7 ms·

Reset the Net Privacy Pack

60 points by sinak 12y ago

Create 12y ago
We begin therefore where they are determined not to end, with the question whether any form of democratic self-government, anywhere, is consistent with the kind of massive, pervasive, surveillance into which the Unites States government has led not only us but the world. This should not actually be a complicated inquiry. http://www.theguardian.com/technology/2014/may/27/-sp-privacy-under-attack-nsa-files-revealed-new-threats-democracy http://www.theguardian.com/technology/2014/may/27/-sp-privac...
- rivd 12y ago
  Kudos for mentioning this article. It is an excellent essay that more people should read.
  - Create 12y ago
    Thank you very much, you made it worth burning all that YC karma. “You can't solve social problems with software.” – Marcus Ranum ps: actually, it is worse: https://www.defcon.org/html/links/dc-archives/dc-18-archive.html#Marlinspike https://www.defcon.org/html/links/dc-archives/dc-18-archive.... http://benjamin.sonntag.fr/Moglen-at-Re-Publica-Freedom-of-thought-requires-free-media http://benjamin.sonntag.fr/Moglen-at-Re-Publica-Freedom-of-t...
furyg3 12y ago
>According to Apple's Legal Process Guidelines, Facetime calls and iMessages are end-to-end encrypted. This is significant, but Textsecure and Redphone are more secure and trustworthy. Yes but they don't exist. TextSecure looks perfect but has been "coming soon to iPhone" for a year. It seems to be a long way off if I look at the GitHub activity (https://github.com/WhisperSystems/TextSecure-iOS https://github.com/WhisperSystems/TextSecure-iOS) I'm not sure why this is, exactly. Maybe there aren't enough iOS developers willing to donate their time to open source projects? A real pity. The only way we have a chance is if the basic tools we use are cross-platform, open-source, and verifiably end-to-end.
- daveid 12y ago
  ChatSecure supports OTR, Xabber supports OTR, Pidgin/Adium too, so there's the multi-platform, open-source, end-to-end texting app. You just need an account on any XMPP server.
  - BillFranklin 12y ago
    Yep, Jabber, ChatStep, Adium, all used by Lavaboom staff. Lavaboom wouldn't be possible without OpenSource. You now have loads of privacy startups building from the groundwork done by OpenSource developers.
  - hnha 12y ago
    OTR only works when both parties are online. Especially with the modern mobile internet, that is something crucial!
- zmanian 12y ago
  The status of TextSecure on iOS is that a new WebSocket based message transport bus needs to be implemented on the server and client side. Text Secure for Android uses Google's Push Messaging Service which queues messages when devices are offline for transport. Apple's push messaging service can't be used in an analogous way because it only delivers the most recent message when a device comes online. You certainly could help with the server side work. Otherwise, the UI, crypto etc... of the iOS app is all done.
  - aw3c2 12y ago
    Is there some site where one can follow rough progress as a non-developer?
Sprint 12y ago
Sure it is for a greater cause, but making people expose their websites' visitors to a third-party is not what I would have expected from a privacy movement. See http://resetthenet.tumblr.com/post/84330794665/the-reset-the-net-splash-screen http://resetthenet.tumblr.com/post/84330794665/the-reset-the... Instead of having a local javascript, they want you to make sure all your visitors load it from members.internetdefenseleague.org or fightforthefuture.github.io The main site is not privacy protecting either. Leaking to Optimizely, Amazon, YouTube, Heroku, Cloudflare, taskforce.is, Typekit.
- ChrisAntaki 12y ago
  > Leaking to Optimizely, Amazon, YouTube, Heroku, Cloudflare, taskforce.is, Typekit Optimizely helps the team at FFTF A/B test wording. I was asking to remove that sooner too, but it adds a lot of value for them, so that stayed. I'm with you there. Amazon Web Services power a lot of the internet. YouTube only gets loaded if a user clicks "Watch Video". Heroku only gets loaded if you submit your email in the top form. Cloudflare helps power a lot of the internet. (HN, for example) Taskforce.is a trusted partner, who offered to lend us Piwik hosting for this project. FFTF is hoping to set up their own server in the future. TypeKit... that's where "Proxima Nova" is served from. The main designer at FFTF, Vasjen, made this awesome design using Proxima Nova and... we just all got attached to that font. I agree though, hosting all of the custom fonts would have rocked. --- The point of the site, isn't to coddle people, and tell them that this little corner of the internet is safe, but not to go anywhere else. Sorry, but the reality is, to attain privacy, users need to take action. Installing the Tor bundle, for instance, which includes NoScript. Ghostery is another good one. Also, when you criticized the usage of AWS, Clouflare, and Heroku... were you making the point that high visibility sites should be self-hosted?
  - aw3c2 12y ago
    > Sorry, but the reality is, to attain privacy, users need to take action. Sadly that is true and sadly that site is part of that problem. I think Sprint's main point was the "please embed our javascript" part though. For what reason is that not meant to be self-hosted?
TheLoneWolfling 12y ago
I have a question: What is the value of encrypted communications when your system is closed and presumably compromised (Windows, iOS, OSX)? Also, why are they suggesting that you write down passwords? For that matter, why passwords at all? Passphrases are easier for people to remember for the same amount of entropy.
- riquito 12y ago
  > Why passwords at all? Passphrases are easier for people to remember for the same amount of entropy. That is true if you compare them directly, but if you have a different pass(word|phrase) for each service it doesn't matter anymore, you can't remember more than a limited number of passphrases (unless you use common and predictable phrases I suppose, but then they're easier to crack).
  - TheLoneWolfling 12y ago
    In which case use a single (long) passphrase for a (n open source) password manager, and generate gibberish for passwords on websites.
- UweSchmidt 12y ago
  My wild guess regarding #1: Crypto is worthless if intelligence agencies of serious/powerful nations (guess: ~20 around the world), top blackhat groups or a small number of people working at the respective software companies are interested in your data. Stealing data from your box through a backdoor might be relatively simple and automated, but it's still an order of magnitude or two harder than just analyzing the plaintext sent to someone's server.
eps 12y ago
Taking bets its a marketing ploy for one listed paid apps. Specifically, telling to enable the two-factor authentication to protect against government snooping makes no sense whatsoever. So this is either just an amateur "OMG, they are spying on us, let's do something secure!!" campaign or it has secondary objectives. My bet is on latter.
eliteraspberrie 12y ago
Wondering why we didn't include (insert app here)? Read our criteria for these recommendations. The page linked for "our criteria" doesn't mention any criteria other than: We need tools that a broad community of experts can get behind. I don't know of a single expert that would recommend Pidgin. I strongly recommend against it, whether you believe you are a "specific target of surveillance" or not.
- ChrisAntaki 12y ago
  What would you say is a better alternative, that supports OTR?
  - eliteraspberrie 12y ago
    Gajim supports OTR with a plugin. Both the client and plugin are written in Python.
- nsmartt 12y ago
  What's your issue with Pidgin?
  - eliteraspberrie 12y ago
    libpurple is 300,000 lines of poorly written C.
joshstrange 12y ago
Forgive if I'm missing something but how does http://masterpasswordapp.com http://masterpasswordapp.com deal with sites password requirements (or rather limitations)?

