5 ms·

Steps You Can Take Right Now Against Internet Surveillance

124 points by erkose 13y ago

lukeqsee 13y ago
I find it significant they still recommend using Tor even after a seeming exposé a couple weeks back. [1] Is it the fact that some measure of security is better than none or it makes surveillance incrementally harder? [1] http://www.theguardian.com/world/2013/oct/04/tor-attacks-nsa-users-online-anonymity http://www.theguardian.com/world/2013/oct/04/tor-attacks-nsa...
- thex86 13y ago
  Tor is still the best solution for online anonymity, even with the shortcomings it has. (low-latency for one). The exploits were related to the Tor Browser, not the Tor daemon/network.
  - footoverhand 13y ago
    Tor is the lazy man's attempt at anonymity. I wouldn't trust it since it receives the majority of its funding from the US Government, and that government is the reason many are looking for anonymity. For better anonymity, ditch your cell (tracking device) and use open wifi networks, with a fresh MAC address each time (you can't necessarily trust routers at $Coffee_Shop to not identify who you are).
    - thex86 13y ago
      If you think the government is one coherent entity with all of them wanting to become Big Brother, you are wrong. The fact that Tor gets its funding from the US government is irrelevant. The source code is out there for you to see and inspect and has been done so by many researchers from universities around the world. Example: The NIST openly went against NSA.
    - drill_sarge 13y ago
      The more people TOR use, the more secure it becomes. All attacks base on analyzing incoming and outgoing traffic or monitoring nodes which use outdated tor version. And why should be using "open wifi networks" more secure or anonymous? You don't know whos running them and who you can trust. With TOR you could still go over open wifi while having not (or much less) to worry about who may be sniffing on that wifi access point.
  - erkose 13y ago
    I think you mean high latency.
    - thex86 13y ago
      No, I meant low latency because it allows timing analysis if you control the first and the last node.
  - sillysaurus2 13y ago
    Is it possible for the NSA to do timing analysis if they control all internet backbones? They've installed that special room at AT&T to gather traffic. If they do that at enough ISPs would it be possible to reveal all Tor hidden services operating from within the US?
  - efraglebagga 13y ago
    Can someone explain to somewhat of a layman in terms of security/privacy, why isn't there a bigger push to adopt http://www.i2p2.de/ http://www.i2p2.de/ ? Also, how solid is it? I suppose Tor has attracted much more research over the years in comparison.
- rz2k 13y ago
  From a game theory perspective, if an adversary has an effective tool, defeating that tool and creating enough doubt that the adversary no longer uses the tool are equivalent. The major vulnerabilities sound like details of implementation alone. Then there is a difference between the more easily lost privacy and the less easily lost anonymity. Finally, people who are actual experts seem to think it remains a tool for anonymity, and explain why in a credible way.
- mtgx 13y ago
  Yes, the NSA attacks Tor, but the same documents also show they've had very little success, other than the occasional bugs in the Tor browser, and with people not updating those browsers. But other than that, Tor is by far the best thing for your privacy right now.
  - hershel 13y ago
    On the other hand , tor is considered not secure against someone who can wiretap all or most global data(global passive attacker) , and cooperation between NSA and five eyes countries seem to fit the definition. And tor has some weaknesses to active attackers, meaning people who control behavior of many routers, to some extent.I believe there were documents showing the NSA has this capability. But it would be truly helpful to NSA to create the illusion that TOR is cracked. Maybe that's the point of the documents you're talking about.
drill_sarge 13y ago
I am surprised that the EFF is recommending two factor auth instead of avoiding Google, Facebook etc. at all. Also no mention not to use certain proprietary OS. I think this list provides some better overview of alternatives: https://prism-break.org/ https://prism-break.org/
- rcthompson 13y ago
  They're also not recommending air-gapping or converting your home into a Faraday cage. Sarcasm aside, "switching operating systems" and "switching email providers" are not exactly "steps you can take right now" (for values of "you" that include the average computer user). Maybe they're being realistic and trying to give people some low-hanging fruit that they can do to significantly increase their security that require minimal intrusiveness into their daily life and minimal technical knowledge.
  - sigkill 13y ago
