11 ms·

At the RSA Security Conference, Things Get Testy

101 points by gregcohn 13y ago

diminoten 13y ago
It's over, isn't it? Let's just be honest with ourselves for a moment - privacy is dead. The steps one would have to take in order to remain anonymous today are on the level of complete and utter self-ostracization. Not even hyperbolically, not even metaphorically, literally every significant thing a person does each and every day is determinable through the analysis of data that gets generated by said act. It's too late, we can't unwind this clock. So what now? I feel like everyone's trying to unbreak the glass, unring the bell, whatever metaphor you'd like, but no one's trying to think of how to live in this world. What does a person do, when everything there is to do leaves a trace, and the rules for what is and isn't acceptable behavior are constantly in wild flux?
- adamnemecek 13y ago
  Sounds pretty defeatist.
  - diminoten 13y ago
    Because privacy has been defeated. The question isn't "what can we do to get our privacy back?", the question is, "what do we do now that we've lost our privacy?"
    - higherpurpose 13y ago
      I don't think that's what he was trying to say. He meant your message is "just give up". I didn't see anything in your post about "what do we do now that privacy was defeated". You just said "give up everyone. Stop trying to make privacy happen". There's a difference there.
    - jodrellblank 13y ago
      How many options are there, once you de-facto exclude getting it back? Well ... you live without it. Ordinary people have been living under the whims of capricious deities from thousands of years. It doesn't really matter if you believe in deities directly, it may as well be natural disasters, cruel landlords, plagues of locusts, drought/weather, mob bosses, as the whims of the spirits, so what you do is just carry on living.
- atmosx 13y ago
  We fight at the only ground it ever mattered: Politics!!! We put privacy on the forefront of the agendas of our MPs. We become more active in the democratic process than before. Fighting organizations with larger amount of money that we will ever have, was always a dead end. You can't fight fire with fire. If you create a new powerful encryption tool, you're starting an decryption race from Americans, Chinese, Russians and who-ever-has the power to pursuit it. If they can't break it, they will try to bend it, etc. So the only thing that was ever going to work, is to held them accountable. Make Keith Alexander and the others who made unwarranted mass surveillance possible, accountable. Press towards that direction. Snowden gave a huge leap towards that direction to the masses. He managed to stir discussion to topics that were never discussed before. All we need to do is let our MPs know that privacy matters, for our own good. And by "we" I mean the entire technology community. Fighting for privacy on the front of politics is the only meaningful way. And once again, only through education people can reach enlightenment.
  - diminoten 13y ago
    Politics is the answer I expected and the answer I fully, completely, and entirely reject. The EFF, IDL, and other technology advocacy groups are terrible at getting legislation passed in the US. Just plain awful. The only thing they can do effectively is say no. This is exactly the kind of response I'm talking about when I say, "unring the bell". Our lives are out there, already. You, me, anyone with a Facebook account, an email address, a cell phone - we're exposed, and the options before us are to either eschew all technology entirely, or to figure out how to live without privacy. The ability to track the movements and activities of everyone in the world is the kind of tool that sits on the same level as nuclear weapons, as jet engines, as automatic weapons. We're never going to experience a world where systemic and universal surveillance is not happening again. The question I think we should start asking ourselves is, how do we live in this world?
    - atmosx 13y ago
      EFF and IDL are terrible because they don't have money to lobby, neither do you (I assume) and the industry that does, want's possibly even less privacy (Faceboo, Google, Twitter, FourSquare, etc). The thing is that I don't want to erase or use a fake name in my StackOverflow or Twitter account. I know perfectly well that at any time my data could be exploited by a third party. That's why I'm saying that the only way to get over this, is to make large part of the population aware of the issue. And the more people use the internet the easier will become. You can reject it, but in a democratic country that's the way things work: Politicians want (and sell themselves easily) for more votes. Exchange your vote for privacy, the administration might want to control our lives using espionage, but if MPs don't get votes they can't support the administration and I believe they will turn their back to the administration way more easily if they know that they will gain more votes (more raw power). So all you have to do, is put the issue high on the agenda, nothing more. I'm not saying it's easy, but it's not impossible either. Once an NSA executive goes in jail for mis-conduction will have set a precedent. Same thing will happen in Germany, etc. Then you can say that you are relatively safer because everyone who is going to exploit our data, could face prison. And that's not an entertaining thought, especially for politicians and executives.
- whyme 13y ago
  If culturally we can get to a point where the world denounces privacy breeches and technologically we advance tools to easily expose these breeches, can't we establish some privacy standards and keep them in check? We don't need perfection, we just need to make the cost of privacy breeches high enough and risky enough to create a meaningfull disincentive.
  - diminoten 13y ago
    That world isn't any better in this one, because the data is still there. It's not a breach of privacy if Facebook or Google just knows everything you've done, and you've agreed to it. I think, if given the choice between convenience and privacy, people will pick convenience, and this will never change. That's where we're at, and it's about time we start accepting that fact.
    - whyme 13y ago
      We could create empowerment for the people. I deleted my Facebook account 3 years ago and up until a few months ago I was able to spin up anonymous google accounts when I needed them. Fortunately I have the skills to create Facebook and Google equivalents for both myself and my family. We just need to get more options out there and fragment the industry to the point where data collection becomes difficult again. Plus we need to lower the hurdles to get alternatives up and running. So let's remove the barriers, remove the sign offs and make it really easy for people to find alternatives.
    - eliasmacpherson 13y ago
      My partner won't look at ads on the internet for shoes they like because the ads will follow them a month at least. That's learned behaviour, they aren't particularly tech literate. When people learn how technology works, they work it to their advantage. People are learning their communications and movements are logged permanently. People will learn how to use technology is a way so that this will not happen. Before this thinking was the realm of tin foil hatters - people are paying attention to it now, and are looking around - telegram/textsecure vs whatsapp. I suspect from your defenseless reaction you didn't see the snowden revelations coming. Two years ago nobody would have given three moments notice to facebook acquiring whatsapp. People around me are reacting like so: "I need to stop using whatsapp immediately". This guide is a good place to get started - social technology that doesn't have to leave you completely isolated. (If enough of your friends care about yours and their privacy). http://freedombone.uk.to/ http://freedombone.uk.to/
