13 ms·

> There are of course other avenues available to obtain your data. Our colocation providers could be compelled to give physical access to our servers. Network c

by nullc 13y ago

> There are of course other avenues available to obtain your data. Our colocation providers could be compelled to give physical access to our servers. Network capturing devices could be installed. And in the worst case an attacker could simply force their way into the datacentre and physically remove our servers. > These are not things we can protect against directly but again, we can make it extremely difficult for these things to occur by using strong encryption and careful systems monitoring. Were anything like this ever to happen we would be talking about it very publically. Such an action would not remain secret for long. > Ultimately though, our opinion is that these kinds of attacks are no different to any other hacking attempt. We can and will do everything in our power to make getting unauthorised access to your data as difficult and expensive as possible, but no online service provider can guarantee that it will never happen. This kind of frank disclosure should be highly rewarded. I provided similar frank disclosure text (elsewhere) only to have it whitewashed. When everyone is underplaying the real limitations it's impossible for people to choose alternative tradeoffs— "Why should I use this slightly harder to use crypto thing when foo is already secure?"— because the risks have been misrepresented. Underplaying the limitations also removes the incentives to invent better protection— "Doesn't foo already have perfect security?".

danenania 13y ago
"This kind of frank disclosure should be highly rewarded." Yep, definitely. I think even more important than the information itself is the spirit of honesty and integrity that it demonstrates. This stands in stark contrast to the ambiguous slimeball statements issued by the likes of Google, Facebook, Apple, Microsoft, etc. When Big Brother comes knocking, which companies are going to take a risk to stand up for you? It's as much a question of character as policy.
- annnnd 13y ago
  Note that G, FB, A and MS are not in a position where they can write such disclosure. I am not arguing with your main point, I applaud FastMail for taking a stand - it's just that USA companies must use "ambiguous slimeball statements" to at least appear clean (because they are not). I would argue that if FastMail were an USA company their statements (if any) would be just as ambiguous as those of G, FB, A and MS.
  - danenania 13y ago
    I understand your viewpoint, but I don't accept that as an excuse. Remember how quickly SOPA sank after the Silicon Valley establishment turned against it? Do you think the government is going to put the CEOs of some of America's most popular and profitable companies in jail for an act of civil disobedience that the majority of the country and the world would support wholeheartedly? SV is more powerful than it realizes, and has little to fear in the current climate. The American national security state, on the other hand, is weakened and vulnerable. Now is the time to take a stand. Not doing so is equivalent to complicity.
    - gibwell 13y ago
      SOPA was a single proposed piece of legislation proposed by corporate lobbyists, who are on an essentially level playing field with Silicon Valley. The NSA is a 60 year old spy agency at the heart of the national security infrastructure and government. You are comparing two entirely dissimilar things. Also, how exactly is the American national security state 'weakened and vulnerable'?
      - FBT 13y ago
        At the moment it is weakened and vulnerable compared to how it was a few years ago. It has not been destroyed or dismantled by Snowden's revelations, far from it, but it is a definite factor the NSA cannot ignore. Five years ago, no one would even think of shutting the NSA down over their abominable deeds, because their abominable deeds were not widely known. At the moment, there are many people shouting for them to be shut down. Will it happen? Probably not. But at the moment, that is something for the NSA to worry about and to try to do damage control over. In that sense, they are certainly in a quite worse position.