    >switching email providers I kind of agree with you here. Especially if it's tied to your identification personally. If you have an X@gmail.com or Y@yahoo.com then you're essentially at their mercy. But if you just buy a domain for 10 bucks a year, you can go to your registrar's page and forward mails from catchalls @FNLN.com to your secret X@gmail.com. If you don't like them, download it to outlook and move on to Y@yahoo.com and change the setting at your host record page. That is literally it. Your cost here to switch is the time it takes to download messages to your computer and close the account, sign up for a new account and redirect your alias to the new account. I would ideally automate step 1 as soon as I have opened an account. You are not 'locked-in' to one provider as your custom domain name becomes an abstraction between your identity to the real world and your storage space/identity to servers. You can change the latter without changing the former. Of course, if you were early enough you could've snagged a Google Apps account, or if you're just entering the scene, you can get a Live Domains account. The only down side is that they don't have catch-alls, so you can have an on the fly email address like hn@FNLN.com for signing up at different websites.
- pgeorgi 13y ago
  I guess this list is aimed at everybody: it can be implemented without breaking too many habits, and with minimal knowledge. Having everyone use SSL is better than nothing (and provides some amount of herd immunity to those that need to hide their communication). Two factor auth protects against a number of threat classes, such as the "local criminal" they mention. People might not care about the NSA, but there are plenty of other reasons to care about security. Right before the list they state that these only provide incremential improvements. The last step might lead people to prism-break at some point (eg. during crypto parties).
deleted 13y ago
[deleted]
- pinwale 13y ago
  Sigh. If you bothered to read the article, then you'd know that it doesn't say anything about donating to the EFF. There isn't even a link in the article to donate. All last point asks is people to support Stop Watching Us rally and other campaigns against bulk spying, run a Tor node, or hold a cryptoparty. Your comments on surveillance tactics/hunger/climate change is just bringing up irrelevant arguments, so I won't address them. P.S. Sorry to go on a rant, but I miss the days when people actually RTFA. (aka never gonna happen).
thomasfromcdnjs 13y ago
Seems like overreaching surveillance will have to go if they keep up with international pressure. http://thecable.foreignpolicy.com/posts/2013/10/24/exclusive_germany_brazil_turn_to_un_to_restrain_american_spies http://thecable.foreignpolicy.com/posts/2013/10/24/exclusive... And also this was quite surprising news to me "After suspected abuses of the USA PATRIOT Act were brought to light in June 2013 with articles about collection of American call records by the NSA and the PRISM program (see 2013 mass surveillance disclosures), Representative Jim Sensenbrenner, Republican of Wisconsin, who introduced the Patriot Act in 2001, said that the National Security Agency overstepped its bounds. He released a statement saying “While I believe the Patriot Act appropriately balanced national security concerns and civil rights, I have always worried about potential abuses.” He added: “Seizing phone records of millions of innocent people is excessive and un-American.”"[1] [1] https://en.wikipedia.org/wiki/Patriot_Act#Controversy https://en.wikipedia.org/wiki/Patriot_Act#Controversy
jarek-foksa 13y ago
> use EFF's HTTPS Everywhere browser addon for Chrome Chrome meets all criteria to be classified as malware software, just because a big name company is behind it doesn't make it any less malicious.
mikro2nd 13y ago
> Turn on two-factor (or two-step) authentication. Google and Gmail has it Only problem being, that involves me handing over my phone number to Google - one personal detail too many, for me.
- pornel 13y ago
  You can also use Google Authenticator app. AFAIR it doesn't associate phone number with your account.
frank_boyd 13y ago
> 1. Use end-to-end encryption. > 2. Encrypt as much communications as you can. http://retroshare.sourceforge.net/ http://retroshare.sourceforge.net/ has got your back.
- drill_sarge 13y ago
  or https://gnunet.org/ https://gnunet.org/
Zecc 13y ago
0. Become a hermit and stop using the internet
j_s 13y ago
'grugq' shares current best practice, and recently stopped by HN when his blog came up for discussion: Anonymity Is Hard https://news.ycombinator.com/item?id=6521517 https://news.ycombinator.com/item?id=6521517 OPSEC for Hackers (video) http://www.youtube.com/watch?v=9XaYdCdwiWU http://www.youtube.com/watch?v=9XaYdCdwiWU
- grugq 13y ago
  ta.
theinterjection 13y ago
Two-factor authentication requires me to give my phone number to the companies whose products I use. That way, my Facebook profile can get associated with the GPS location that my mobile phone may transmit. This does not seem like a good measure for privacy.
darkbot 13y ago
Quit Facebook. Use an alternative, like Diaspora*.
giardini 13y ago
"Cowboy" attempts to somehow outflank the NSA are foolish. Time and resources would be better spent asking voters to shutdown the NSA's illegal collection of information on US citizens (for starters).