- higherpurpose 13y ago
  We can change that through technology. I believe Lessig was right when he said "code is law" [1]. That goes for NSA, too -meaning they can do whatever they want as long as they can do it through code. If you read that slowly, you realize that: 1) NSA can do a whole lot right now, regardless of the law, because Internet security is so broken 2) If we do fix Internet security, then they will be very limited - again, regardless of the law. Like take end to end security for example. A judge can request a company to give up the key even to all of their users data - like they did with Lavabit. But if it was true end to end security, with the key on the client's side, there's nothing they could've requested from the company, making FBI and NSA much more limited in the data they can gather. They would basically have to try and tap only the important targets - you know, like they used to. We will fix Internet security, and I'm starting to see a trend already of high quality secure apps that the public could use (compared to before when most were just unusable by normal people), and we're going to see more of it. [1] - http://harvardmagazine.com/2000/01/code-is-law-html http://harvardmagazine.com/2000/01/code-is-law-html
- PavlovsCat 13y ago
  "I've heard quite a lot of people that talk about post-privacy, and they talk about it in terms of feeling like, you know, it's too late, we're done for, there's just no possibility for privacy left anymore and we just have to get used to it. And this is a pretty fascinating thing, because it seems to me that you never hear a feminist say that we're post-consent because there is rape. And why is that? The reason is that it's bullshit." -- Jacob Appelbaum ( http://www.youtube.com/watch?v=Y3h46EbqhPo&t=7m46s http://www.youtube.com/watch?v=Y3h46EbqhPo&t=7m46s )
  - badman_ting 13y ago
    You do hear laments and expressions of despair over the state of things from feminists, though. To claim otherwise would be, well...
- summerdown2 13y ago
  Privacy is impossible for me to implement alone, because I'm just one guy in a room, not able to resist a nation state. But it doesn't have to be that way. What if there was an organisation - let's call them "the NSA" or "GCHQ," whose mission was to ensure the privacy of its citizens? Then we'd get better encryption, stronger tools and we'd have a nation-state on our side fighting all the others. All it takes is a change in the politics.
- dredmorbius 13y ago
  It's over, isn't it? No. It is not. Simply because something is technically possible doesn't mean that it must happen. Simply because a thing does happen doesn't mean it must be allowed. Legal protections can be created. Governments and corporations can be legally obliged to turn over or destroy records. Failure to do so can be subject to audits. The operating presumption is that the surveillance is happening, which should oblige a tremendous benefit of the doubt to anyone challenging or refusing such surveillance. At another level: surveillance countermeasures will become more prevalent and effective. Small-scale tools such as data fuzzers (running a constant set of quasi-random Internet searches and traffic from your IP, generating white noise to frustrate microphones, laser-blinding cameras, whatever). If you've read Neal Stephenson's Diamond Age, the nanobot wars he describes are likely to become a reality -- your own personal defense devices seeking out and destroying surveillance bots. People realizing that a principle of least privilege and of least capability should apply to technologies: "smart paper" may be nifty and keen, but one of the advantages of plain old dumb paper is that it's not electronic, and doesn't have arbitrary programmatic capabilities. When we've got a record of microprocessor bugs being placed in electric teakettles and irons, the benefits of solid cast-iron cookware or other dumb-as-rocks tools are clear. http://www.ibtimes.com/russia-accuses-china-spying-imported-tea-kettles-irons-1450390 http://www.ibtimes.com/russia-accuses-china-spying-imported-... At the government level, pushing back against elected officials (hey, California, when are you going to dump DiFi?). Massive lawsuits against corporate spies can have similar chilling effects on them, as well as loss-of-business. There remains considerable power in collective action, so long as people are willing to use it.
  - MWil 13y ago
    I asked about and then proposed what you call a data fuzzer about 3 years ago. Instead of not using Facebook, get your computer to use it when you're not and muddy the data collected on you. Friends would know the relevant period to ignore. Same with other sites where user content is allowed. I haven't actually seen a "consumer" data fuzzer though outside of Twitter and Twitch bots.
    - dredmorbius 13y ago
- Zigurd 13y ago
  What's over is US technology exports. It's a big world, and we are not indispensable. We will lose dominance in telecom infrastructure and services because of the NSA.
- jodrellblank 13y ago
  Totally nitpicking for fun here, but literally every significant thing a person does each and every day is determinable through the analysis of data that gets generated by said act. has always been true, just never possible. Criminals always left DNA at crimescenes, even before people knew it existed. In the past if someone dodged work to go to a protest there would be witnesses all along the way - phonecall to work, boss recording them as ill, train passengers seeing them, DNA left on the train, dogs smelling their scent, mud from their home area dropped on the street, coffee shop worker in the city serving them, other protesters seeing them, all sorts of historic record that this happened, and nothing else happened, just no way for humans to pull that together. History only happened one way. The uncertainty about what happened somewhere/somewhen has always been in our understanding, not in the world itself.
- MaysonL 13y ago
  The question will be: is privacy dead for everybody, or just for the 99%?
- tzs 13y ago
  > It's over, isn't it? Let's just be honest with ourselves for a moment - privacy is dead Yes. If not now, it will be. I say this for two reasons. 1. The commercial value in killing privacy is too high. Nearly every company you deal with (and nearly every individual you deal with in matters that concern money) is much better off the more private information they can find out about you. We've grown reliant on email and text messaging, and on social networking, and on internet search, and on internet shopping, so that nearly everything we do is a potential leak of information to some entity that can profit from that information. Almost no one is willing to disentangle themselves from that to the extent that would be necessary to maintain privacy. Some might leave Facebook, or switch from Google to Duck Duck Go, but there are so many ways your privacy gets compromise that plugging one or two holes doesn't really save you. 2. I think that physical threats are going to increase, largely due to technology. Things that currently would take a well organized and well funded terrorist organization are going to eventually be in the reach of your random crazy person. People that nowadays are limited to crude bombs that take out a few people will be able to readily build large bombs that kill dozens or hundreds. I expect home-made biological weapons to become relatively easy at some point, adding a whole new level of destructive capability. I think we'll reach a point where disgruntled ex-employees, disgruntled ex-boyfriends or ex-girlfriends, members of religious and political cults, and the like are killing more people a year than all the major terrorist groups combined can do. Since these attacks will be coming from within, often from people who seem pretty ordinary until they go off the deep end, my guess is that there will be no way to prevent them other than extensive surveillance. Since the above two factors make loss of privacy inevitable in my opinion, I think the focus should be on making sure our information is not misused, rather than trying to stop it from being gathered at all. Take surveillance. I think we need to automate it. Get humans out of the loop. I don't care if AI spies on me, as long as it only alerts humans when it sees me doing something bad (or if it sees that I need aid), and we have sufficient public auditing to ensure this.
