won out, because other jurisdictions haven't known to fight it. In the future that might change, but... secret orders supported by secret laws enforced by secret courts can be pretty hard for other jurisdictions to fight.
- arethuza 13y ago
  A server that is located in the EU is almost certainly owned and operated by a EU-based legal entity that is a wholly owned subsidiary of the US parent. So strictly speaking you would be getting your services from a EU company that is owned and controlled from the US but that is subject to all the relevant local laws.

mswe 13y ago

Dear cpbotha, You can run, but you can't hide. - USA

cpbotha 13y ago
Dear USA, You are probably correct. My point is that I can make it slightly more complicated for you to sniff around in my data, and that was the whole point of this move. If more people do this, it will get progressively harder for you to do your mass surveillance job as you do it now. I'm sorry I had to leave you, cpbotha
- josefresco 13y ago
  If you think the USA is alone in their desire to surveille you're going to have a rough time around the world. The USA had the means, but the will is there worldwide.
  - einhverfr 13y ago
    This is true, but outside of the US, China, and probably Europe, few countries' governments have the money to do this or the priorities to do it.

jacquesm 13y ago

Nitpickers aside (yes, what they had they may still have or at least in digest form) this is a single instance of a tidal wave of people doing this. EU datacenters are doing quite well because of the NSA revelations. The economic impact of this could very well counteract any net plus the US had while they were able to spy at will. Likely it's not going to be the same parties that will end up footing the bill. The practical effect from a security point of view of this exodus is likely not very significant, I take it as read that EU pipes & major hubs are also bugged in much the same way, possibly even by the NSA and their friends with tacit approval or blind-eye-turning of local authorities, presumably under some data sharing agreement. Just this morning it was revealed that Belgacom (the Belgian major telco) has concluded that their communications are being spied on and I'm sure that even though the Belgian government is reacting very much upset about this that when the final verdict is in we'll find that that very same government at some level of the bureaucracy knew about this since day one. Plausible deniability will protect those in charge. So, you can move your data around as much as you want, it won't make much more than symbolic difference unless you go to really exotic or lawless places. Maybe Switzerland or Iceland could re-invent themselves as data bastions but that would merely shift the attention to lines running into and out of those places.

DanielBMarkham 13y ago
More to the point, this is a problem of layers. It's not just where you decide to host. Most every national government is probably involved in data sniffing to one degree or another, major hubs are/can be bugged, and undersea fiber connections are especially vulnerable. This, in addition to all of the insecurities found in common consumer gear. There's probably a tidal wave of folks moving, but I agree: the move is nothing more than hugely symbolic. The only thing you might accomplish is change the organization that's capturing your data and perhaps the method. But that's about it.
- mbesto 13y ago
  You can also encrypt the data before it gets to the server by a third-party who holds the key in your own country. (these services do exist btw) The question is then if those companies chose to give up the key to decrypt the information.

pastylegs 13y ago

It's interesting to see people doing this as it's something I've been planning to try. I've backed the Lima project on Kickstarter which will hopefully become my Dropbox replacement: http://www.kickstarter.com/projects/cloud-guys/plug-the-brain-of-your-devices?ref=live http://www.kickstarter.com/projects/cloud-guys/plug-the-brai... and the Mailpile project on Indiegogo which will hopefully work as my email frontend on a local server: http://www.indiegogo.com/projects/mailpile-taking-e-mail-back http://www.indiegogo.com/projects/mailpile-taking-e-mail-bac... I'm planning on buying a small server for running all my services on a VPN (mail server, GitLab, Mailpile etc.) and a decent NAS with RAID'ed backups of server + lima drives + time machine and if possible send that to a safe off-site backup.

cones688 13y ago
I have a HP ProLiant N40L and couldnt recommend it enough.

