6 ms·

United States of Secrets (Part Two)

109 points by plg 12y ago

plg 12y ago
So in light of this, which BTW is pretty horrendous when one sees it laid out like this, does anyone publish "best practices" for the everyday citizen? Maybe EFF? On the one extreme (my guess: 98% of the population) one shares anything and everything on social networks, no concept of encryption, or VPNs, lots of sensitive info sent unencrypted over email, location-enabled smartphone, etc etc. On the other extreme I guess is the snowden/greenwald approach, only even boot into Tails onto a laptop that has been inspected for mal(hard)ware, only ever use Tor, always use PGP, never unencrypted email, etc. Only problem is that the everyday person cannot interface with the rest of society this way (e.g. their job). So what are suggested best practices? ... and let's be realistic, the everyday person cannot for example host their own email (although I wish the day comes soon when this is possible)
- unreal37 12y ago
  I don't think anyone can use the Internet in any normal way (email, Facebook, Hacker News, CNN.com, anything) without leaving a trail that can be tracked. Anything that can be encrypted must be decrypted at the other end. How can you use Facebook (even as an alias) and avoid revealing your true identity to any of your friends? A strange game. The only winning move is not to play. How about a nice game of chess?
- orionblastar 12y ago
  The everyday citizen is not computer savvy enough to know that the NSA is spying on them or that Windows needs regular security updates and antivirus updates, and that they need to pick a different password than 'password' for their account. Most of them work a job for a greedy employer who gives them a Microsoft Windows PC locked down without administrative access with just the software they need to get their job done. No operating system updates or AV updates for three years and since they don't have admin access they cannot run them. They are stuck with an older Internet Explorer and cannot install a third party web browser that would be more secure and have less exploits and use Adblock or NoScript. Most likely they use XP/Vista/7 in order to run some legacy Windows software, and management does not care about security and has fired all of the competent and experienced IT staff to hire college and high school dropouts to work for a bit over minimum wage to save money and maybe some H1b Visa workers. For the everyday citizen I just point them to this site: https://prism-break.org/en/ https://prism-break.org/en/ But it is completely over their heads to understand it or how to install apps in Windows or even boot a Live Linux CD, and at work their PC is locked down and even if they knew how to do all of that, management would fire them if they did it because management sees making things secure as a waste of productivity. Sure a lot of companies that post at Hacker News here are not everyday citizens, but experienced and competent IT workers and hackers who know security and most likely boot a version of GNU/Linux with the privacy programs already installed. The everyday citizens does not even read HN, because 'Eek hackers, they might give me a virus infection and steal my email account!' because the everyday person is told that 'hackers will infect you with a virus and steal all your data' and then point to an article about Target's POS systems being hacked by viruses, etc. Nope those are 'crackers' and 'black hat' people. 'hackers' on hacker news are 'white hat' people who actually build useful software and operating systems and help people out. Then give you useful advice on security. Even the federal government does not get computer security: http://blogs.computerworld.com/malware-and-vulnerabilities/23490/clueless-federal-governments-cybersecurity-one-giant-hack-me-cluster-flub http://blogs.computerworld.com/malware-and-vulnerabilities/2... Most US corporations and colleges and universities have the same problem as the federal government. They fired anyone who was competent enough to implement a good security policy, and they went with an insecure security policy because it was easier to implement for the everyday person to be able to use their Microsoft Windows PC systems. Heck I've been to some startup dotcom hackathons where they had very poor security and only focused on writing code and storing it on a server with a weak password of 'password' and overloaded the electrical outlets with a couple traps per outlet to power all of the PCs they used to write their code. Violating the fire code, weak security, virus infections, and nobody seemed to care as long as they had the potential to make some new IP and earn some money.
- rdl 12y ago
  For a completely average US citizen, I don't think NSA spying has a practical impact today, at least directly -- it's almost all future risk. It's very serious future risk, that NSA will start to use its capabilities for entirely unlawful and immoral things (political activities, repression) vs. just spying on too many people when going after a smaller number of people. So, the correct thing for average individuals today is to stop this from going farther -- not trying so much to mitigate the effects today. There are two main tools for the individual: politics, and commerce. I'm willing to vote single-issue on reigning in NSA; I'd vote for Brian Schatz or Ted Cruz based on this single issue, even though I hate them otherwise. As for commerce: I'll choose companies which resist spying activities (Google, Twitter, Sonic) over companies which cooperate completely (Telcos, eBay, etc.). (legal challenges kind of fall in between; if I had the resources, I'd certainly fight vs. settle on these issues, individually or as a company, but it's not fair to expect others to do so) If I were a foreigner, I wouldn't be able to directly influence US politics. I would lobby my government to end EU Safe Harbor and any other pressure they can put on the US Government, and to fix my own crazy data retention laws. And I'd probably prefer domestic companies, even when they also spy, just to put pressure on the US.
  - headShrinker 12y ago