deleted 13y ago
[deleted]
alexqgb 13y ago
“When or if the N.S.A. blurs the lines between its defensive and intelligence-gathering roles, and exploits its position of trust within the security community, then that’s a problem.” That's Arthur W. Coviello Jr, RSA's Executive Chairman, who is not doing himself or his company any favors. Seriously, "IF"?! Who does he think he's trying to fool?
naaaaak 13y ago
Around San Francisco this week, some were seen sporting Electronic Frontier Foundation T-shirts featuring a retooled N.S.A. logo with an eagle using its talons to plug into the American telecom network, symbolized by AT&T. Asked about the T-shirts, one AT&T executive, who asked not to be named, said they had a chilling effect. “There are many of us at AT&T who are disturbed by what we’ve been hearing about the N.S.A.,” this person said. “But when you see that,” he said, pointing to the T-shirts, “a conversation becomes impossible.” ---- The conversation became impossible when your company decided to willingly give up everything and anything about its customers for a fee. Were it not for customer apathy, I'd like to think your entire shitty company would have been fucked out of existence by now for what they continue to do. But not really, because your company probably would have just been given a bailout for failing at everything but sucking government dick. Fuck you nameless executive. I wish I could request anonymity as easily as you can. Your shitty company brought this upon itself and there is nothing to discuss until it stops being the NSA's bitch.
- lotsofmangos 13y ago
  About the t-shirts, perhaps that is how Snowden got away with it. He was wearing one of those t-shirts at work, so they were unable to ask him what he was doing due to the impossibility of having a conversation.
  - serf 13y ago
    good point. I think this also highlights a possible solution to the privacy debate. Let's all wear these tshirts, maybe they'll be unable to listen to us.
- lostcolony 13y ago
  Yes. A conversation was possible for the decade before Snowden leaked. Those who could have initiated it, from the government to these companies, did not do so. Bemoaning the inability to have a conversation -now- is really just bemoaning the inability to sweep everything under the rug as people demand substantive change.
higherpurpose 13y ago
> Representative Mike Rogers, Republican of Michigan and the chairman of the House Intelligence Committee, said in an interview that he would spend much of the week meeting with venture capitalists and young entrepreneurs to try to rebuild Silicon Valley’s trust in the intelligence community. How? By lying to them some more? I haven't seen one truth spoken by Mike Rogers about NSA so far. And they thought he's the perfect guy to rebuild trust with Silicon Valley? Do they imagine that if he's the guy that lies the most about NSA, that also means Silicon Valley will buy it? > Thursday but Metreon’s management began to grow concerned after they received calls from RSA’s conference organizers. I don't get it. Why would they care what RSA thinks? Unless they got some calls from some Congressmen/NSA, too? > As one put it, “If you’re not here, you’re shutting yourself out of the conversation, which helps nobody.” To backdoor or not to backdoor. Yeah, that's some conversation. So from all the people who said that, and went to RSA, did they actually "have that conversation"? Or did they just sit quietly in their chairs and waited to be spoonfed some more lies? Something tells me most of those didn't even care if they put a backdoor. They're just there to get more business. From what I hear, RSA didn't even bother to alleviate concerns about their backdoor. Probably because trying to do that would mean admitting to it, and that's rather keep people confused. This way they may get to keep some fans. > “There are many of us at AT&T who are disturbed by what we’ve been hearing about the N.S.A.,” this person said. “But when you see that,” he said, pointing to the T-shirts, “a conversation becomes impossible.” Poor AT&T. People are so unfair to them. I mean so what they let NSA tap into their cables and gave them whatever data they wanted? That doesn't mean people should be mean to them by wearing T-shirts describing exactly what they did. It reminds me of GEMA complaining about Youtube telling its viewers that the videos were taken down by GEMA.
- nitrogen 13y ago
  Both of those quotations refer to "conversation", apparently in an attempt to frame the public discussion in terms of being shut out by the privacy advocates. Where was this "conversation" when the backdoors and exploits were being developed? A victim of a privacy violation doesn't want a "conversation" with the perpetrator -- they want the violation to stop and the perpetrator prosecuted.
ra 13y ago
I seriously hope that this whole episode blows up in the form of an implosion of RSA's top line. That's the only message that will resonate with other NSA conspirateurs and make them think again.
blisterpeanuts 13y ago
The market will solve the problem as it always does. Customers the world over will cease relying on American software and data services, which will cause enough pain in the U.S. that pressure will finally be brought to bear on Congress to act, and the surveillance will be reined in, albeit probably too little too late to lure back much of the business. Ultimately, we'll have a more dispersed and diversified industry with more infrastructure and offices in places that are beyond the reach of government spies. New cryptographic techniques will help protect data, and there will be a new transparency among companies that guarantee data privacy: they'll need to prove it to increasingly skeptical customers. The internet will map around this problem as it always has.
- Zigurd 13y ago
  This is the correct answer. People have made fun of the first steps: the undersea cable that avoids the US, for example. Yeah, yeah, we have multi-billion-dollar titanium submarines to tap that. It's not the first such cable that's significant. It's when the cables to the US don't get replaced it will start to sting. But the real break with the US will happen when you can buy telecom infrastructure and enterprise gear that runs buildable open source software, and when Internet portals start offering secure-by-default communications products like Tox for their customers (or customers adopt such products with or without support from their service providers).
  - gregcohn 13y ago
    An economist would like this answer, but I would like to think a little document called the Constitution could also -- eventually -- put a stop to things.
    - Zigurd 13y ago