rsync 13y ago

Obviously we[1] sympathize with this, since we've been running a swiss location since 2006 - one that has become increasingly busy in the last 3-4 months. However, I personally don't store my data there - even though I am deeply disturbed by the recent revelations and invoke all manner of security precautions in my own digital life. First of all, it appears that intra-US Internet traffic is subject to less scrutiny and open to a much more narrow interpretation of the laws that (supposedly) allow this snooping to happen. Once your traffic leaves the US, the 4A (and other) protections seem to relax significantly. Let's set aside for the moment the bad behavior of other global and national "observers" on the network, which we have to assume are at least as bad as the US NSA ... and let's just concern ourselves with the US side of things. From that perspective, moving your traffic out of the US appears to have a lot of unintended consequences. Second, it really shouldn't matter. SSH is SSH and duplicity is duplicity and storing a fragmented TC container is ... well you get the idea. If I have the right toolset[2], I should be able to store my data on a USB stick that I leave in the NSA lobby every night. You should ask yourself how large and unwieldy your digital life has become if you can't just trust the math. Oh, and also ...[3] [1] rsync.net [2] SSL/PKI is not the right toolset. gmail is not the right toolset. Weirdo walled garden dropbox gdrive non-standard private API garbage is not the right toolset. [3] We support synology devices perfectly, right out of the box, and right through their GUI config. Just saying.

MattJ100 13y ago
I have a Synology device (exact same model as the article author actually, and likewise I love it). However I'm having trouble finding a way to back it up securely. The built-in backup methods don't seem to account for encrypting the backups (even if the volume is encrypted). Any suggestions?
- ansible 13y ago
  However I'm having trouble finding a way to back it up securely. The built-in backup methods don't seem to account for encrypting the backups (even if the volume is encrypted). Any suggestions? Two suggestions: A) Download the source [1], and see if it is complete and then you can port in cryptsetup and the LUKS stuff from Linux. B) Run Linux. If you're at the point where you're worried about encrypted backups, then you should probably be running some form of Linux instead. You can get a small form factor PC that includes the motherboard and processor for not much more than the Synology box. That'll give you a lot more options for software and services too. We're using this for all the offsite backup drives, and it wasn't too hard to get going. If you (or anyone reading this) can't figure out cryptsetup, just PM me and I'll help you out. [1] http://sourceforge.net/projects/dsgpl/files/?source=navbar http://sourceforge.net/projects/dsgpl/files/?source=navbar

stef25 13y ago

It's not clear to me if you dropped your gmail address? Running email outside of gmail is easy enough, but changing email address to another domain is a total pain.

cpbotha 13y ago
Fortunately I've been using my own domains on top of gmail for the past few years. I still have my gmail account to see what mail ends up in there (and then notify people), and to use google+ (not going to stop that yet). Already probably about 98% of important mail is going directly to addresses on my own domains.
fphilipe 13y ago
He could have been using Google Apps with a custom domain.
fulafel 13y ago
It' odd that perma-address providers like pobox.com aren't more popular.
- nodata 13y ago
  pobox is US-based.

sneak 13y ago

The problem is that all of your email conversations are with people who still use gmail. Game over.

cpbotha 13y ago
You are correct. However, I am simply taking all MY email out of gmail, so that MY database is not the one that's used to get information about others. Besides this, because I'm not using gmail anymore, I'm using OpenPGP more often to sign and encrypt emails. I agree that it's a drop in the bucket, but it's a drop that I had to add.
frank_boyd 13y ago
> Game over. Never surrender. "Educate" your friends. Provide them with the facts/sources they need so they open their eyes.
icebraining 13y ago
At least you're not informing on other non-Gmail users. http://betabeat.com/2011/12/in-which-eben-moglen-like-legit-yells-at-me-for-being-on-facebook/ http://betabeat.com/2011/12/in-which-eben-moglen-like-legit-...

dshep 13y ago

Can anyone recommend a linux VPS host outside the US as an alternative to Linode or Digitalocean?

bornhuetter 13y ago
I've been using http://www.cheapvps.co.uk/ http://www.cheapvps.co.uk/ for bots and simple websites, and am pretty happy with it. EDIT: as other people pointed out elsewhere, the UK may not be that much better (if at all better) than the US. The question is, though, where is safer?
timw6n 13y ago
http://www.bigv.io/ http://www.bigv.io/ is UK based and seems rather popular.
- sschueller 13y ago
  I think the UK is just as bad as the US when it comes to spying.
- shiven 13y ago
  Why is a US lapdog country like the UK, any better in the context of this post?
tdec 13y ago
You can check out http://www.ovh.com http://www.ovh.com and http://www.hetzner.de http://www.hetzner.de
sdoering 13y ago
If you are speaking German (site is in German) you could try http://uberspace.de http://uberspace.de. I am one happy customer of these guys.
- skrause 13y ago
  I'm also a happy Uberspace user, but they don't offer any VPS. They're more like a standard webhosting provider with shell access.

