9 ms·

Edward Snowden’s Privacy Tips: “Get Rid of Dropbox,” Avoid Facebook and Google

141 points by malditojavi 12y ago

CurtMonash 12y ago
http://www.dbms2.com/2014/09/15/misconceptions-about-privacy-and-surveillance/ http://www.dbms2.com/2014/09/15/misconceptions-about-privacy... While I'm a huge Snowden fan, he's a bit wrong at times about encryption, in that it solves a smaller part of the problem than he sometimes suggests.
- throwawayaway 12y ago
  Is that your blog? I really don't think you've "caught him out" by saying his first paragraph contradicts his second. One paragraph is the present state of affairs, the other suggests future behaviour that can change the present state of affairs. Snowden doesn't have the luxury of communicating with people who have covered their tracks. All of your bullet points thereafter merely describe the present state of affairs and do not in any way contradict the concept of using encryption to change them. It's the defeatist attitude that I find the most defeating about this subject.
- xnull 12y ago
  Dropbox was revealed as a participant of the PRISM program: anything you store there is searchable. The same is true of Facebook and Google and Yahoo, Apple, all cell phone carriers, all internet carriers and other cloud storage companies including Skydrive/Onedrive.
  - skuhn 12y ago
    Dropbox is mentioned in the PRISM slide deck as being a desired participant, not an actual participant. I worked at Dropbox when those slides were released, and none of us on the operations team knew what it could possibly be talking about. Every company that wants to continue to operate in the US has to comply with US government orders, that is just a fact of life. No one in the technology industry is super excited about going to jail or having their equipment seized. But the kind of compliance that PRISM implies is not something that you just sneak in without anyone noticing. There was an internal accounting of every server and network connection -- it would have required a shadow ops team running shadow datacenters to sneak it by us.
    - xnull2guest 12y ago
      > Every company that wants to continue to operate in the US has to comply with US government orders, that is just a fact of life. No one in the technology industry is super excited about going to jail or having their equipment seized I understand this and it is not contrary to my point. I'm actually trying to point out that the companies Snowden mentions have been specifically mentioned by NSA slides/documents and I think this has colored his suggestions. He suggests moving to others - but ultimately anything he suggests will get subverted if enough interesting material gets stored there. Not that that in itself is a reason not to adopt new technologies. > To sneak it by us... They aren't sneaking it by you as a company. They cooperate with the corporation and its internal organizational model to create a solution that fulfills the requirements. Most employees, however, can be blissfully ignorant. I think you overestimate your ability to know such things. I know plenty of Google employees that had no idea about Google's involvement, Facebook employees with no idea about Facebook's involvement, Apple employees with no idea about Apple's involvement and Microsoft employees with no idea about Microsoft involvement. I also work at a large company, and would have thought I would have seen clear indications of PRISM (& other) activity. Unfortunately that is not the case. Condolezza Rice (of all people) joined the board of Dropbox. This is their full time job and their professional expertise. I'm sure that PRISM infrastructure (or beta versions) were accounted for in full. Edit: It's not condusive to conversation to downvote something merely because you disagree with it. The downvote button (and upvote respectively) are for designating whether you believe something is irrelevant to (/contributes to) the topic.
      - skuhn 12y ago
        It's always hard to be absolutely certain about what goes on at a company, but I'm pretty confident about Dropbox not participating in PRISM (defined as a government system that automatically collects considerable data from within a company's private systems). I haven't been at Dropbox for a year now, but for most of the time I was there I was one of only two SREs that ran the production infrastructure. I knew every piece of server hardware in every datacenter, and what services ran on them. It was my job to qualify and deploy hardware, do the systems level automation, and run the user facing frontends. There is literally no way that something like PRISM could be put in place without my knowledge except by what would amount to sabotage. Keep in mind that while Dropbox is large for a startup, it only recently surpassed 1,000 employees (150 when I joined). The vast majority of those people are in customer service, and the number of people with access to production is likely still well under 100. For the first five years of the company's life there was one datacenter manager and network engineer (the same person), one SRE up until I was hired, and so on. In operations, we did more with less. However, this shouldn't make you feel like your data in Dropbox is guaranteed to be safe from prying government eyes. Dropbox can and does comply with government requests -- every company operating in the US does so, or they would not be operating anymore. I agree with your distaste towards Condoleezza Rice joining the board. It doesn't look good, but I also doubt that she has any day-to-day authority or responsibilities whatsoever.