60 points by sinak 12y ago

We begin therefore where they are determined not to end, with the question whether any form of democratic self-government, anywhere, is consistent with the kind of massive, pervasive, surveillance into which the Unites States government has led not only us but the world. This should not actually be a complicated inquiry. http://www.theguardian.com/technology/2014/may/27/-sp-privacy-under-attack-nsa-files-revealed-new-threats-democracy http://www.theguardian.com/technology/2014/may/27/-sp-privac...

rivd 12y ago
Kudos for mentioning this article. It is an excellent essay that more people should read.
- Create 12y ago
  Thank you very much, you made it worth burning all that YC karma. “You can't solve social problems with software.” – Marcus Ranum ps: actually, it is worse: https://www.defcon.org/html/links/dc-archives/dc-18-archive.html#Marlinspike https://www.defcon.org/html/links/dc-archives/dc-18-archive.... http://benjamin.sonntag.fr/Moglen-at-Re-Publica-Freedom-of-thought-requires-free-media http://benjamin.sonntag.fr/Moglen-at-Re-Publica-Freedom-of-t...

furyg3 12y ago

>According to Apple's Legal Process Guidelines, Facetime calls and iMessages are end-to-end encrypted. This is significant, but Textsecure and Redphone are more secure and trustworthy. Yes but they don't exist. TextSecure looks perfect but has been "coming soon to iPhone" for a year. It seems to be a long way off if I look at the GitHub activity (https://github.com/WhisperSystems/TextSecure-iOS https://github.com/WhisperSystems/TextSecure-iOS) I'm not sure why this is, exactly. Maybe there aren't enough iOS developers willing to donate their time to open source projects? A real pity. The only way we have a chance is if the basic tools we use are cross-platform, open-source, and verifiably end-to-end.

daveid 12y ago
ChatSecure supports OTR, Xabber supports OTR, Pidgin/Adium too, so there's the multi-platform, open-source, end-to-end texting app. You just need an account on any XMPP server.
- BillFranklin 12y ago
  Yep, Jabber, ChatStep, Adium, all used by Lavaboom staff. Lavaboom wouldn't be possible without OpenSource. You now have loads of privacy startups building from the groundwork done by OpenSource developers.
- hnha 12y ago
  OTR only works when both parties are online. Especially with the modern mobile internet, that is something crucial!
zmanian 12y ago
The status of TextSecure on iOS is that a new WebSocket based message transport bus needs to be implemented on the server and client side. Text Secure for Android uses Google's Push Messaging Service which queues messages when devices are offline for transport. Apple's push messaging service can't be used in an analogous way because it only delivers the most recent message when a device comes online. You certainly could help with the server side work. Otherwise, the UI, crypto etc... of the iOS app is all done.
- aw3c2 12y ago
  Is there some site where one can follow rough progress as a non-developer?