    > For a completely average US citizen, I don't think NSA spying has a practical impact today, at least directly -- it's almost all future risk. While I think it's true. The keyword is direct. Though it should be mentioned that indirect impact is measurable, now. > 1 in 6 writers has avoided writing or speaking on a topic they thought would subject them to surveillance. Another 1 in 6 has seriously considered doing so. Source: http://www.pen.org/chilling-effects http://www.pen.org/chilling-effects
    - sroerick 12y ago
      It depends. Do you believe that NSA is stifling citizen activism? If that's the case, than NSA spying affects a large portion of Americans. If that's the case, that would put a dampening effect on democracy, which theoretically affects everyone in the entire system, immediately.
- deleted 12y ago
  [deleted]
- Homunculiheaded 12y ago
  My personal opinion on this issue is that we already have a pretty good sense of public/private spaces in the physical world. The problem is that most people assume that if your computer is in a private space (ie your bedroom) then it is also private. This is obviously not the case. What we need is to start building a culture of online privacy. Everyone should have access to an anonymizing VPN, should know how to use Tor and understand PGP. But just like it would be insane to never leave your bedroom and unlock your door, or always speak in a whisper, the same applies to online privacy. And the important thing is just because you are in your private space doesn't mean you're doing anything wrong or shameful. People use private spaces to snort lines of coke and plan bank robberies, but also just to have some time when they can think and not be bothered... or watched. People need to start using Tor just to browse the web and know they aren't being watched, that neither the government nor advertisers are building a profile on you. And just like physical privacy means less social, so does online. Online privacy should be about keeping anonymous. Don't talk about where you live, what your hobbies are etc. Be conscious of not leaving a trail of personally identifiable information (just like you close the blinds in your bedroom). It's not a question of always watched or always hidden, but being conscious of when we are being watched, and when we are free to say and do as we please.
- higherpurpose 12y ago
  We need popular services to adopt end-to-end encryption, so it's "transparent" to the user and doesn't need to worry about it. Imagine if Gmail adopted the DarkMail protocol by default (or even as an obvious "turn on encryption" option), and Hangouts, Facebook Chat and Whatsapp would adopt Axolotl or OTR. That would be huge for privacy.
plg 12y ago
PS if the link looks strange try http://video.pbs.org/video/2365250130/ http://video.pbs.org/video/2365250130/ (i.e. not https) ironic
- plorg 12y ago
  MP4 video stream, direct from the PBS CDN: [SD] http://ga.video.cdn.pbs.org/videos/frontline/69be704d-8ed9-4ea5-80b9-be79f3e95ab6/133379/hd-mezzanine-16x9/b3fc5ae0_00003212-16x9-mp4-baseline.mp4 http://ga.video.cdn.pbs.org/videos/frontline/69be704d-8ed9-4... [HD] http://ga.video.cdn.pbs.org/videos/frontline/69be704d-8ed9-4ea5-80b9-be79f3e95ab6/133379/hd-mezzanine-16x9/b3fc5ae0_00003212-16x9-mp4-2500k.mp4 http://ga.video.cdn.pbs.org/videos/frontline/69be704d-8ed9-4... (It wasn't working for me, so I played with the Chrome debugger)
  - deleted 12y ago
    [deleted]
  - lorenzhs 12y ago
    Thanks, these work outside the US as well.
  - sitkack 12y ago
    I was getting a 404 on the original link but these still loaded.
- geekam 12y ago
  That loads the page fine but video does not load : "Crossdomain loading denied."
- rdl 12y ago
  I get really bad, out of sync video streaming performance from them (from CloudFront, on Comcast Business 30M); it's weird because it's only an SD stream. (Sad because their content is amazing; I guess I'll find a torrent, although Part 2 isn't up anywhere yet)
  - 12y ago
vinhboy 12y ago
Why do they keep saying that ANY websites can track you through your cookies. They also seem to imply that google purposefully made the PREF cookie so the NSA can use it to track people. If anything, google is a victim themselves here. I love Frontline, but come on, this is just not accurate. Unless a lot of the things I understand about the browser is wrong. Whenever I see inaccuracies in tech reporting, it makes me wonder if there are similar inaccuracies in other fields that I do not recognize because it's not my specialty..
- unreal37 12y ago
  If the NSA can track the request from your browser to the adsense/doubleclick servers, then they can track where you go around large parts of the Internet. I didn't get the sense they were saying the NSA made Google make that cookie. Just that Google was denying that cookie was used for tracking, except 8 years ago when they said it was. I suspect we don't fully understand the level of ability the NSA has to monitor a specific Internet user. It might be accurate to say that, if they want to track you, they will easily know every site you visit surfing around the web due to ad tracking cookies by all the various ad companies. I bet they can tie a Google PREF=ID to you by name and IP address.
  - vinhboy 12y ago
    Yes I understand that. And I agree the NSA is wrong for doing that. But I felt like the show is implying that google is purposefully doing it to allow the NSA to track you. When it seems to me that Google got outsmarted by the NSA.
    - unreal37 12y ago
      I agree that Google was outsmarted by the NSA. I disagree the show was implying otherwise.
    - wordofchristian 12y ago
      Actually the summary of that whole segment seemed to simply be that, 1. google is really good at tracking users 2. NSA became very interested in that fact. 3. NSA piggybacked on Google's tracking without them knowing. I didn't get that they were saying google knew that the tracking cookie was being used in this way. Only that they were setting the example of how best to spy on people.
Create 12y ago
We begin therefore where they are determined not to end, with the question whether any form of democratic self-government, anywhere, is consistent with the kind of massive, pervasive, surveillance into which the Unites States government has led not only us but the world. This should not actually be a complicated inquiry. http://snowdenandthefuture.info/events.html http://snowdenandthefuture.info/events.html
acqq 12y ago
Includes: Soltani: "A Personal Hit on Me" by Google http://video.pbs.org/video/2365249799/ http://video.pbs.org/video/2365249799/