  - lern_too_spel 12y ago
    You left out half a sentence. "Anything you store there is searchable" if the US government has a court order for your data. This has always been the case. Other governments have similar systems for processing data obtained via legal requests, under different names.
    - yuubi 12y ago
      Don't we have some examples of such court orders, basically "Acme Telecom is ORDERED to reveal ALL THE THINGS"?
      - lern_too_spel 12y ago
        PRISM specifically isn't about revealing ALL THE THINGS. The documents reveal it is for ingesting specific users' data.
    - xnull2guest 12y ago
      Right, but the Snowden revelations showed that the FISA court was/is? a rubber stamp circle without any real due process - and in fact they can search the data and afterwards make a request via the FISA court. The data is also collected and stored and processed by algorithms without any court oversight, it is just when they want a contractor to look through the data manually that the minimal paperwork is involved. It would be misleading to include that half sentence without also mentioning this.
      - lern_too_spel 12y ago
        "The data is also collected and stored and processed by algorithms without any court oversight." This is false. PRISM doesn't get any data that wasn't specifically requested with a court order. It sounds like your understanding is still based on Greenwald's original reporting, which has since been shown to be inaccurate.
        xnull2guest 12y ago
        "Collected" legally means looked at by a human. I'm talking about sent to the NSA, processed by algorithms and stored. That's not 'collected'. It's a word game they play. My original assertion stands. And be careful of "not under the PRISM program". The "not this program" has been shown to be false over and over (in spirit) as there are many related programs that do joint work on shared datasets. Regarding Greenwald's reporting, can you link to something comprehensive (and trustworthy) about inaccuracies?
  - newscracker 12y ago
    What's worse with Dropbox is that it deduplicates data across users. So it's really easy for someone who "needs to know" (like the NSA) as well as people who "would like to know" to "takedown" a single user for something and identify every other Dropbox user who has the same content.
film42 12y ago
I won't be getting rid of Dropbox, Google services, or Facebook anytime soon. I disagree with government spying, and would like to see major reform, but (disagreeing with Snowden) I actually have nothing to hide. I'm not excusing the companies that provide data to governments, but I like the services they provide. They solve problems I want solved, so I will continue to use them. Edit: Why all the down votes? If you disagree, let's talk about it.
- deleted 12y ago
  [deleted]
  - film42 12y ago
    I firmly agree with you, these services can seem scary, and we're half way down that slippery slope. But it's hard for myself (the consumer) to leave a service (like dropbox) that makes my life easier. I can manage my own private dropbox like service, but I don't trust myself. Maybe that's even scarier.
    - smtddr 12y ago
      So, I get what you're saying. I have no intention of abandoning Google either. In fact, I still see Google as the good guys as odd as that might be to many people. In the short term I understand what Edward is saying, but I'm about the long-term game. Doesn't matter what trendy tech company has your data. Yesterday it was Yahoo & Myspace. Today it's Google & Facebook, tomorrow who knows... but the one constant in all of this is a corrupt government. I'm only interested in fixing government and fixing(or destroying) the NSA. Avoiding the victims(Google,Facebook,Apple,etc) of bad laws I don't think solves things in the long term. But, if you're an activist planning a revolution or becoming another whistle-blower in the near future... then by all means do what Edward says so you can at least attempt your plan and not get preemptively stopped.
    - takeitawaymike 12y ago
      "But it's hard for myself (the consumer) to leave a service (like dropbox) that makes my life easier." That's nonsensical and a strawman. No one is telling you to stop using such services. Just use an alternative that respects your rights. That's all there is to it.
deleted 12y ago
[deleted]
mark_l_watson 12y ago
I use DropBox and Google Drive a lot, but I have scripts to encrypt data into ZIP files for anything that needs to be protected. It really is not much of a hassle. I have a SpiderOak account, but don't use it as often. Speaking of protecting data: I am surprised at how many companies seem to keep their software in private repositories on github and bitbucket. That seems like a security hole, if software if the core of your business.