124 points by erkose 13y ago

I find it significant they still recommend using Tor even after a seeming exposé a couple weeks back. [1] Is it the fact that some measure of security is better than none or it makes surveillance incrementally harder? [1] http://www.theguardian.com/world/2013/oct/04/tor-attacks-nsa-users-online-anonymity http://www.theguardian.com/world/2013/oct/04/tor-attacks-nsa...

thex86 13y ago
Tor is still the best solution for online anonymity, even with the shortcomings it has. (low-latency for one). The exploits were related to the Tor Browser, not the Tor daemon/network.
- footoverhand 13y ago
  Tor is the lazy man's attempt at anonymity. I wouldn't trust it since it receives the majority of its funding from the US Government, and that government is the reason many are looking for anonymity. For better anonymity, ditch your cell (tracking device) and use open wifi networks, with a fresh MAC address each time (you can't necessarily trust routers at $Coffee_Shop to not identify who you are).
  - thex86 13y ago
    If you think the government is one coherent entity with all of them wanting to become Big Brother, you are wrong. The fact that Tor gets its funding from the US government is irrelevant. The source code is out there for you to see and inspect and has been done so by many researchers from universities around the world. Example: The NIST openly went against NSA.
  - drill_sarge 13y ago
    The more people TOR use, the more secure it becomes. All attacks base on analyzing incoming and outgoing traffic or monitoring nodes which use outdated tor version. And why should be using "open wifi networks" more secure or anonymous? You don't know whos running them and who you can trust. With TOR you could still go over open wifi while having not (or much less) to worry about who may be sniffing on that wifi access point.
- erkose 13y ago
  I think you mean high latency.
  - thex86 13y ago
    No, I meant low latency because it allows timing analysis if you control the first and the last node.
- sillysaurus2 13y ago
  Is it possible for the NSA to do timing analysis if they control all internet backbones? They've installed that special room at AT&T to gather traffic. If they do that at enough ISPs would it be possible to reveal all Tor hidden services operating from within the US?
- efraglebagga 13y ago
  Can someone explain to somewhat of a layman in terms of security/privacy, why isn't there a bigger push to adopt http://www.i2p2.de/ http://www.i2p2.de/ ? Also, how solid is it? I suppose Tor has attracted much more research over the years in comparison.
rz2k 13y ago
From a game theory perspective, if an adversary has an effective tool, defeating that tool and creating enough doubt that the adversary no longer uses the tool are equivalent. The major vulnerabilities sound like details of implementation alone. Then there is a difference between the more easily lost privacy and the less easily lost anonymity. Finally, people who are actual experts seem to think it remains a tool for anonymity, and explain why in a credible way.
mtgx 13y ago
Yes, the NSA attacks Tor, but the same documents also show they've had very little success, other than the occasional bugs in the Tor browser, and with people not updating those browsers. But other than that, Tor is by far the best thing for your privacy right now.
- hershel 13y ago
  On the other hand , tor is considered not secure against someone who can wiretap all or most global data(global passive attacker) , and cooperation between NSA and five eyes countries seem to fit the definition. And tor has some weaknesses to active attackers, meaning people who control behavior of many routers, to some extent.I believe there were documents showing the NSA has this capability. But it would be truly helpful to NSA to create the illusion that TOR is cracked. Maybe that's the point of the documents you're talking about.

drill_sarge 13y ago

I am surprised that the EFF is recommending two factor auth instead of avoiding Google, Facebook etc. at all. Also no mention not to use certain proprietary OS. I think this list provides some better overview of alternatives: https://prism-break.org/ https://prism-break.org/