109 points by plg 12y ago

plg 12y ago

So in light of this, which BTW is pretty horrendous when one sees it laid out like this, does anyone publish "best practices" for the everyday citizen? Maybe EFF? On the one extreme (my guess: 98% of the population) one shares anything and everything on social networks, no concept of encryption, or VPNs, lots of sensitive info sent unencrypted over email, location-enabled smartphone, etc etc. On the other extreme I guess is the snowden/greenwald approach, only even boot into Tails onto a laptop that has been inspected for mal(hard)ware, only ever use Tor, always use PGP, never unencrypted email, etc. Only problem is that the everyday person cannot interface with the rest of society this way (e.g. their job). So what are suggested best practices? ... and let's be realistic, the everyday person cannot for example host their own email (although I wish the day comes soon when this is possible)

unreal37 12y ago
I don't think anyone can use the Internet in any normal way (email, Facebook, Hacker News, CNN.com, anything) without leaving a trail that can be tracked. Anything that can be encrypted must be decrypted at the other end. How can you use Facebook (even as an alias) and avoid revealing your true identity to any of your friends? A strange game. The only winning move is not to play. How about a nice game of chess?
orionblastar 12y ago
The everyday citizen is not computer savvy enough to know that the NSA is spying on them or that Windows needs regular security updates and antivirus updates, and that they need to pick a different password than 'password' for their account. Most of them work a job for a greedy employer who gives them a Microsoft Windows PC locked down without administrative access with just the software they need to get their job done. No operating system updates or AV updates for three years and since they don't have admin access they cannot run them. They are stuck with an older Internet Explorer and cannot install a third party web browser that would be more secure and have less exploits and use Adblock or NoScript. Most likely they use XP/Vista/7 in order to run some legacy Windows software, and management does not care about security and has fired all of the competent and experienced IT staff to hire college and high school dropouts to work for a bit over minimum wage to save money and maybe some H1b Visa workers. For the everyday citizen I just point them to this site: https://prism-break.org/en/ https://prism-break.org/en/ But it is completely over their heads to understand it or how to install apps in Windows or even boot a Live Linux CD, and at work their PC is locked down and even if they knew how to do all of that, management would fire them if they did it because management sees making things secure as a waste of productivity. Sure a lot of companies that post at Hacker News here are not everyday citizens, but experienced and competent IT workers and hackers who know security and most likely boot a version of GNU/Linux with the privacy programs already installed. The everyday citizens does not even read HN, because 'Eek hackers, they might give me a virus infection and steal my email account!' because the everyday person is told that 'hackers will infect you with a virus and steal all your data' and then point to an article about Target's POS systems being hacked by viruses, etc. Nope those are 'crackers' and 'black hat' people. 'hackers' on hacker news are 'white hat' people who actually build useful software and operating systems and help people out. Then give you useful advice on security. Even the federal government does not get computer security: http://blogs.computerworld.com/malware-and-vulnerabilities/23490/clueless-federal-governments-cybersecurity-one-giant-hack-me-cluster-flub http://blogs.computerworld.com/malware-and-vulnerabilities/2... Most US corporations and colleges and universities have the same problem as the federal government. They fired anyone who was competent enough to implement a good security policy, and they went with an insecure security policy because it was easier to implement for the everyday person to be able to use their Microsoft Windows PC systems. Heck I've been to some startup dotcom hackathons where they had very poor security and only focused on writing code and storing it on a server with a weak password of 'password' and overloaded the electrical outlets with a couple traps per outlet to power all of the PCs they used to write their code. Violating the fire code, weak security, virus infections, and nobody seemed to care as long as they had the potential to make some new IP and earn some money.