- throwawayaway 12y ago
  for a lot of them, it is not "the crown jewels" that they put there.
  - logn 12y ago
    And for others, they'd rather entrust the crown jewels to GitHub than to their rotating cast of employees relying on server closets with unreliable power supplies and lackluster physical security.
    - throwawayaway 12y ago
      ah, so to GitHub's "rotating cast of employees relying on server closets with unreliable power supplies and lackluster physical security". much better! problem solved. not our problem anymore.
      - logn 12y ago
        GitHub does it full-time though. Also, for businesses, it's a real financial concern that it's not their problem anymore. Having someone for you and your customers to sue is a good position to be in and what drives a lot of B2B decisions.
        throwawayaway 12y ago
        I think you would do well to read this before recommending github on that basis then: https://help.github.com/articles/github-terms-of-service/ https://help.github.com/articles/github-terms-of-service/ "You expressly understand and agree that GitHub shall not be liable for any direct, indirect, incidental, special, consequential or exemplary damages, including but not limited to, damages for loss of profits, goodwill, use, data or other intangible losses (even if GitHub has been advised of the possibility of such damages), resulting from: (i) the use or the inability to use the service; (ii) the cost of procurement of substitute goods and services resulting from any goods, data, information or services purchased or obtained or messages received or transactions entered into through or from the service; (iii) unauthorized access to or alteration of your transmissions or data; (iv) statements or conduct of any third-party on the service; (v) or any other matter relating to the service."
lern_too_spel 12y ago
"Even with that encryption, he said law enforcement officials can still ask for warrants that will give them complete access to a suspect’s phone, which will include the key to the encrypted data." What, pray tell, is the mechanism by which the key will be obtained? Snowden is bloviating here.
- nitrogen 12y ago
  If a key is stored on your phone, it can be obtained the same way any other data is obtained. If the key is password protected, a key logger would yield the password. Edit: I forgot to check to whom I replied; "lern_to_spel" shows up on all of the Snowden threads.
  - csandreasen 12y ago
    The keys aren't stored on the phone - that's what's caused all of the recent controversy. A warrant to install a keylogger isn't very useful after the suspect has been taken into custody.
  - lern_too_spel 12y ago
    The key is not stored in the clear, and the device password is entered before a keylogger can run. https://www.eff.org/deeplinks/2014/10/even-golden-key-can-be-stolen-thieves-simple-facts-apples-encryption-decision https://www.eff.org/deeplinks/2014/10/even-golden-key-can-be...
    - xnull 12y ago
      It's called "key escrow" and there are tons of ways to do it. Look up US patents under 380/286 classification.
      - lern_too_spel 12y ago
        I know what key escrow is. Nitrogen didn't claim that Apple does that, and for good reason -- there is absolutely zero evidence that they do.
Selfcommit 12y ago
Does no one else see the irony in Snowden warning everyong to avoid Google.. via a Google+ Hangout?
- sauere 12y ago
  Word. I really feel that a lot of people talking about this whole thing fail to practice what they preach.
  - Havvy 12y ago
    To be honest, he's not looking for privacy for this statement. He's looking for exactly the opposite, so using the thing that doesn't care for privacy doesn't matter for this instance.
- josephlord 12y ago
  If it was something intended to be public there is no harm in Google having it (they will scrape it off the web anyway) as the NSA are welcome to publicly access the content. Most people don't treat Dropbox/Google/Facebook (non-public) usage as being equivalent to CCing the government but maybe they should.
  - XorNot 12y ago
    Pro-tip: anything you put on any service can and probably will at some point scroll past the eyes of a random sysadmin who's debugging why the database keeps crashing under load. Most people are worried about "disclosure" - which is something Uber violated for a PR stunt at a party recently - i.e. we're usually okay wandering past the window naked, because we assume it's extraordinarily unlikely that someone will be pointing a camera at it right then, or that it wouldn't be more embarrassing for them to try and yell "hey that person is naked in the window I saw them!" Conversely, we wouldn't be happy if someone did take photos, then uploaded them to the web, and showed them to all our friends etc. In a practical sense, this is how people act. It's how you have to act - it would be practically neurotic to act any other way.
- Yver 12y ago
deleted 12y ago
[deleted]
vikramsrao 12y ago
If i do all of these how do i share documents or search for information on the web? What ever the alternative is going to have the same issues as Dropbox, Facebook or Google. I cannot build my own versions of these!