        shubb 13y ago
        I dunno, if the US government can't figure out if it wants public healthcare by the end of this month, they are gonna have to sell off some of those datacentres to pay the national debt...
- asabjorn 13y ago
  Definitely. I am actually really worried about the effect of NSA Surveillance and data collection on industrial espionage. How does a small and growing company know that a big company/interest group that feels threatened by it won't get access to NSA data on the company by using their connections? If Snowden, an individual contractor, can dive deep into the data how do we know that others are not doing the same for other purposes?
olegp 13y ago
It's nice that they are frank about it, but it is also pretty clear that any company hosting in the US, even if they are based elsewhere, is less of an appealing option to the truly security conscious (or paranoid, depends on how you look at it). Sometimes these aren't necessarily the more technical people either. The problem is that for most services, it is hard to tell where the company is from and where they are hosted, unless you're technical enough to run a traceroute. At StartHQ we've been trying to make that easier to find for non techies and the fact that FastMail host in the US became quickly apparent via their app profile page when we first added it: https://starthq.com/apps/fastmail https://starthq.com/apps/fastmail - there was a pretty lively discussion on FB about it at the time as well.
- pekk 13y ago
  Less of an appealing option where? If I don't trust (say) the Russian government, it is more secure to put my hosting in Russia? Nonsense.
  - olegp 13y ago
    I don't understand what you're trying to say with the Russian example. You can for example trust the Finnish government not to look at your data or let other governments do the same. A number of companies here in Finland are emphasizing that point in their marketing nowadays.
alan_cx 13y ago
"This kind of frank disclosure should be highly rewarded." With all due, Im sorry but, no. Had it come before the Snowden leaks, absolutely. But it didn't. After the event, facing a danger of customer loss or loss of confidence, it can only be seen as too late and defensive move. All these companies must have known something about these risks, yet remained in a passive conspiracy of silence. Not one stood up until Snowden did. By then, too damn late.
- manojlds 13y ago
  So Lavabit should have shutdown before the leaks? What you say may be applicable to the big players, but not to the smaller ones.
- Kudos 13y ago
  Before the Snowden leaks Fastmail was owned by Opera, it has since been bought by Fastmail staff. http://blog.fastmail.fm/2013/09/25/exciting-news-fastmail-staff-purchase-the-business-from-opera/ http://blog.fastmail.fm/2013/09/25/exciting-news-fastmail-st...
- kamjam 13y ago
  How could they have talked about it if they never knew about because they were never in bed with the NSA? You are assuming they were cooperating with the NSA behind the scenes like Google et al, but they are saying they were not and could not be compelled to do so by Australian Law.
acqq 13y ago
The problem of this "disclosure" is that to the people writing the text the implications of Australian laws aren't clear, as seen in other thread here, started by westicle: https://news.ycombinator.com/item?id=6506711 https://news.ycombinator.com/item?id=6506711 In short, don't expect that you can get any advantage from FastMail being Australian company -- you can even be worse off.
aroman 13y ago
I agree that this is a nice gesture, but it's not a "frank disclosure". What did they disclose? When they actually have a security breach and they promptly "[talk] about it very publicly", that will be something commendable. Right now we have words, not actions. Though honestly I'd much rather have such words than not.