rdl 12y ago
For a completely average US citizen, I don't think NSA spying has a practical impact today, at least directly -- it's almost all future risk. It's very serious future risk, that NSA will start to use its capabilities for entirely unlawful and immoral things (political activities, repression) vs. just spying on too many people when going after a smaller number of people. So, the correct thing for average individuals today is to stop this from going farther -- not trying so much to mitigate the effects today. There are two main tools for the individual: politics, and commerce. I'm willing to vote single-issue on reigning in NSA; I'd vote for Brian Schatz or Ted Cruz based on this single issue, even though I hate them otherwise. As for commerce: I'll choose companies which resist spying activities (Google, Twitter, Sonic) over companies which cooperate completely (Telcos, eBay, etc.). (legal challenges kind of fall in between; if I had the resources, I'd certainly fight vs. settle on these issues, individually or as a company, but it's not fair to expect others to do so) If I were a foreigner, I wouldn't be able to directly influence US politics. I would lobby my government to end EU Safe Harbor and any other pressure they can put on the US Government, and to fix my own crazy data retention laws. And I'd probably prefer domestic companies, even when they also spy, just to put pressure on the US.
- headShrinker 12y ago
  > For a completely average US citizen, I don't think NSA spying has a practical impact today, at least directly -- it's almost all future risk. While I think it's true. The keyword is direct. Though it should be mentioned that indirect impact is measurable, now. > 1 in 6 writers has avoided writing or speaking on a topic they thought would subject them to surveillance. Another 1 in 6 has seriously considered doing so. Source: http://www.pen.org/chilling-effects http://www.pen.org/chilling-effects
  - sroerick 12y ago
    It depends. Do you believe that NSA is stifling citizen activism? If that's the case, than NSA spying affects a large portion of Americans. If that's the case, that would put a dampening effect on democracy, which theoretically affects everyone in the entire system, immediately.
deleted 12y ago
[deleted]
Homunculiheaded 12y ago
My personal opinion on this issue is that we already have a pretty good sense of public/private spaces in the physical world. The problem is that most people assume that if your computer is in a private space (ie your bedroom) then it is also private. This is obviously not the case. What we need is to start building a culture of online privacy. Everyone should have access to an anonymizing VPN, should know how to use Tor and understand PGP. But just like it would be insane to never leave your bedroom and unlock your door, or always speak in a whisper, the same applies to online privacy. And the important thing is just because you are in your private space doesn't mean you're doing anything wrong or shameful. People use private spaces to snort lines of coke and plan bank robberies, but also just to have some time when they can think and not be bothered... or watched. People need to start using Tor just to browse the web and know they aren't being watched, that neither the government nor advertisers are building a profile on you. And just like physical privacy means less social, so does online. Online privacy should be about keeping anonymous. Don't talk about where you live, what your hobbies are etc. Be conscious of not leaving a trail of personally identifiable information (just like you close the blinds in your bedroom). It's not a question of always watched or always hidden, but being conscious of when we are being watched, and when we are free to say and do as we please.
higherpurpose 12y ago
We need popular services to adopt end-to-end encryption, so it's "transparent" to the user and doesn't need to worry about it. Imagine if Gmail adopted the DarkMail protocol by default (or even as an obvious "turn on encryption" option), and Hangouts, Facebook Chat and Whatsapp would adopt Axolotl or OTR. That would be huge for privacy.