- jayd16 12y ago
  You could build your own dropbox. It's not that complex. A social network and a search engine would be a bit harder.
  - vikramsrao 12y ago
    I agree dropbox would be easier of these and i can live without Facebook but definitely not be able to build a google. But more importantly is it worth it? I have a feeling from hardware to layers of software in the tech stack we use is all compromised to give access in one way or the other or they can be cracked brute force with the enormous computing power these organisations have.
  - swartkrans 12y ago
    > You could build your own dropbox. It's not that complex. It would be incredibly complex to build your own Dropbox. Maybe it wouldn't be "complex" to use rsync to automatically copy files over to some other drive if that's all you wanted, but Dropbox does way more than that and I don't plan on dropping Dropbox for some half baked solution that requires more effort to set up, maintenance and ends up in lost data because on the one in a million chance the FBI might want to look at pictures of my pets. I don't know how I feel about government surveillance, but I sure as hell don't see it worth to trade some supposed imperceptible theoretical harm with tons of actual effort and inconvenience.
    - jerf 12y ago
      http://owncloud.org/ http://owncloud.org/ You don't have to write your own Dropbox. You just have to host one. And even beside the question of government surveillance there is the advantage that it is under your control, not somebody else's. File sharing is so generic that the lockin opportunity is less than it is in other domains (like social networking) but there still can be advantage to being the owner and not merely a renter.
rafaqueque 12y ago
What should we use then? If someone tells me to change X program, please, give me alternatives, otherwise, I'll stick with that. PS: Quite ironic to see him saying "get rid of Google", through an Hangouts session.
- te0x 12y ago
  Did you read the article? They talk about an alternative at length.
- patcon 12y ago
  Seafile is great if you dislike SpiderOak's closed-sourceness. Open source android and desktop clients, client-side encryption, can start with a free service then move to self-hosting when you're so inclined. imho, it's the best option until we get a good user-friendly decentralized offering.
- megablast 12y ago
  Everything has to be served on a platter, right?
- icebraining 12y ago
  PS: Quite ironic to see him saying "get rid of Google", through an Hangouts session. It's only ironic if you didn't read the first half of the title. He wasn't looking to keep this call private, was he?
vu3rdd 12y ago
Once again, I would like to recommend Tahoe-LAFS [0] (which anyone can install on their own on their servers or use the paid service from the creators of Tahoe-LAFS [1]). One can even store "shares" securely on Google Drive and Dropbox though it is a bit involved. [0] http://tahoe-lafs.org/ http://tahoe-lafs.org/ [1] https://leastauthority.com/ https://leastauthority.com/
- anonbanker 12y ago
  More importantly, you can host the storage over i2p, or a hybrid of clearnet and darknet. There's even an implement ion of free net over i2p using tahoe-lafs. I have assisted a few people in implementing this for their storage needs. No complaints, either.
- newscracker 12y ago
  Premise: I'm not interested in setting up a server and maintaining it, but I am interested in storing my data on services that can promise, or even better, guarantee, privacy and security. I have looked at Tahoe-LAFS for a few years now, along with the paid service. In my observations over the last few years, the paid service is getting almost zero attention from the creators. Initially they had it at an enormous cost (like $1 per GB per month) compared to other competitors. In the recent times it has moved to other schemes that are still expensive for many people ($25 per month). Their products, or rather services, are rarely updated and remain in the TBA (to be announced) status for far too long while other competitors (the "privacy conscious" ones like SpiderOak that cannot truly guarantee it like Tahoe-LAFS can as well as the "what's privacy?" services like Dropbox, Crashplan, Box, Google, Microsoft and Apple, to name just a few) are moving ahead much faster and bringing down prices. I'm willing to pay a decent enough premium to help privacy guaranteeing services survive and thrive, but this kind of pricing and sluggishness in introducing services from leastauthority.com makes it seem like they don't really want many users to sign up.
vook 12y ago
I can't agree with his logic here : "When you say, ‘I have nothing to hide,’ you’re saying, ‘I don’t care about this right.’" How does he arrive at that conclusion? I have nothing to hide, but I still don't support the violation of these rights. Does he suggest that we instead support some other service or method under the illusion that we are immune from NSA spying?
- philtar 12y ago
  I think it's pretty clear he means people who say "I have nothing to hide. They can look at whatever they want"