      The US government and people seem to be capable of deluding themselves that they are world-class in a wide range of endeavors where they actually rank below relatively poor, relatively new republics like Lithuania. The technology industry, despite being far larger, has been led by the nose by a corrupt old-school rent-seeking content publishing industry. What chance do you give it against the Security State and the revenue gravy train behind it. Nobody fought back. Are there any YC startups making secure services for end-users? As for the Constitution? That's been sidelined. Only the naive think it still offers any protection. There will be no meaningful change until collapse and/or insurrection break the current system. At best we might swerve at the brink.
lotsofmangos 13y ago
Colbert at least ended it in reasonable style... part 1 - https://www.youtube.com/watch?v=f7gGtVScrQo https://www.youtube.com/watch?v=f7gGtVScrQo part 2 - https://www.youtube.com/watch?v=j3QH4d4qNOQ https://www.youtube.com/watch?v=j3QH4d4qNOQ "I'm sure that under enhanced liberty you can have all the privacy that you want, just like under enhanced interrogation you can breathe all the water you want."
cinquemb 13y ago
It seems like the conversation on HN in general oscillates back and forth about fighting fire with fire and not acknowledging there can be many ways to put out a fire... People upset about the corporate-governmental surveillance state ever-present globally want those in power to change without changing their own collective behaviors seems to crowd out any discussion about other ideas that probably would be eaiser/more effective to implement by taking advantage of such realities and less focus on imposing crypto fantasies that go against the flow of current collective human behavior... Here's an idea seldom mentioned here: have you thought about removing the oxygen that enables the fire to burn?
zmanian 13y ago
Restore the Fourth SF participated in the protests with several other organizations. We don't know who the other participants in BULLRUN are. We don't know if companies or standards bodies are compromised from the top down like RSA or the bottom up through subverted employees. It was important to protest RSA because imposing a cost on RSA provides an incentive to companies to resist BULLRUN through stronger internal security and extracting a higher price for C-Level cooperation. - RSA security tried to force some of our members off the public sidewalk. (https://restorethefourthsf.com/rsa-thinks-as-little-of-the-first-amendment-as-they-do-of-the-fourth-amendment/ https://restorethefourthsf.com/rsa-thinks-as-little-of-the-f...) - Most of our volunteers had positive interactions with conference attendees(https://restorethefourthsf.com/the-rsa-conference-protestvolunteer-experiences/ https://restorethefourthsf.com/the-rsa-conference-protestvol...) There were some lovely photos of the event from the independent press. https://secure.flickr.com/photos/ari/tags/rsac/ https://secure.flickr.com/photos/ari/tags/rsac/
- a3n 13y ago
  > imposing a cost on RSA provides an incentive Exactly. And that's the potential effectiveness of boycotting US businesses, and infrastructure like undersea cables. Of course the NSA can get at data almost anywhere in the world. You can't stop their technical ability. But you can hurt US business by not using them. If that loses US business serious money, then the "heavily lobbied" Congress will change the NSA. Harumphs will be heard throughout the halls of Congress.
  - zmanian 13y ago
    Simply raising awareness and suspicion of the American government's attempt to subvert the security features of US products is step in the right direction.
a3n 13y ago
> The organizers of a rival conference, called TrustyCon, which was organized following revelations that RSA had been paid by the N.S.A., said they had spent much of the past weekend persuading executives from the Metreon — another big, downtown center next to the Moscone — not to kick them out of their conference space. The Metreon was set to house the TrustyCon conference on Thursday but Metreon’s management began to grow concerned after they received calls from RSA’s conference organizers. > The RSA organizers warned the Metreon that TrustyCon attendees were arranging a huge boycott on their premises. In the end, the TrustyCon conference was able to proceed Thursday without a hitch. So RSA tried to suppress free speech (which is what TrustyCon amounts to) by planting FUD to kill a business deal (the contract with TrustyCon's venue). Your security dollars at work.
- mwfunk 13y ago
  This is not suppression of free speech (that's a very loaded term). If it was, we never would have heard about this incident in the first place.
  - a3n 13y ago
    "tried to"
a3n 13y ago
> Around San Francisco this week, some were seen sporting Electronic Frontier Foundation T-shirts featuring a retooled N.S.A. logo with an eagle using its talons to plug into the American telecom network, symbolized by AT&T. Asked about the T-shirts, one AT&T executive, who asked not to be named, said they had a chilling effect. > “There are many of us at AT&T who are disturbed by what we’ve been hearing about the N.S.A.,” this person said. “But when you see that,” he said, pointing to the T-shirts, “a conversation becomes impossible.” When you see Person C over there wearing a Tshirt, it makes an easy excuse not to have a conversation with Person B who has nothing to do with the Tshirt.
smoyer 13y ago
Does anyone else see the irony in a politician saying “If you have two different agencies, it becomes a bureaucracy,” Mr. Rogers added. “I think that would be a mistake.”? I think he needs to understand a few things from the constituent's perspective: 1) The government is already too much of a bureaucracy. 2) The NSA is also a bureaucracy ... and doesn't have enough oversight/transparency as it is. 3) He's not really in a position to say what's right since he's part of the problem.
us0r 13y ago
"Let's have a conversation" Keith Alexanders talking points seem to be working just perfectly. Business as usual.
ForHackernews 13y ago
> American officials were quick to rebut the idea that foreign data would be more secure outside American borders. “There’s a big call for data localization,” said Richard A. Clarke, the former United States counterterrorism czar. He pointed to the announcement this week between the European Union and Brazil that they would run a new undersea fiber-optic cable between Brazil and Portugal to thwart American spying. > “First of all, who doesn’t think the U.S. can’t listen in?” Mr. Clarke said. “Could it possibly be that these countries are trying to take business away from U.S. carriers?” Anyone want to try and parse the double-negatives here? "who doesn’t think the U.S. can’t listen in?" So he's saying, "It's not worth building your own networks, because we'll just tap those too?" Is that the official US government position now?
- dsuth 13y ago
  I guess that would technically mean "Who thinks the US can listen in?", which would mean that he's attempting to downplay the possibility that the US tapping things is a relevant concern, and all these international competitors are just using the NSA as a convenient scapegoat, to drum up business. Which actually makes sense when you consider that he's part of the machine, and just toeing the party line.
alextingle 13y ago
The RSA brand is now irredeemably toxic. End of story.
gregcohn 13y ago
>German executives and intelligence officials called Mr. Snowden a hero and said his disclosures had been a boon for business, as N.S.A. suspicions prompted global companies to look for alternatives to American products and services. I found this tidbit interesting -- the idea that setting aside legalities and popular opinion, NSA policies are having a real (negative) effect on american tech companies.