dutchbrit 13y ago

You forgot the backdoors in your hardware. Yours faithfully, The United States of America

devx 13y ago
Maybe it's time EU, Latin America, and most of the Asian countries start banning US hardware, too - you know, just like US started banning Huawei, for the same reasons.
- GFischer 13y ago
  So, would we use Chinese hardware? It probably has backdoors too.. And at least here in Latin America I believe there aren't enough hardware providers to build anything resembling a modern computer.
  - dingaling 13y ago
    > So, would we use Chinese hardware? It probably has backdoors too.. Indeed, but at least the backdoors aren't used to feed an establishment that has a track record of rendition, UAV assassination and technology-based lethal sabotage.

a3n 13y ago

It's the bottom line that's important. As long as the current surveillance regime is in place, there's nowhere you can be online that isn't watchable by them. The NSA is the largest practitioner and consumer of surveillance among its allies and other targets, and likely drives and influences most surveillance activity among its allies and other targets. The NSA gets its funding from US tax collections, and those taxes are controlled by US politicians. So at the least, non-US citizens and corporations should move their data and activity out of US-controlled or affiliated corporations. There is only one way that this surveillance can be changed at all, and that's by US corporations and their rich executives and shareholders feeling a rumbling in their bottom lines. This will rouse them to direct the recipients of their political and lobbying dollars to cut this shit out. I'm sorry, but we citizens of the US have long lost control of our government. It's money. Vote with your feet. Don't fund the US surveillance state.

einhverfr 13y ago
This is true, but there is also some reason to think that surveillance may be somewhat more difficult if outside the immediate operational reach of the US government. So yes they can listen. But if you make it as hard as you can, you make them spend more effort for less. If we could make the internet run more secure encryption generally, then the NSA, forced to target specific end-points, would howl in frustration....
hershel 13y ago
In most cases I'll agree with you, money controls the us government. In this case thought, the nsa might have secret knowledge on politicians, it's job might be critical to national security or at least seem so, and I bet there's some support from the military industrial complex. It would be quite hard for tech companies fight this fight.
a3n 13y ago
Actually, there's a potential error in what I said. If corporate America benefits from economic espionage (e.g. spying on PetroBras), then it will never stop.

scrrr 13y ago

I suspected there was going to be a mass exodus. NSA basically killed cloud-computing. I don't think it will come back soon. And while on the subject, consider selling your Microsoft stock. How many enterprise customers will choose Microsoft products again after 2013?

jacquesm 13y ago
> NSA basically killed cloud-computing. I don't think the current disgust will last too long. A lot of people will move, at some point they'll realize the grass isn't all that much greener on the other side. There is a definite activation energy required for such a move and I'm sure that the NSA debacle provided just that for a fairly large number of parties but in the very long term the difference will be small. (In the short term it will be quite significant, at least as long as this issue is on the front-burner in the media). The response to things like this is usually an impulse with a strong attenuation over time. It'll never quite become 0 but it will get close to 0 in a fairly short time. The reason why right now we are seeing all this movement is because Glenn Greenwald specifically is doing an extremely good job of keeping the focus on this subject. Mainstream media would normally have completely passed an issue like this by as too technical and not enough human interest to spend a lot of time on (both of those are negatives in a news cycle that thrives on eyeballs and associated advertising). The longer this story is kept in the public eye the bigger the fall-out will be. For now, I'm very impressed with how they are managing this, considering the adversary.
- scrrr 13y ago
  Greenwald somewhere mentioned that there's material for months to come if I am not mistaken. So besides that he's doing a good job (agreed), I think Snowden simply provided a huge amount of information.
  - jbigelow76 13y ago
    If there really is months more worth of information I wonder if the public, US or otherwise (as we find more countries with intelligence agencies working as accessories), will experience outrage fatigue. I guess it will depend on how bad each revelation is but I could easily imagine a lot people picking the one revelation that really bothered them and then framing all others relative to that: "they're doing Y too? What's the point when they are already doing X?" My armchair quarterback opinion, reveal the rest now and hope for a critical mass of outrage.