141 points by malditojavi 12y ago

http://www.dbms2.com/2014/09/15/misconceptions-about-privacy-and-surveillance/ http://www.dbms2.com/2014/09/15/misconceptions-about-privacy... While I'm a huge Snowden fan, he's a bit wrong at times about encryption, in that it solves a smaller part of the problem than he sometimes suggests.

throwawayaway 12y ago
Is that your blog? I really don't think you've "caught him out" by saying his first paragraph contradicts his second. One paragraph is the present state of affairs, the other suggests future behaviour that can change the present state of affairs. Snowden doesn't have the luxury of communicating with people who have covered their tracks. All of your bullet points thereafter merely describe the present state of affairs and do not in any way contradict the concept of using encryption to change them. It's the defeatist attitude that I find the most defeating about this subject.
xnull 12y ago
Dropbox was revealed as a participant of the PRISM program: anything you store there is searchable. The same is true of Facebook and Google and Yahoo, Apple, all cell phone carriers, all internet carriers and other cloud storage companies including Skydrive/Onedrive.
- skuhn 12y ago
  Dropbox is mentioned in the PRISM slide deck as being a desired participant, not an actual participant. I worked at Dropbox when those slides were released, and none of us on the operations team knew what it could possibly be talking about. Every company that wants to continue to operate in the US has to comply with US government orders, that is just a fact of life. No one in the technology industry is super excited about going to jail or having their equipment seized. But the kind of compliance that PRISM implies is not something that you just sneak in without anyone noticing. There was an internal accounting of every server and network connection -- it would have required a shadow ops team running shadow datacenters to sneak it by us.
  - xnull2guest 12y ago
    > Every company that wants to continue to operate in the US has to comply with US government orders, that is just a fact of life. No one in the technology industry is super excited about going to jail or having their equipment seized I understand this and it is not contrary to my point. I'm actually trying to point out that the companies Snowden mentions have been specifically mentioned by NSA slides/documents and I think this has colored his suggestions. He suggests moving to others - but ultimately anything he suggests will get subverted if enough interesting material gets stored there. Not that that in itself is a reason not to adopt new technologies. > To sneak it by us... They aren't sneaking it by you as a company. They cooperate with the corporation and its internal organizational model to create a solution that fulfills the requirements. Most employees, however, can be blissfully ignorant. I think you overestimate your ability to know such things. I know plenty of Google employees that had no idea about Google's involvement, Facebook employees with no idea about Facebook's involvement, Apple employees with no idea about Apple's involvement and Microsoft employees with no idea about Microsoft involvement. I also work at a large company, and would have thought I would have seen clear indications of PRISM (& other) activity. Unfortunately that is not the case. Condolezza Rice (of all people) joined the board of Dropbox. This is their full time job and their professional expertise. I'm sure that PRISM infrastructure (or beta versions) were accounted for in full. Edit: It's not condusive to conversation to downvote something merely because you disagree with it. The downvote button (and upvote respectively) are for designating whether you believe something is irrelevant to (/contributes to) the topic.
    - skuhn 12y ago
      It's always hard to be absolutely certain about what goes on at a company, but I'm pretty confident about Dropbox not participating in PRISM (defined as a government system that automatically collects considerable data from within a company's private systems). I haven't been at Dropbox for a year now, but for most of the time I was there I was one of only two SREs that ran the production infrastructure. I knew every piece of server hardware in every datacenter, and what services ran on them. It was my job to qualify and deploy hardware, do the systems level automation, and run the user facing frontends. There is literally no way that something like PRISM could be put in place without my knowledge except by what would amount to sabotage. Keep in mind that while Dropbox is large for a startup, it only recently surpassed 1,000 employees (150 when I joined). The vast majority of those people are in customer service, and the number of people with access to production is likely still well under 100. For the first five years of the company's life there was one datacenter manager and network engineer (the same person), one SRE up until I was hired, and so on. In operations, we did more with less. However, this shouldn't make you feel like your data in Dropbox is guaranteed to be safe from prying government eyes. Dropbox can and does comply with government requests -- every company operating in the US does so, or they would not be operating anymore. I agree with your distaste towards Condoleezza Rice joining the board. It doesn't look good, but I also doubt that she has any day-to-day authority or responsibilities whatsoever.
- lern_too_spel 12y ago
  You left out half a sentence. "Anything you store there is searchable" if the US government has a court order for your data. This has always been the case. Other governments have similar systems for processing data obtained via legal requests, under different names.
  - yuubi 12y ago
    Don't we have some examples of such court orders, basically "Acme Telecom is ORDERED to reveal ALL THE THINGS"?
    - lern_too_spel 12y ago
      PRISM specifically isn't about revealing ALL THE THINGS. The documents reveal it is for ingesting specific users' data.
  - xnull2guest 12y ago
    Right, but the Snowden revelations showed that the FISA court was/is? a rubber stamp circle without any real due process - and in fact they can search the data and afterwards make a request via the FISA court. The data is also collected and stored and processed by algorithms without any court oversight, it is just when they want a contractor to look through the data manually that the minimal paperwork is involved. It would be misleading to include that half sentence without also mentioning this.
    - lern_too_spel 12y ago
      "The data is also collected and stored and processed by algorithms without any court oversight." This is false. PRISM doesn't get any data that wasn't specifically requested with a court order. It sounds like your understanding is still based on Greenwald's original reporting, which has since been shown to be inaccurate.
      - xnull2guest 12y ago
        "Collected" legally means looked at by a human. I'm talking about sent to the NSA, processed by algorithms and stored. That's not 'collected'. It's a word game they play. My original assertion stands. And be careful of "not under the PRISM program". The "not this program" has been shown to be false over and over (in spirit) as there are many related programs that do joint work on shared datasets. Regarding Greenwald's reporting, can you link to something comprehensive (and trustworthy) about inaccuracies?
- newscracker 12y ago
  What's worse with Dropbox is that it deduplicates data across users. So it's really easy for someone who "needs to know" (like the NSA) as well as people who "would like to know" to "takedown" a single user for something and identify every other Dropbox user who has the same content.