by nullc 13y ago

danenania 13y ago

"This kind of frank disclosure should be highly rewarded." Yep, definitely. I think even more important than the information itself is the spirit of honesty and integrity that it demonstrates. This stands in stark contrast to the ambiguous slimeball statements issued by the likes of Google, Facebook, Apple, Microsoft, etc. When Big Brother comes knocking, which companies are going to take a risk to stand up for you? It's as much a question of character as policy.

annnnd 13y ago
Note that G, FB, A and MS are not in a position where they can write such disclosure. I am not arguing with your main point, I applaud FastMail for taking a stand - it's just that USA companies must use "ambiguous slimeball statements" to at least appear clean (because they are not). I would argue that if FastMail were an USA company their statements (if any) would be just as ambiguous as those of G, FB, A and MS.
- danenania 13y ago
  I understand your viewpoint, but I don't accept that as an excuse. Remember how quickly SOPA sank after the Silicon Valley establishment turned against it? Do you think the government is going to put the CEOs of some of America's most popular and profitable companies in jail for an act of civil disobedience that the majority of the country and the world would support wholeheartedly? SV is more powerful than it realizes, and has little to fear in the current climate. The American national security state, on the other hand, is weakened and vulnerable. Now is the time to take a stand. Not doing so is equivalent to complicity.
  - gibwell 13y ago
    SOPA was a single proposed piece of legislation proposed by corporate lobbyists, who are on an essentially level playing field with Silicon Valley. The NSA is a 60 year old spy agency at the heart of the national security infrastructure and government. You are comparing two entirely dissimilar things. Also, how exactly is the American national security state 'weakened and vulnerable'?
    - FBT 13y ago
      At the moment it is weakened and vulnerable compared to how it was a few years ago. It has not been destroyed or dismantled by Snowden's revelations, far from it, but it is a definite factor the NSA cannot ignore. Five years ago, no one would even think of shutting the NSA down over their abominable deeds, because their abominable deeds were not widely known. At the moment, there are many people shouting for them to be shut down. Will it happen? Probably not. But at the moment, that is something for the NSA to worry about and to try to do damage control over. In that sense, they are certainly in a quite worse position.
      - shubb 13y ago
        I dunno, if the US government can't figure out if it wants public healthcare by the end of this month, they are gonna have to sell off some of those datacentres to pay the national debt...
asabjorn 13y ago
Definitely. I am actually really worried about the effect of NSA Surveillance and data collection on industrial espionage. How does a small and growing company know that a big company/interest group that feels threatened by it won't get access to NSA data on the company by using their connections? If Snowden, an individual contractor, can dive deep into the data how do we know that others are not doing the same for other purposes?

olegp 13y ago

It's nice that they are frank about it, but it is also pretty clear that any company hosting in the US, even if they are based elsewhere, is less of an appealing option to the truly security conscious (or paranoid, depends on how you look at it). Sometimes these aren't necessarily the more technical people either. The problem is that for most services, it is hard to tell where the company is from and where they are hosted, unless you're technical enough to run a traceroute. At StartHQ we've been trying to make that easier to find for non techies and the fact that FastMail host in the US became quickly apparent via their app profile page when we first added it: https://starthq.com/apps/fastmail https://starthq.com/apps/fastmail - there was a pretty lively discussion on FB about it at the time as well.

pekk 13y ago
Less of an appealing option where? If I don't trust (say) the Russian government, it is more secure to put my hosting in Russia? Nonsense.
- olegp 13y ago
  I don't understand what you're trying to say with the Russian example. You can for example trust the Finnish government not to look at your data or let other governments do the same. A number of companies here in Finland are emphasizing that point in their marketing nowadays.

alan_cx 13y ago

"This kind of frank disclosure should be highly rewarded." With all due, Im sorry but, no. Had it come before the Snowden leaks, absolutely. But it didn't. After the event, facing a danger of customer loss or loss of confidence, it can only be seen as too late and defensive move. All these companies must have known something about these risks, yet remained in a passive conspiracy of silence. Not one stood up until Snowden did. By then, too damn late.

manojlds 13y ago
So Lavabit should have shutdown before the leaks? What you say may be applicable to the big players, but not to the smaller ones.
Kudos 13y ago
Before the Snowden leaks Fastmail was owned by Opera, it has since been bought by Fastmail staff. http://blog.fastmail.fm/2013/09/25/exciting-news-fastmail-staff-purchase-the-business-from-opera/ http://blog.fastmail.fm/2013/09/25/exciting-news-fastmail-st...
kamjam 13y ago
How could they have talked about it if they never knew about because they were never in bed with the NSA? You are assuming they were cooperating with the NSA behind the scenes like Google et al, but they are saying they were not and could not be compelled to do so by Australian Law.

acqq 13y ago

The problem of this "disclosure" is that to the people writing the text the implications of Australian laws aren't clear, as seen in other thread here, started by westicle: https://news.ycombinator.com/item?id=6506711 https://news.ycombinator.com/item?id=6506711 In short, don't expect that you can get any advantage from FastMail being Australian company -- you can even be worse off.

aroman 13y ago

I agree that this is a nice gesture, but it's not a "frank disclosure". What did they disclose? When they actually have a security breach and they promptly "[talk] about it very publicly", that will be something commendable. Right now we have words, not actions. Though honestly I'd much rather have such words than not.