101 points by gregcohn 13y ago

It's over, isn't it? Let's just be honest with ourselves for a moment - privacy is dead. The steps one would have to take in order to remain anonymous today are on the level of complete and utter self-ostracization. Not even hyperbolically, not even metaphorically, literally every significant thing a person does each and every day is determinable through the analysis of data that gets generated by said act. It's too late, we can't unwind this clock. So what now? I feel like everyone's trying to unbreak the glass, unring the bell, whatever metaphor you'd like, but no one's trying to think of how to live in this world. What does a person do, when everything there is to do leaves a trace, and the rules for what is and isn't acceptable behavior are constantly in wild flux?

adamnemecek 13y ago
Sounds pretty defeatist.
- diminoten 13y ago
  Because privacy has been defeated. The question isn't "what can we do to get our privacy back?", the question is, "what do we do now that we've lost our privacy?"
  - higherpurpose 13y ago
    I don't think that's what he was trying to say. He meant your message is "just give up". I didn't see anything in your post about "what do we do now that privacy was defeated". You just said "give up everyone. Stop trying to make privacy happen". There's a difference there.
  - jodrellblank 13y ago
    How many options are there, once you de-facto exclude getting it back? Well ... you live without it. Ordinary people have been living under the whims of capricious deities from thousands of years. It doesn't really matter if you believe in deities directly, it may as well be natural disasters, cruel landlords, plagues of locusts, drought/weather, mob bosses, as the whims of the spirits, so what you do is just carry on living.
atmosx 13y ago
We fight at the only ground it ever mattered: Politics!!! We put privacy on the forefront of the agendas of our MPs. We become more active in the democratic process than before. Fighting organizations with larger amount of money that we will ever have, was always a dead end. You can't fight fire with fire. If you create a new powerful encryption tool, you're starting an decryption race from Americans, Chinese, Russians and who-ever-has the power to pursuit it. If they can't break it, they will try to bend it, etc. So the only thing that was ever going to work, is to held them accountable. Make Keith Alexander and the others who made unwarranted mass surveillance possible, accountable. Press towards that direction. Snowden gave a huge leap towards that direction to the masses. He managed to stir discussion to topics that were never discussed before. All we need to do is let our MPs know that privacy matters, for our own good. And by "we" I mean the entire technology community. Fighting for privacy on the front of politics is the only meaningful way. And once again, only through education people can reach enlightenment.
- diminoten 13y ago
  Politics is the answer I expected and the answer I fully, completely, and entirely reject. The EFF, IDL, and other technology advocacy groups are terrible at getting legislation passed in the US. Just plain awful. The only thing they can do effectively is say no. This is exactly the kind of response I'm talking about when I say, "unring the bell". Our lives are out there, already. You, me, anyone with a Facebook account, an email address, a cell phone - we're exposed, and the options before us are to either eschew all technology entirely, or to figure out how to live without privacy. The ability to track the movements and activities of everyone in the world is the kind of tool that sits on the same level as nuclear weapons, as jet engines, as automatic weapons. We're never going to experience a world where systemic and universal surveillance is not happening again. The question I think we should start asking ourselves is, how do we live in this world?
  - atmosx 13y ago
    EFF and IDL are terrible because they don't have money to lobby, neither do you (I assume) and the industry that does, want's possibly even less privacy (Faceboo, Google, Twitter, FourSquare, etc). The thing is that I don't want to erase or use a fake name in my StackOverflow or Twitter account. I know perfectly well that at any time my data could be exploited by a third party. That's why I'm saying that the only way to get over this, is to make large part of the population aware of the issue. And the more people use the internet the easier will become. You can reject it, but in a democratic country that's the way things work: Politicians want (and sell themselves easily) for more votes. Exchange your vote for privacy, the administration might want to control our lives using espionage, but if MPs don't get votes they can't support the administration and I believe they will turn their back to the administration way more easily if they know that they will gain more votes (more raw power). So all you have to do, is put the issue high on the agenda, nothing more. I'm not saying it's easy, but it's not impossible either. Once an NSA executive goes in jail for mis-conduction will have set a precedent. Same thing will happen in Germany, etc. Then you can say that you are relatively safer because everyone who is going to exploit our data, could face prison. And that's not an entertaining thought, especially for politicians and executives.
whyme 13y ago
If culturally we can get to a point where the world denounces privacy breeches and technologically we advance tools to easily expose these breeches, can't we establish some privacy standards and keep them in check? We don't need perfection, we just need to make the cost of privacy breeches high enough and risky enough to create a meaningfull disincentive.
- diminoten 13y ago
  That world isn't any better in this one, because the data is still there. It's not a breach of privacy if Facebook or Google just knows everything you've done, and you've agreed to it. I think, if given the choice between convenience and privacy, people will pick convenience, and this will never change. That's where we're at, and it's about time we start accepting that fact.
  - whyme 13y ago
    We could create empowerment for the people. I deleted my Facebook account 3 years ago and up until a few months ago I was able to spin up anonymous google accounts when I needed them. Fortunately I have the skills to create Facebook and Google equivalents for both myself and my family. We just need to get more options out there and fragment the industry to the point where data collection becomes difficult again. Plus we need to lower the hurdles to get alternatives up and running. So let's remove the barriers, remove the sign offs and make it really easy for people to find alternatives.
  - eliasmacpherson 13y ago
    My partner won't look at ads on the internet for shoes they like because the ads will follow them a month at least. That's learned behaviour, they aren't particularly tech literate. When people learn how technology works, they work it to their advantage. People are learning their communications and movements are logged permanently. People will learn how to use technology is a way so that this will not happen. Before this thinking was the realm of tin foil hatters - people are paying attention to it now, and are looking around - telegram/textsecure vs whatsapp. I suspect from your defenseless reaction you didn't see the snowden revelations coming. Two years ago nobody would have given three moments notice to facebook acquiring whatsapp. People around me are reacting like so: "I need to stop using whatsapp immediately". This guide is a good place to get started - social technology that doesn't have to leave you completely isolated. (If enough of your friends care about yours and their privacy). http://freedombone.uk.to/ http://freedombone.uk.to/
higherpurpose 13y ago