film42 12y ago

I won't be getting rid of Dropbox, Google services, or Facebook anytime soon. I disagree with government spying, and would like to see major reform, but (disagreeing with Snowden) I actually have nothing to hide. I'm not excusing the companies that provide data to governments, but I like the services they provide. They solve problems I want solved, so I will continue to use them. Edit: Why all the down votes? If you disagree, let's talk about it.

deleted 12y ago
[deleted]
- film42 12y ago
  I firmly agree with you, these services can seem scary, and we're half way down that slippery slope. But it's hard for myself (the consumer) to leave a service (like dropbox) that makes my life easier. I can manage my own private dropbox like service, but I don't trust myself. Maybe that's even scarier.
  - smtddr 12y ago
    So, I get what you're saying. I have no intention of abandoning Google either. In fact, I still see Google as the good guys as odd as that might be to many people. In the short term I understand what Edward is saying, but I'm about the long-term game. Doesn't matter what trendy tech company has your data. Yesterday it was Yahoo & Myspace. Today it's Google & Facebook, tomorrow who knows... but the one constant in all of this is a corrupt government. I'm only interested in fixing government and fixing(or destroying) the NSA. Avoiding the victims(Google,Facebook,Apple,etc) of bad laws I don't think solves things in the long term. But, if you're an activist planning a revolution or becoming another whistle-blower in the near future... then by all means do what Edward says so you can at least attempt your plan and not get preemptively stopped.
  - takeitawaymike 12y ago
    "But it's hard for myself (the consumer) to leave a service (like dropbox) that makes my life easier." That's nonsensical and a strawman. No one is telling you to stop using such services. Just use an alternative that respects your rights. That's all there is to it.

deleted 12y ago

[deleted]

mark_l_watson 12y ago

I use DropBox and Google Drive a lot, but I have scripts to encrypt data into ZIP files for anything that needs to be protected. It really is not much of a hassle. I have a SpiderOak account, but don't use it as often. Speaking of protecting data: I am surprised at how many companies seem to keep their software in private repositories on github and bitbucket. That seems like a security hole, if software if the core of your business.