rcthompson 13y ago
They're also not recommending air-gapping or converting your home into a Faraday cage. Sarcasm aside, "switching operating systems" and "switching email providers" are not exactly "steps you can take right now" (for values of "you" that include the average computer user). Maybe they're being realistic and trying to give people some low-hanging fruit that they can do to significantly increase their security that require minimal intrusiveness into their daily life and minimal technical knowledge.
- sigkill 13y ago
  >switching email providers I kind of agree with you here. Especially if it's tied to your identification personally. If you have an X@gmail.com or Y@yahoo.com then you're essentially at their mercy. But if you just buy a domain for 10 bucks a year, you can go to your registrar's page and forward mails from catchalls @FNLN.com to your secret X@gmail.com. If you don't like them, download it to outlook and move on to Y@yahoo.com and change the setting at your host record page. That is literally it. Your cost here to switch is the time it takes to download messages to your computer and close the account, sign up for a new account and redirect your alias to the new account. I would ideally automate step 1 as soon as I have opened an account. You are not 'locked-in' to one provider as your custom domain name becomes an abstraction between your identity to the real world and your storage space/identity to servers. You can change the latter without changing the former. Of course, if you were early enough you could've snagged a Google Apps account, or if you're just entering the scene, you can get a Live Domains account. The only down side is that they don't have catch-alls, so you can have an on the fly email address like hn@FNLN.com for signing up at different websites.
pgeorgi 13y ago
I guess this list is aimed at everybody: it can be implemented without breaking too many habits, and with minimal knowledge. Having everyone use SSL is better than nothing (and provides some amount of herd immunity to those that need to hide their communication). Two factor auth protects against a number of threat classes, such as the "local criminal" they mention. People might not care about the NSA, but there are plenty of other reasons to care about security. Right before the list they state that these only provide incremential improvements. The last step might lead people to prism-break at some point (eg. during crypto parties).

deleted 13y ago

[deleted]

pinwale 13y ago
Sigh. If you bothered to read the article, then you'd know that it doesn't say anything about donating to the EFF. There isn't even a link in the article to donate. All last point asks is people to support Stop Watching Us rally and other campaigns against bulk spying, run a Tor node, or hold a cryptoparty. Your comments on surveillance tactics/hunger/climate change is just bringing up irrelevant arguments, so I won't address them. P.S. Sorry to go on a rant, but I miss the days when people actually RTFA. (aka never gonna happen).

thomasfromcdnjs 13y ago

Seems like overreaching surveillance will have to go if they keep up with international pressure. http://thecable.foreignpolicy.com/posts/2013/10/24/exclusive_germany_brazil_turn_to_un_to_restrain_american_spies http://thecable.foreignpolicy.com/posts/2013/10/24/exclusive... And also this was quite surprising news to me "After suspected abuses of the USA PATRIOT Act were brought to light in June 2013 with articles about collection of American call records by the NSA and the PRISM program (see 2013 mass surveillance disclosures), Representative Jim Sensenbrenner, Republican of Wisconsin, who introduced the Patriot Act in 2001, said that the National Security Agency overstepped its bounds. He released a statement saying “While I believe the Patriot Act appropriately balanced national security concerns and civil rights, I have always worried about potential abuses.” He added: “Seizing phone records of millions of innocent people is excessive and un-American.”"[1] [1] https://en.wikipedia.org/wiki/Patriot_Act#Controversy https://en.wikipedia.org/wiki/Patriot_Act#Controversy

jarek-foksa 13y ago

> use EFF's HTTPS Everywhere browser addon for Chrome Chrome meets all criteria to be classified as malware software, just because a big name company is behind it doesn't make it any less malicious.

mikro2nd 13y ago

> Turn on two-factor (or two-step) authentication. Google and Gmail has it Only problem being, that involves me handing over my phone number to Google - one personal detail too many, for me.

pornel 13y ago
You can also use Google Authenticator app. AFAIR it doesn't associate phone number with your account.

frank_boyd 13y ago

> 1. Use end-to-end encryption. > 2. Encrypt as much communications as you can. http://retroshare.sourceforge.net/ http://retroshare.sourceforge.net/ has got your back.

drill_sarge 13y ago
or https://gnunet.org/ https://gnunet.org/

Zecc 13y ago

0. Become a hermit and stop using the internet

j_s 13y ago

'grugq' shares current best practice, and recently stopped by HN when his blog came up for discussion: Anonymity Is Hard https://news.ycombinator.com/item?id=6521517 https://news.ycombinator.com/item?id=6521517 OPSEC for Hackers (video) http://www.youtube.com/watch?v=9XaYdCdwiWU http://www.youtube.com/watch?v=9XaYdCdwiWU

grugq 13y ago
ta.

theinterjection 13y ago

Two-factor authentication requires me to give my phone number to the companies whose products I use. That way, my Facebook profile can get associated with the GPS location that my mobile phone may transmit. This does not seem like a good measure for privacy.

darkbot 13y ago

Quit Facebook. Use an alternative, like Diaspora*.

giardini 13y ago

"Cowboy" attempts to somehow outflank the NSA are foolish. Time and resources would be better spent asking voters to shutdown the NSA's illegal collection of information on US citizens (for starters).