We can change that through technology. I believe Lessig was right when he said "code is law" [1]. That goes for NSA, too -meaning they can do whatever they want as long as they can do it through code. If you read that slowly, you realize that: 1) NSA can do a whole lot right now, regardless of the law, because Internet security is so broken 2) If we do fix Internet security, then they will be very limited - again, regardless of the law. Like take end to end security for example. A judge can request a company to give up the key even to all of their users data - like they did with Lavabit. But if it was true end to end security, with the key on the client's side, there's nothing they could've requested from the company, making FBI and NSA much more limited in the data they can gather. They would basically have to try and tap only the important targets - you know, like they used to. We will fix Internet security, and I'm starting to see a trend already of high quality secure apps that the public could use (compared to before when most were just unusable by normal people), and we're going to see more of it. [1] - http://harvardmagazine.com/2000/01/code-is-law-html http://harvardmagazine.com/2000/01/code-is-law-html
PavlovsCat 13y ago
"I've heard quite a lot of people that talk about post-privacy, and they talk about it in terms of feeling like, you know, it's too late, we're done for, there's just no possibility for privacy left anymore and we just have to get used to it. And this is a pretty fascinating thing, because it seems to me that you never hear a feminist say that we're post-consent because there is rape. And why is that? The reason is that it's bullshit." -- Jacob Appelbaum ( http://www.youtube.com/watch?v=Y3h46EbqhPo&t=7m46s http://www.youtube.com/watch?v=Y3h46EbqhPo&t=7m46s )
- badman_ting 13y ago
  You do hear laments and expressions of despair over the state of things from feminists, though. To claim otherwise would be, well...
summerdown2 13y ago
Privacy is impossible for me to implement alone, because I'm just one guy in a room, not able to resist a nation state. But it doesn't have to be that way. What if there was an organisation - let's call them "the NSA" or "GCHQ," whose mission was to ensure the privacy of its citizens? Then we'd get better encryption, stronger tools and we'd have a nation-state on our side fighting all the others. All it takes is a change in the politics.
dredmorbius 13y ago
It's over, isn't it? No. It is not. Simply because something is technically possible doesn't mean that it must happen. Simply because a thing does happen doesn't mean it must be allowed. Legal protections can be created. Governments and corporations can be legally obliged to turn over or destroy records. Failure to do so can be subject to audits. The operating presumption is that the surveillance is happening, which should oblige a tremendous benefit of the doubt to anyone challenging or refusing such surveillance. At another level: surveillance countermeasures will become more prevalent and effective. Small-scale tools such as data fuzzers (running a constant set of quasi-random Internet searches and traffic from your IP, generating white noise to frustrate microphones, laser-blinding cameras, whatever). If you've read Neal Stephenson's Diamond Age, the nanobot wars he describes are likely to become a reality -- your own personal defense devices seeking out and destroying surveillance bots. People realizing that a principle of least privilege and of least capability should apply to technologies: "smart paper" may be nifty and keen, but one of the advantages of plain old dumb paper is that it's not electronic, and doesn't have arbitrary programmatic capabilities. When we've got a record of microprocessor bugs being placed in electric teakettles and irons, the benefits of solid cast-iron cookware or other dumb-as-rocks tools are clear. http://www.ibtimes.com/russia-accuses-china-spying-imported-tea-kettles-irons-1450390 http://www.ibtimes.com/russia-accuses-china-spying-imported-... At the government level, pushing back against elected officials (hey, California, when are you going to dump DiFi?). Massive lawsuits against corporate spies can have similar chilling effects on them, as well as loss-of-business. There remains considerable power in collective action, so long as people are willing to use it.
- MWil 13y ago
  I asked about and then proposed what you call a data fuzzer about 3 years ago. Instead of not using Facebook, get your computer to use it when you're not and muddy the data collected on you. Friends would know the relevant period to ignore. Same with other sites where user content is allowed. I haven't actually seen a "consumer" data fuzzer though outside of Twitter and Twitch bots.
  - dredmorbius 13y ago
Zigurd 13y ago
What's over is US technology exports. It's a big world, and we are not indispensable. We will lose dominance in telecom infrastructure and services because of the NSA.
jodrellblank 13y ago
Totally nitpicking for fun here, but literally every significant thing a person does each and every day is determinable through the analysis of data that gets generated by said act. has always been true, just never possible. Criminals always left DNA at crimescenes, even before people knew it existed. In the past if someone dodged work to go to a protest there would be witnesses all along the way - phonecall to work, boss recording them as ill, train passengers seeing them, DNA left on the train, dogs smelling their scent, mud from their home area dropped on the street, coffee shop worker in the city serving them, other protesters seeing them, all sorts of historic record that this happened, and nothing else happened, just no way for humans to pull that together. History only happened one way. The uncertainty about what happened somewhere/somewhen has always been in our understanding, not in the world itself.
MaysonL 13y ago
The question will be: is privacy dead for everybody, or just for the 99%?
tzs 13y ago
> It's over, isn't it? Let's just be honest with ourselves for a moment - privacy is dead Yes. If not now, it will be. I say this for two reasons. 1. The commercial value in killing privacy is too high. Nearly every company you deal with (and nearly every individual you deal with in matters that concern money) is much better off the more private information they can find out about you. We've grown reliant on email and text messaging, and on social networking, and on internet search, and on internet shopping, so that nearly everything we do is a potential leak of information to some entity that can profit from that information. Almost no one is willing to disentangle themselves from that to the extent that would be necessary to maintain privacy. Some might leave Facebook, or switch from Google to Duck Duck Go, but there are so many ways your privacy gets compromise that plugging one or two holes doesn't really save you. 2. I think that physical threats are going to increase, largely due to technology. Things that currently would take a well organized and well funded terrorist organization are going to eventually be in the reach of your random crazy person. People that nowadays are limited to crude bombs that take out a few people will be able to readily build large bombs that kill dozens or hundreds. I expect home-made biological weapons to become relatively easy at some point, adding a whole new level of destructive capability. I think we'll reach a point where disgruntled ex-employees, disgruntled ex-boyfriends or ex-girlfriends, members of religious and political cults, and the like are killing more people a year than all the major terrorist groups combined can do. Since these attacks will be coming from within, often from people who seem pretty ordinary until they go off the deep end, my guess is that there will be no way to prevent them other than extensive surveillance. Since the above two factors make loss of privacy inevitable in my opinion, I think the focus should be on making sure our information is not misused, rather than trying to stop it from being gathered at all. Take surveillance. I think we need to automate it. Get humans out of the loop. I don't care if AI spies on me, as long as it only alerts humans when it sees me doing something bad (or if it sees that I need aid), and we have sufficient public auditing to ensure this.