throwawayaway 12y ago
for a lot of them, it is not "the crown jewels" that they put there.
- logn 12y ago
  And for others, they'd rather entrust the crown jewels to GitHub than to their rotating cast of employees relying on server closets with unreliable power supplies and lackluster physical security.
  - throwawayaway 12y ago
    ah, so to GitHub's "rotating cast of employees relying on server closets with unreliable power supplies and lackluster physical security". much better! problem solved. not our problem anymore.
    - logn 12y ago
      GitHub does it full-time though. Also, for businesses, it's a real financial concern that it's not their problem anymore. Having someone for you and your customers to sue is a good position to be in and what drives a lot of B2B decisions.
      - throwawayaway 12y ago
        I think you would do well to read this before recommending github on that basis then: https://help.github.com/articles/github-terms-of-service/ https://help.github.com/articles/github-terms-of-service/ "You expressly understand and agree that GitHub shall not be liable for any direct, indirect, incidental, special, consequential or exemplary damages, including but not limited to, damages for loss of profits, goodwill, use, data or other intangible losses (even if GitHub has been advised of the possibility of such damages), resulting from: (i) the use or the inability to use the service; (ii) the cost of procurement of substitute goods and services resulting from any goods, data, information or services purchased or obtained or messages received or transactions entered into through or from the service; (iii) unauthorized access to or alteration of your transmissions or data; (iv) statements or conduct of any third-party on the service; (v) or any other matter relating to the service."

lern_too_spel 12y ago

"Even with that encryption, he said law enforcement officials can still ask for warrants that will give them complete access to a suspect’s phone, which will include the key to the encrypted data." What, pray tell, is the mechanism by which the key will be obtained? Snowden is bloviating here.

nitrogen 12y ago
If a key is stored on your phone, it can be obtained the same way any other data is obtained. If the key is password protected, a key logger would yield the password. Edit: I forgot to check to whom I replied; "lern_to_spel" shows up on all of the Snowden threads.
- csandreasen 12y ago
  The keys aren't stored on the phone - that's what's caused all of the recent controversy. A warrant to install a keylogger isn't very useful after the suspect has been taken into custody.
- lern_too_spel 12y ago
  The key is not stored in the clear, and the device password is entered before a keylogger can run. https://www.eff.org/deeplinks/2014/10/even-golden-key-can-be-stolen-thieves-simple-facts-apples-encryption-decision https://www.eff.org/deeplinks/2014/10/even-golden-key-can-be...
  - xnull 12y ago
    It's called "key escrow" and there are tons of ways to do it. Look up US patents under 380/286 classification.
    - lern_too_spel 12y ago
      I know what key escrow is. Nitrogen didn't claim that Apple does that, and for good reason -- there is absolutely zero evidence that they do.

Selfcommit 12y ago

Does no one else see the irony in Snowden warning everyong to avoid Google.. via a Google+ Hangout?

sauere 12y ago
Word. I really feel that a lot of people talking about this whole thing fail to practice what they preach.
- Havvy 12y ago
  To be honest, he's not looking for privacy for this statement. He's looking for exactly the opposite, so using the thing that doesn't care for privacy doesn't matter for this instance.
josephlord 12y ago
If it was something intended to be public there is no harm in Google having it (they will scrape it off the web anyway) as the NSA are welcome to publicly access the content. Most people don't treat Dropbox/Google/Facebook (non-public) usage as being equivalent to CCing the government but maybe they should.
- XorNot 12y ago
  Pro-tip: anything you put on any service can and probably will at some point scroll past the eyes of a random sysadmin who's debugging why the database keeps crashing under load. Most people are worried about "disclosure" - which is something Uber violated for a PR stunt at a party recently - i.e. we're usually okay wandering past the window naked, because we assume it's extraordinarily unlikely that someone will be pointing a camera at it right then, or that it wouldn't be more embarrassing for them to try and yell "hey that person is naked in the window I saw them!" Conversely, we wouldn't be happy if someone did take photos, then uploaded them to the web, and showed them to all our friends etc. In a practical sense, this is how people act. It's how you have to act - it would be practically neurotic to act any other way.
Yver 12y ago

deleted 12y ago

[deleted]

vikramsrao 12y ago

If i do all of these how do i share documents or search for information on the web? What ever the alternative is going to have the same issues as Dropbox, Facebook or Google. I cannot build my own versions of these!