leokun 13y ago

Just as a thought exercise, this might not be a good trend for US businesses, but perverse reversion of this is that the less foreigners store their data at US companies, the less rational the NSA has to snoop there, meaning we may only have to worry about FBI, DEA, etc and they aren't as sophisticated as the NSA at this. I actually don't have a problem with any of these agencies personally, just a thought.

pekk 13y ago

Technical decision, or just nationalism? Some people never get over old historical issues.

nileshtrivedi 13y ago

I recently deleted my Google+ profile. I have to say that Google is among the nice ones out there. They have a no-nonsense process with tools in place to export the data and delete accounts. Facebook/Quora make it really difficult to delete your data. It's ironic that it's easier to leave the good corporations than the bad ones.

mike-cardwell 13y ago
Was your data actually deleted, or does Google still have it?
- nileshtrivedi 13y ago
  They said that they will delete the data "over a few days". I only deleted my Google+ profile, not the entire Google account and I had manually emptied the profile anyway.
skrause 13y ago
Facebook doesn't really make it difficult either: https://www.facebook.com/help/delete_account https://www.facebook.com/help/delete_account
hoffcoder 13y ago
Since when Quora too make the cut to the baddies?

dirktheman 13y ago

As much as I love Synology NAS, I wouldn't trust it for keeping what's essentially my entire life (email, photos, music, files, everything). The author has a backup system which involves two laptops, a workstation and a separate file drive. However, at the bottom he/she adds "I will probably add an extra external drive to the mix and try to keep that off site." My advice: do it. Now. Murphy's law states that a flood/power surge will hit your house as soon as pull the plug on your external storages. I don't want the NSA to snoop through my email and family photos, but the fear of data loss easily trumps my fear of not having privacy. To me, that's the tradeoff for using public services like dropbox/Gmail: I get more redundancy at the cost of privacy.

moocowduckquack 13y ago
free cloud services!=backup
- dirktheman 13y ago
  No, you're absolutely right. And I didn't state they are, nor that they are free. For backup purposes, I use my NAS, an external hard drive that I use off site, and Amazon Glacier for when things go really bad. (With Glacier, you pay mere pennies for storing gigabytes, but you pay a lot if you ever need the files). What I meant is that the author is so focused on privacy issues that he/she forgets about redundancy.
jlgaddis 13y ago
I currently backup to (encrypted volumes on) external USB drives at home. I just recently moved and now have much more upstream bandwidth (FTTH, yay!) so I wanted to do off-site backups as well. After careful consideration, I decided to occasionally make an "encrypted full backup" and then permanently archive those to Amazon's Glacier service. Edit: Just read your comment further down where you also mention using Glacier. Have you restored any data from it to test it out yet? If so, are you happy with it? Thanks.

nodata 13y ago

dirvish is dead. Use obnam http://liw.fi/obnam/ http://liw.fi/obnam/

peterkelly 13y ago

Actually, your data is still in their building. You've only removed the particular copy that you had access to.

wlj 13y ago

"The loss of GMail conversation view was initially really REALLY painful." I recently experienced the same pain with Thunderbird after moving away from the new Gmail compose interface however I've since moved on to Airmail [1] which deals with conversations (and other Gmail behaviours (shortcuts etc) in a very similar way to Gmail and am extremely happy with the move. [1] http://airmailapp.com http://airmailapp.com

cpbotha 13y ago
Thanks for the tip! I use Linux on all my laptops and workstation, so unfortunately I can't use airmail or postbox (windows + osx) for this.
- takluyver 13y ago
  Geary is a mail client for Linux with a similar interface to conversation view. It's still fairly young, so not entirely polished, but it is usable. Edit: usable, but seemingly with no support for encryption/signing, among various other things. Maybe it needs a bit more time to be ready.

frank_boyd 13y ago

> On my Android telephone (whoops…) I am using the Kaiten IMAP client. Check out: http://www.ubuntu.com/phone http://www.ubuntu.com/phone Devices supported: https://wiki.ubuntu.com/Touch/Devices https://wiki.ubuntu.com/Touch/Devices Currently, the Galaxy Nexus seems to be the best option; see its hardware support progress here: https://docs.google.com/spreadsheet/ccc?key=0ArLs7UPtu-hJdDZDNWliMmV1YUJ3Zk1pQlpDdGp4VFE#gid=0 https://docs.google.com/spreadsheet/ccc?key=0ArLs7UPtu-hJdDZ... (column "Maguro")

ubergesundheit 13y ago
Even better: Firefox OS
- frank_boyd 13y ago
  The only thing I'd miss there is the lack of support for "native apps" (meaning everything runs in the browser). But it's still great to have another open-source mobile OS alternative.