deleted 13y ago

[deleted]

alexqgb 13y ago

“When or if the N.S.A. blurs the lines between its defensive and intelligence-gathering roles, and exploits its position of trust within the security community, then that’s a problem.” That's Arthur W. Coviello Jr, RSA's Executive Chairman, who is not doing himself or his company any favors. Seriously, "IF"?! Who does he think he's trying to fool?

naaaaak 13y ago

Around San Francisco this week, some were seen sporting Electronic Frontier Foundation T-shirts featuring a retooled N.S.A. logo with an eagle using its talons to plug into the American telecom network, symbolized by AT&T. Asked about the T-shirts, one AT&T executive, who asked not to be named, said they had a chilling effect. “There are many of us at AT&T who are disturbed by what we’ve been hearing about the N.S.A.,” this person said. “But when you see that,” he said, pointing to the T-shirts, “a conversation becomes impossible.” ---- The conversation became impossible when your company decided to willingly give up everything and anything about its customers for a fee. Were it not for customer apathy, I'd like to think your entire shitty company would have been fucked out of existence by now for what they continue to do. But not really, because your company probably would have just been given a bailout for failing at everything but sucking government dick. Fuck you nameless executive. I wish I could request anonymity as easily as you can. Your shitty company brought this upon itself and there is nothing to discuss until it stops being the NSA's bitch.

lotsofmangos 13y ago
About the t-shirts, perhaps that is how Snowden got away with it. He was wearing one of those t-shirts at work, so they were unable to ask him what he was doing due to the impossibility of having a conversation.
- serf 13y ago
  good point. I think this also highlights a possible solution to the privacy debate. Let's all wear these tshirts, maybe they'll be unable to listen to us.
lostcolony 13y ago
Yes. A conversation was possible for the decade before Snowden leaked. Those who could have initiated it, from the government to these companies, did not do so. Bemoaning the inability to have a conversation -now- is really just bemoaning the inability to sweep everything under the rug as people demand substantive change.

higherpurpose 13y ago

> Representative Mike Rogers, Republican of Michigan and the chairman of the House Intelligence Committee, said in an interview that he would spend much of the week meeting with venture capitalists and young entrepreneurs to try to rebuild Silicon Valley’s trust in the intelligence community. How? By lying to them some more? I haven't seen one truth spoken by Mike Rogers about NSA so far. And they thought he's the perfect guy to rebuild trust with Silicon Valley? Do they imagine that if he's the guy that lies the most about NSA, that also means Silicon Valley will buy it? > Thursday but Metreon’s management began to grow concerned after they received calls from RSA’s conference organizers. I don't get it. Why would they care what RSA thinks? Unless they got some calls from some Congressmen/NSA, too? > As one put it, “If you’re not here, you’re shutting yourself out of the conversation, which helps nobody.” To backdoor or not to backdoor. Yeah, that's some conversation. So from all the people who said that, and went to RSA, did they actually "have that conversation"? Or did they just sit quietly in their chairs and waited to be spoonfed some more lies? Something tells me most of those didn't even care if they put a backdoor. They're just there to get more business. From what I hear, RSA didn't even bother to alleviate concerns about their backdoor. Probably because trying to do that would mean admitting to it, and that's rather keep people confused. This way they may get to keep some fans. > “There are many of us at AT&T who are disturbed by what we’ve been hearing about the N.S.A.,” this person said. “But when you see that,” he said, pointing to the T-shirts, “a conversation becomes impossible.” Poor AT&T. People are so unfair to them. I mean so what they let NSA tap into their cables and gave them whatever data they wanted? That doesn't mean people should be mean to them by wearing T-shirts describing exactly what they did. It reminds me of GEMA complaining about Youtube telling its viewers that the videos were taken down by GEMA.

nitrogen 13y ago
Both of those quotations refer to "conversation", apparently in an attempt to frame the public discussion in terms of being shut out by the privacy advocates. Where was this "conversation" when the backdoors and exploits were being developed? A victim of a privacy violation doesn't want a "conversation" with the perpetrator -- they want the violation to stop and the perpetrator prosecuted.

ra 13y ago

I seriously hope that this whole episode blows up in the form of an implosion of RSA's top line. That's the only message that will resonate with other NSA conspirateurs and make them think again.

blisterpeanuts 13y ago

The market will solve the problem as it always does. Customers the world over will cease relying on American software and data services, which will cause enough pain in the U.S. that pressure will finally be brought to bear on Congress to act, and the surveillance will be reined in, albeit probably too little too late to lure back much of the business. Ultimately, we'll have a more dispersed and diversified industry with more infrastructure and offices in places that are beyond the reach of government spies. New cryptographic techniques will help protect data, and there will be a new transparency among companies that guarantee data privacy: they'll need to prove it to increasingly skeptical customers. The internet will map around this problem as it always has.

Zigurd 13y ago
This is the correct answer. People have made fun of the first steps: the undersea cable that avoids the US, for example. Yeah, yeah, we have multi-billion-dollar titanium submarines to tap that. It's not the first such cable that's significant. It's when the cables to the US don't get replaced it will start to sting. But the real break with the US will happen when you can buy telecom infrastructure and enterprise gear that runs buildable open source software, and when Internet portals start offering secure-by-default communications products like Tox for their customers (or customers adopt such products with or without support from their service providers).
- gregcohn 13y ago
  An economist would like this answer, but I would like to think a little document called the Constitution could also -- eventually -- put a stop to things.
  - Zigurd 13y ago
    The US government and people seem to be capable of deluding themselves that they are world-class in a wide range of endeavors where they actually rank below relatively poor, relatively new republics like Lithuania. The technology industry, despite being far larger, has been led by the nose by a corrupt old-school rent-seeking content publishing industry. What chance do you give it against the Security State and the revenue gravy train behind it. Nobody fought back. Are there any YC startups making secure services for end-users? As for the Constitution? That's been sidelined. Only the naive think it still offers any protection. There will be no meaningful change until collapse and/or insurrection break the current system. At best we might swerve at the brink.