Sprint 12y ago

Sure it is for a greater cause, but making people expose their websites' visitors to a third-party is not what I would have expected from a privacy movement. See http://resetthenet.tumblr.com/post/84330794665/the-reset-the-net-splash-screen http://resetthenet.tumblr.com/post/84330794665/the-reset-the... Instead of having a local javascript, they want you to make sure all your visitors load it from members.internetdefenseleague.org or fightforthefuture.github.io The main site is not privacy protecting either. Leaking to Optimizely, Amazon, YouTube, Heroku, Cloudflare, taskforce.is, Typekit.

ChrisAntaki 12y ago
> Leaking to Optimizely, Amazon, YouTube, Heroku, Cloudflare, taskforce.is, Typekit Optimizely helps the team at FFTF A/B test wording. I was asking to remove that sooner too, but it adds a lot of value for them, so that stayed. I'm with you there. Amazon Web Services power a lot of the internet. YouTube only gets loaded if a user clicks "Watch Video". Heroku only gets loaded if you submit your email in the top form. Cloudflare helps power a lot of the internet. (HN, for example) Taskforce.is a trusted partner, who offered to lend us Piwik hosting for this project. FFTF is hoping to set up their own server in the future. TypeKit... that's where "Proxima Nova" is served from. The main designer at FFTF, Vasjen, made this awesome design using Proxima Nova and... we just all got attached to that font. I agree though, hosting all of the custom fonts would have rocked. --- The point of the site, isn't to coddle people, and tell them that this little corner of the internet is safe, but not to go anywhere else. Sorry, but the reality is, to attain privacy, users need to take action. Installing the Tor bundle, for instance, which includes NoScript. Ghostery is another good one. Also, when you criticized the usage of AWS, Clouflare, and Heroku... were you making the point that high visibility sites should be self-hosted?
- aw3c2 12y ago
  > Sorry, but the reality is, to attain privacy, users need to take action. Sadly that is true and sadly that site is part of that problem. I think Sprint's main point was the "please embed our javascript" part though. For what reason is that not meant to be self-hosted?

TheLoneWolfling 12y ago

I have a question: What is the value of encrypted communications when your system is closed and presumably compromised (Windows, iOS, OSX)? Also, why are they suggesting that you write down passwords? For that matter, why passwords at all? Passphrases are easier for people to remember for the same amount of entropy.

riquito 12y ago
> Why passwords at all? Passphrases are easier for people to remember for the same amount of entropy. That is true if you compare them directly, but if you have a different pass(word|phrase) for each service it doesn't matter anymore, you can't remember more than a limited number of passphrases (unless you use common and predictable phrases I suppose, but then they're easier to crack).
- TheLoneWolfling 12y ago
  In which case use a single (long) passphrase for a (n open source) password manager, and generate gibberish for passwords on websites.
UweSchmidt 12y ago
My wild guess regarding #1: Crypto is worthless if intelligence agencies of serious/powerful nations (guess: ~20 around the world), top blackhat groups or a small number of people working at the respective software companies are interested in your data. Stealing data from your box through a backdoor might be relatively simple and automated, but it's still an order of magnitude or two harder than just analyzing the plaintext sent to someone's server.

eps 12y ago

Taking bets its a marketing ploy for one listed paid apps. Specifically, telling to enable the two-factor authentication to protect against government snooping makes no sense whatsoever. So this is either just an amateur "OMG, they are spying on us, let's do something secure!!" campaign or it has secondary objectives. My bet is on latter.

eliteraspberrie 12y ago

Wondering why we didn't include (insert app here)? Read our criteria for these recommendations. The page linked for "our criteria" doesn't mention any criteria other than: We need tools that a broad community of experts can get behind. I don't know of a single expert that would recommend Pidgin. I strongly recommend against it, whether you believe you are a "specific target of surveillance" or not.

ChrisAntaki 12y ago
What would you say is a better alternative, that supports OTR?
- eliteraspberrie 12y ago
  Gajim supports OTR with a plugin. Both the client and plugin are written in Python.
nsmartt 12y ago
What's your issue with Pidgin?
- eliteraspberrie 12y ago
  libpurple is 300,000 lines of poorly written C.

joshstrange 12y ago

Forgive if I'm missing something but how does http://masterpasswordapp.com http://masterpasswordapp.com deal with sites password requirements (or rather limitations)?