plg 13y ago

"My webhoster (WebFaction) receives mail for all my domains. My Synology retrieves mail every 5 minutes via POP (you can set this up via Roundcube on the Synology) and deletes it from WebFaction." but even if you can delete your mail from your mailhost after downloading it to your private machine, isn't the point that the NSA probably collected the email before it even hit your mailhost?

tokenizer 13y ago
I think you're right. Even moving your mail or web server to another country won't help deter the actual collection with prism. However, I think responses like this create tension between the companies agreeing to give their information, and the government. If google, yahoo, and facebook start to lose money they might potentially fight legislation like this going forward and may advocate in reverting these policies.
- reustle 13y ago
  This is probably the biggest thing we need to work towards. Sure, leaving gmail might be painful and it might not really help us out in the end (regarding preventing spying) but hurting the big players enough for them to move into offense mode is a great scenario.
  - chronolitus 13y ago
    Reading this comment made me feel uneasy, and I couldn't tell why. After giving it some thought, I found the reason. There is nothing wrong with the argument, it is sound logic, and reasonable. In fact, I agree with it. No, this comment made me recoil because for a second, it made me envision a reality where our political influence, as people, can only be exercised through corporations. And, (maybe, I confess, because I am so deep into the lecture of cloud atlas) I can't help but sense that it is a dangerous road to be embarked on. But these are just my two cents...
pja 13y ago
That probably depends on whether your ISP's mailserver uses opportunistic encryption. Any email I send to Google from my mailserver is always sent over a TLS-encrypted connection for instance, because Google's mailservers agree to encrypt where possible. In this scenario, the NSA wiretaps will get direct access to any email sent over unencrypted connections to the ISP mailserver, but they'll have to work harder to get at the encrypted data. Of course, as we know they've suborned the encryption used by many, many organisations so this is no guarantee of protection against an NSA fishing expedition, but it's a lot better than nothing.

educating 13y ago

Great post. Appreciate all of the details of how to leave Google vs just a rant.

blahbl4hblah 13y ago

I think its cute that this guy thinks that running his own gear will keep a nation state out of his email. YET ANOTHER SELF-ABSORBED NSA BLOG POST. I bet in all the ensuing conversation that covered how to use double blind file system encryption an GPG encrypted toast that no one said..."we should get involved in the political process and do something about this!"...because you're stupid and you just want to circle jerk about it...

ianstallings 13y ago

Yeah, because nothing protects you from the NSA like being outside the USA. Edit: Oh I see I've been voted down. I guess that makes my statement untrue.. My point was that outside the USA the NSA has free reign. Only inside the USA does the NSA have restrictions. Obviously they crossed some lines and we are still fighting for privacy around the globe. But moving data outside will not stop them.

zobzu 13y ago

all major nations do exactly the same as the nsa. yes france. yes germany. becauqe theyve not been exposes as publicly does not mean nobody is watching. source: used to work in eu intelligence agencies

mergy 13y ago

This used to be called setting up a mailserver and fileserver back in the day. Some people never gave up the goods and kept their personal files and email accounts on their own hardware.

bayesianhorse 13y ago

I don't believe that there is enough information yet to take action, for example moving data out of US Datacenters. Too little is know about what the NSA is actually doing with the stuff, what they do and don't have access to, and what kind of risks businesses are incurring as a result. The most important question is whether or not the NSA or other agencies in the US are actively committing industrial espionage, meaning not only that they are spying on foreign companies but also passing on data to US competitors.

mcdougle 13y ago

> The loss of GMail conversation view was initially really REALLY painful Considering all the shit going down lately... we've seen a recent surge in use of things like DuckDuckGo and OwnCloud, but no good replacement for the Gmail UI. I'm surprised no one's seen that opportunity and created something similar, but installable on your own personal server so that you can have access to a good web UI from anywhere. If I can make the time, I'd love to do something like this.