lotsofmangos 13y ago

Colbert at least ended it in reasonable style... part 1 - https://www.youtube.com/watch?v=f7gGtVScrQo https://www.youtube.com/watch?v=f7gGtVScrQo part 2 - https://www.youtube.com/watch?v=j3QH4d4qNOQ https://www.youtube.com/watch?v=j3QH4d4qNOQ "I'm sure that under enhanced liberty you can have all the privacy that you want, just like under enhanced interrogation you can breathe all the water you want."

cinquemb 13y ago

It seems like the conversation on HN in general oscillates back and forth about fighting fire with fire and not acknowledging there can be many ways to put out a fire... People upset about the corporate-governmental surveillance state ever-present globally want those in power to change without changing their own collective behaviors seems to crowd out any discussion about other ideas that probably would be eaiser/more effective to implement by taking advantage of such realities and less focus on imposing crypto fantasies that go against the flow of current collective human behavior... Here's an idea seldom mentioned here: have you thought about removing the oxygen that enables the fire to burn?

zmanian 13y ago

Restore the Fourth SF participated in the protests with several other organizations. We don't know who the other participants in BULLRUN are. We don't know if companies or standards bodies are compromised from the top down like RSA or the bottom up through subverted employees. It was important to protest RSA because imposing a cost on RSA provides an incentive to companies to resist BULLRUN through stronger internal security and extracting a higher price for C-Level cooperation. - RSA security tried to force some of our members off the public sidewalk. (https://restorethefourthsf.com/rsa-thinks-as-little-of-the-first-amendment-as-they-do-of-the-fourth-amendment/ https://restorethefourthsf.com/rsa-thinks-as-little-of-the-f...) - Most of our volunteers had positive interactions with conference attendees(https://restorethefourthsf.com/the-rsa-conference-protestvolunteer-experiences/ https://restorethefourthsf.com/the-rsa-conference-protestvol...) There were some lovely photos of the event from the independent press. https://secure.flickr.com/photos/ari/tags/rsac/ https://secure.flickr.com/photos/ari/tags/rsac/

a3n 13y ago
> imposing a cost on RSA provides an incentive Exactly. And that's the potential effectiveness of boycotting US businesses, and infrastructure like undersea cables. Of course the NSA can get at data almost anywhere in the world. You can't stop their technical ability. But you can hurt US business by not using them. If that loses US business serious money, then the "heavily lobbied" Congress will change the NSA. Harumphs will be heard throughout the halls of Congress.
- zmanian 13y ago
  Simply raising awareness and suspicion of the American government's attempt to subvert the security features of US products is step in the right direction.

a3n 13y ago

> The organizers of a rival conference, called TrustyCon, which was organized following revelations that RSA had been paid by the N.S.A., said they had spent much of the past weekend persuading executives from the Metreon — another big, downtown center next to the Moscone — not to kick them out of their conference space. The Metreon was set to house the TrustyCon conference on Thursday but Metreon’s management began to grow concerned after they received calls from RSA’s conference organizers. > The RSA organizers warned the Metreon that TrustyCon attendees were arranging a huge boycott on their premises. In the end, the TrustyCon conference was able to proceed Thursday without a hitch. So RSA tried to suppress free speech (which is what TrustyCon amounts to) by planting FUD to kill a business deal (the contract with TrustyCon's venue). Your security dollars at work.

mwfunk 13y ago
This is not suppression of free speech (that's a very loaded term). If it was, we never would have heard about this incident in the first place.
- a3n 13y ago
  "tried to"

a3n 13y ago

> Around San Francisco this week, some were seen sporting Electronic Frontier Foundation T-shirts featuring a retooled N.S.A. logo with an eagle using its talons to plug into the American telecom network, symbolized by AT&T. Asked about the T-shirts, one AT&T executive, who asked not to be named, said they had a chilling effect. > “There are many of us at AT&T who are disturbed by what we’ve been hearing about the N.S.A.,” this person said. “But when you see that,” he said, pointing to the T-shirts, “a conversation becomes impossible.” When you see Person C over there wearing a Tshirt, it makes an easy excuse not to have a conversation with Person B who has nothing to do with the Tshirt.

smoyer 13y ago

Does anyone else see the irony in a politician saying “If you have two different agencies, it becomes a bureaucracy,” Mr. Rogers added. “I think that would be a mistake.”? I think he needs to understand a few things from the constituent's perspective: 1) The government is already too much of a bureaucracy. 2) The NSA is also a bureaucracy ... and doesn't have enough oversight/transparency as it is. 3) He's not really in a position to say what's right since he's part of the problem.

us0r 13y ago

"Let's have a conversation" Keith Alexanders talking points seem to be working just perfectly. Business as usual.

ForHackernews 13y ago

> American officials were quick to rebut the idea that foreign data would be more secure outside American borders. “There’s a big call for data localization,” said Richard A. Clarke, the former United States counterterrorism czar. He pointed to the announcement this week between the European Union and Brazil that they would run a new undersea fiber-optic cable between Brazil and Portugal to thwart American spying. > “First of all, who doesn’t think the U.S. can’t listen in?” Mr. Clarke said. “Could it possibly be that these countries are trying to take business away from U.S. carriers?” Anyone want to try and parse the double-negatives here? "who doesn’t think the U.S. can’t listen in?" So he's saying, "It's not worth building your own networks, because we'll just tap those too?" Is that the official US government position now?

dsuth 13y ago
I guess that would technically mean "Who thinks the US can listen in?", which would mean that he's attempting to downplay the possibility that the US tapping things is a relevant concern, and all these international competitors are just using the NSA as a convenient scapegoat, to drum up business. Which actually makes sense when you consider that he's part of the machine, and just toeing the party line.

alextingle 13y ago

The RSA brand is now irredeemably toxic. End of story.

gregcohn 13y ago

>German executives and intelligence officials called Mr. Snowden a hero and said his disclosures had been a boon for business, as N.S.A. suspicions prompted global companies to look for alternatives to American products and services. I found this tidbit interesting -- the idea that setting aside legalities and popular opinion, NSA policies are having a real (negative) effect on american tech companies.