plg 12y ago

PS if the link looks strange try http://video.pbs.org/video/2365250130/ http://video.pbs.org/video/2365250130/ (i.e. not https) ironic

plorg 12y ago
MP4 video stream, direct from the PBS CDN: [SD] http://ga.video.cdn.pbs.org/videos/frontline/69be704d-8ed9-4ea5-80b9-be79f3e95ab6/133379/hd-mezzanine-16x9/b3fc5ae0_00003212-16x9-mp4-baseline.mp4 http://ga.video.cdn.pbs.org/videos/frontline/69be704d-8ed9-4... [HD] http://ga.video.cdn.pbs.org/videos/frontline/69be704d-8ed9-4ea5-80b9-be79f3e95ab6/133379/hd-mezzanine-16x9/b3fc5ae0_00003212-16x9-mp4-2500k.mp4 http://ga.video.cdn.pbs.org/videos/frontline/69be704d-8ed9-4... (It wasn't working for me, so I played with the Chrome debugger)
- deleted 12y ago
  [deleted]
- lorenzhs 12y ago
  Thanks, these work outside the US as well.
- sitkack 12y ago
  I was getting a 404 on the original link but these still loaded.
geekam 12y ago
That loads the page fine but video does not load : "Crossdomain loading denied."
rdl 12y ago
I get really bad, out of sync video streaming performance from them (from CloudFront, on Comcast Business 30M); it's weird because it's only an SD stream. (Sad because their content is amazing; I guess I'll find a torrent, although Part 2 isn't up anywhere yet)
- 12y ago

vinhboy 12y ago

Why do they keep saying that ANY websites can track you through your cookies. They also seem to imply that google purposefully made the PREF cookie so the NSA can use it to track people. If anything, google is a victim themselves here. I love Frontline, but come on, this is just not accurate. Unless a lot of the things I understand about the browser is wrong. Whenever I see inaccuracies in tech reporting, it makes me wonder if there are similar inaccuracies in other fields that I do not recognize because it's not my specialty..

unreal37 12y ago
If the NSA can track the request from your browser to the adsense/doubleclick servers, then they can track where you go around large parts of the Internet. I didn't get the sense they were saying the NSA made Google make that cookie. Just that Google was denying that cookie was used for tracking, except 8 years ago when they said it was. I suspect we don't fully understand the level of ability the NSA has to monitor a specific Internet user. It might be accurate to say that, if they want to track you, they will easily know every site you visit surfing around the web due to ad tracking cookies by all the various ad companies. I bet they can tie a Google PREF=ID to you by name and IP address.
- vinhboy 12y ago
  Yes I understand that. And I agree the NSA is wrong for doing that. But I felt like the show is implying that google is purposefully doing it to allow the NSA to track you. When it seems to me that Google got outsmarted by the NSA.
  - unreal37 12y ago
    I agree that Google was outsmarted by the NSA. I disagree the show was implying otherwise.
  - wordofchristian 12y ago
    Actually the summary of that whole segment seemed to simply be that, 1. google is really good at tracking users 2. NSA became very interested in that fact. 3. NSA piggybacked on Google's tracking without them knowing. I didn't get that they were saying google knew that the tracking cookie was being used in this way. Only that they were setting the example of how best to spy on people.

Create 12y ago

We begin therefore where they are determined not to end, with the question whether any form of democratic self-government, anywhere, is consistent with the kind of massive, pervasive, surveillance into which the Unites States government has led not only us but the world. This should not actually be a complicated inquiry. http://snowdenandthefuture.info/events.html http://snowdenandthefuture.info/events.html

acqq 12y ago

Includes: Soltani: "A Personal Hit on Me" by Google http://video.pbs.org/video/2365249799/ http://video.pbs.org/video/2365249799/