flatfilefan 13y ago

The author is an ignorant puppy. [\ad hominem] What's the use of all those spendings if his email is not encrypted and hosted on his own hardened server behind a firewall he knows how to configure himself? And even then, if his counterparts are not doing the same, we're back to the original problem.

chadk 13y ago
> And even then, if his counterparts are not doing the same, we're back to the original problem. Not necessarily. It means he removes the "trove" aspect of his email inbox. Putting together all his communications from the recipients adds to the difficulty (not impossible since "they" have all the metadata and others are probably compromised), but at least he removes the major point of failure.

deleted 13y ago

[deleted]

joshdance 13y ago

The problem is the "normals" don't know the spying is going on, don't know what it means, and don't know how to roll their own solution.

superuser2 13y ago

GCHQ is not exactly any rosier than the NSA. I don't know why OP imagines that WebFaction (UK company) is immune to spying in a way that Google isn't. I'm afraid this will be characteristic of the anticipated mass exodus. People will move away from US services because it makes them feel good, but their destinations are going to be either Five Eyes territory or countries that don't even feel a need to hide their surveillance apparatus.

takluyver 13y ago
At least for e-mail, I think the idea is to ensure that a cloud provider doesn't have a long backlog of his e-mails. Of course, if the NSA take an interest in him, they'll still find a way to monitor his current e-mails, but this makes it harder for them to pull all his past e-mails. I doubt WebFaction is secretly storing all the e-mail he has deleted, because that costs money, and they can't show advertising next to it.
- superuser2 13y ago
  We know that the Five Eyes have ISP-level taps. Why do we think they aren't reading SMTP as it flows across WebFaction's datacenter?
  - takluyver 13y ago
    They are quite probably reading it, and I think I read something about a buffer of a few days that they kept things for. But they're probably not keeping all of everyone's communications in case they want to refer to them in five years time. Whereas on GMail they can dig back through years of old e-mails as well. At the very least, it adds a small per-person cost to their surveillance, because they have to store copies of e-mails themselves rather than getting Google to do it.

gcv 13y ago

All well and good — I suspect that OpenPGP is one of the few reliable tools out there for file and email security — but BitTorrent Sync is closed-source. We have no way of knowing that it doesn't automatically provide copies of all data to interested third parties. Better put those cat pictures in TrueCrypt (another tool which probably works) volumes before syncing them out. (Assuming your hardware doesn't compromise the encryption.)

pinaceae 13y ago

7bn people on earth, but the NSA has a direct interest in cpbotha hence his actions make total sense. because if the US intelligence services took interest in him, moving his data to other servers would totally stop them. i can see the agents shaking their fists at the sky, helplessly staring at the server just beyond their reach. so fulfilling to finally act out those ultimate nerd fantasies. just as awesome as the PGP mail users in college back in the days. sending plain text mails with pgp signatures, because somenone else could forge your identity - riiiiight. i wonder if there is a direct correlation between this mindset and stuff mounted on the belts of said users. giant keyrings, led flashlights, multitools, etc - always prepared for the movie in your head.

speedyrev 13y ago

If your data, encrypted or not, travels through the US or any of it's allies, don't you think they already have access if they want it. Privacy is an illusion.

devx 13y ago

I strongly suggest watching Jakob Appelbaum's speech at the NSA hearing in the European Parliament: https://www.youtube.com/watch?v=Cu6accTBjfs&feature=youtu.be&t=2h23m1s https://www.youtube.com/watch?v=Cu6accTBjfs&feature=youtu.be... Here's a question he asks to people who think that because they're Americans they're "more protected" against NSA spying than foreigners: Who would be me more afraid to call someone like Appelbaum or Julian Assange? Someone from US, or a foreigner? I think everyone knows the answer to that question, and you also have your answer for how protected Americans really are against this total surveillance.

runjake 13y ago

Where are you going to move your data where it's less likely reachable by the NSA and the GCHQ? Another UKUSA member country? Any country in Europe? A third world nation? You're only shifting eyes from western intelligence to a third world dictatorship, or Russia's FAPSI and GRU units. And in some cases, moving your data out of the US may subject it to even more scrutiny or dragnets.

Sami_Lehtinen 13y ago

For me everything was clear before these NSA leaks. That's why I have hosted my own services and servers already for 15 years.