jayd16 12y ago
You could build your own dropbox. It's not that complex. A social network and a search engine would be a bit harder.
- vikramsrao 12y ago
  I agree dropbox would be easier of these and i can live without Facebook but definitely not be able to build a google. But more importantly is it worth it? I have a feeling from hardware to layers of software in the tech stack we use is all compromised to give access in one way or the other or they can be cracked brute force with the enormous computing power these organisations have.
- swartkrans 12y ago
  > You could build your own dropbox. It's not that complex. It would be incredibly complex to build your own Dropbox. Maybe it wouldn't be "complex" to use rsync to automatically copy files over to some other drive if that's all you wanted, but Dropbox does way more than that and I don't plan on dropping Dropbox for some half baked solution that requires more effort to set up, maintenance and ends up in lost data because on the one in a million chance the FBI might want to look at pictures of my pets. I don't know how I feel about government surveillance, but I sure as hell don't see it worth to trade some supposed imperceptible theoretical harm with tons of actual effort and inconvenience.
  - jerf 12y ago
    http://owncloud.org/ http://owncloud.org/ You don't have to write your own Dropbox. You just have to host one. And even beside the question of government surveillance there is the advantage that it is under your control, not somebody else's. File sharing is so generic that the lockin opportunity is less than it is in other domains (like social networking) but there still can be advantage to being the owner and not merely a renter.

rafaqueque 12y ago

What should we use then? If someone tells me to change X program, please, give me alternatives, otherwise, I'll stick with that. PS: Quite ironic to see him saying "get rid of Google", through an Hangouts session.

te0x 12y ago
Did you read the article? They talk about an alternative at length.
patcon 12y ago
Seafile is great if you dislike SpiderOak's closed-sourceness. Open source android and desktop clients, client-side encryption, can start with a free service then move to self-hosting when you're so inclined. imho, it's the best option until we get a good user-friendly decentralized offering.
megablast 12y ago
Everything has to be served on a platter, right?
icebraining 12y ago
PS: Quite ironic to see him saying "get rid of Google", through an Hangouts session. It's only ironic if you didn't read the first half of the title. He wasn't looking to keep this call private, was he?

vu3rdd 12y ago

Once again, I would like to recommend Tahoe-LAFS [0] (which anyone can install on their own on their servers or use the paid service from the creators of Tahoe-LAFS [1]). One can even store "shares" securely on Google Drive and Dropbox though it is a bit involved. [0] http://tahoe-lafs.org/ http://tahoe-lafs.org/ [1] https://leastauthority.com/ https://leastauthority.com/

anonbanker 12y ago
More importantly, you can host the storage over i2p, or a hybrid of clearnet and darknet. There's even an implement ion of free net over i2p using tahoe-lafs. I have assisted a few people in implementing this for their storage needs. No complaints, either.
newscracker 12y ago
Premise: I'm not interested in setting up a server and maintaining it, but I am interested in storing my data on services that can promise, or even better, guarantee, privacy and security. I have looked at Tahoe-LAFS for a few years now, along with the paid service. In my observations over the last few years, the paid service is getting almost zero attention from the creators. Initially they had it at an enormous cost (like $1 per GB per month) compared to other competitors. In the recent times it has moved to other schemes that are still expensive for many people ($25 per month). Their products, or rather services, are rarely updated and remain in the TBA (to be announced) status for far too long while other competitors (the "privacy conscious" ones like SpiderOak that cannot truly guarantee it like Tahoe-LAFS can as well as the "what's privacy?" services like Dropbox, Crashplan, Box, Google, Microsoft and Apple, to name just a few) are moving ahead much faster and bringing down prices. I'm willing to pay a decent enough premium to help privacy guaranteeing services survive and thrive, but this kind of pricing and sluggishness in introducing services from leastauthority.com makes it seem like they don't really want many users to sign up.

vook 12y ago

I can't agree with his logic here : "When you say, ‘I have nothing to hide,’ you’re saying, ‘I don’t care about this right.’" How does he arrive at that conclusion? I have nothing to hide, but I still don't support the violation of these rights. Does he suggest that we instead support some other service or method under the illusion that we are immune from NSA spying?

philtar 12y ago
I think it's pretty clear he means people who say "I have nothing to hide. They can look at whatever they want"