7 ms·

http://www.dbms2.com/2014/09/15/misconceptions-about-privacy-and-surveillance/ http://www.dbms2.com/2014/09/15/misconceptions-about-privacy... While I'm a huge

http://www.dbms2.com/2014/09/15/misconceptions-about-privacy-and-surveillance/ http://www.dbms2.com/2014/09/15/misconceptions-about-privacy... While I'm a huge Snowden fan, he's a bit wrong at times about encryption, in that it solves a smaller part of the problem than he sometimes suggests.

throwawayaway 12y ago
Is that your blog? I really don't think you've "caught him out" by saying his first paragraph contradicts his second. One paragraph is the present state of affairs, the other suggests future behaviour that can change the present state of affairs. Snowden doesn't have the luxury of communicating with people who have covered their tracks. All of your bullet points thereafter merely describe the present state of affairs and do not in any way contradict the concept of using encryption to change them. It's the defeatist attitude that I find the most defeating about this subject.
xnull 12y ago
Dropbox was revealed as a participant of the PRISM program: anything you store there is searchable. The same is true of Facebook and Google and Yahoo, Apple, all cell phone carriers, all internet carriers and other cloud storage companies including Skydrive/Onedrive.
- skuhn 12y ago
  Dropbox is mentioned in the PRISM slide deck as being a desired participant, not an actual participant. I worked at Dropbox when those slides were released, and none of us on the operations team knew what it could possibly be talking about. Every company that wants to continue to operate in the US has to comply with US government orders, that is just a fact of life. No one in the technology industry is super excited about going to jail or having their equipment seized. But the kind of compliance that PRISM implies is not something that you just sneak in without anyone noticing. There was an internal accounting of every server and network connection -- it would have required a shadow ops team running shadow datacenters to sneak it by us.
  - xnull2guest 12y ago
    > Every company that wants to continue to operate in the US has to comply with US government orders, that is just a fact of life. No one in the technology industry is super excited about going to jail or having their equipment seized I understand this and it is not contrary to my point. I'm actually trying to point out that the companies Snowden mentions have been specifically mentioned by NSA slides/documents and I think this has colored his suggestions. He suggests moving to others - but ultimately anything he suggests will get subverted if enough interesting material gets stored there. Not that that in itself is a reason not to adopt new technologies. > To sneak it by us... They aren't sneaking it by you as a company. They cooperate with the corporation and its internal organizational model to create a solution that fulfills the requirements. Most employees, however, can be blissfully ignorant. I think you overestimate your ability to know such things. I know plenty of Google employees that had no idea about Google's involvement, Facebook employees with no idea about Facebook's involvement, Apple employees with no idea about Apple's involvement and Microsoft employees with no idea about Microsoft involvement. I also work at a large company, and would have thought I would have seen clear indications of PRISM (& other) activity. Unfortunately that is not the case. Condolezza Rice (of all people) joined the board of Dropbox. This is their full time job and their professional expertise. I'm sure that PRISM infrastructure (or beta versions) were accounted for in full. Edit: It's not condusive to conversation to downvote something merely because you disagree with it. The downvote button (and upvote respectively) are for designating whether you believe something is irrelevant to (/contributes to) the topic.
    - skuhn 12y ago
      It's always hard to be absolutely certain about what goes on at a company, but I'm pretty confident about Dropbox not participating in PRISM (defined as a government system that automatically collects considerable data from within a company's private systems). I haven't been at Dropbox for a year now, but for most of the time I was there I was one of only two SREs that ran the production infrastructure. I knew every piece of server hardware in every datacenter, and what services ran on them. It was my job to qualify and deploy hardware, do the systems level automation, and run the user facing frontends. There is literally no way that something like PRISM could be put in place without my knowledge except by what would amount to sabotage. Keep in mind that while Dropbox is large for a startup, it only recently surpassed 1,000 employees (150 when I joined). The vast majority of those people are in customer service, and the number of people with access to production is likely still well under 100. For the first five years of the company's life there was one datacenter manager and network engineer (the same person), one SRE up until I was hired, and so on. In operations, we did more with less. However, this shouldn't make you feel like your data in Dropbox is guaranteed to be safe from prying government eyes. Dropbox can and does comply with government requests -- every company operating in the US does so, or they would not be operating anymore. I agree with your distaste towards Condoleezza Rice joining the board. It doesn't look good, but I also doubt that she has any day-to-day authority or responsibilities whatsoever.
- lern_too_spel 12y ago
  You left out half a sentence. "Anything you store there is searchable" if the US government has a court order for your data. This has always been the case. Other governments have similar systems for processing data obtained via legal requests, under different names.
  - yuubi 12y ago
    Don't we have some examples of such court orders, basically "Acme Telecom is ORDERED to reveal ALL THE THINGS"?
    - lern_too_spel 12y ago
      PRISM specifically isn't about revealing ALL THE THINGS. The documents reveal it is for ingesting specific users' data.
  - xnull2guest 12y ago
    Right, but the Snowden revelations showed that the FISA court was/is? a rubber stamp circle without any real due process - and in fact they can search the data and afterwards make a request via the FISA court. The data is also collected and stored and processed by algorithms without any court oversight, it is just when they want a contractor to look through the data manually that the minimal paperwork is involved. It would be misleading to include that half sentence without also mentioning this.
    - lern_too_spel 12y ago
      "The data is also collected and stored and processed by algorithms without any court oversight." This is false. PRISM doesn't get any data that wasn't specifically requested with a court order. It sounds like your understanding is still based on Greenwald's original reporting, which has since been shown to be inaccurate.
      - xnull2guest 12y ago
        "Collected" legally means looked at by a human. I'm talking about sent to the NSA, processed by algorithms and stored. That's not 'collected'. It's a word game they play. My original assertion stands. And be careful of "not under the PRISM program". The "not this program" has been shown to be false over and over (in spirit) as there are many related programs that do joint work on shared datasets. Regarding Greenwald's reporting, can you link to something comprehensive (and trustworthy) about inaccuracies?
- newscracker 12y ago
  What's worse with Dropbox is that it deduplicates data across users. So it's really easy for someone who "needs to know" (like the NSA) as well as people who "would like to know" to "takedown" a single user for something and identify every other Dropbox user who has the same content.

throwawayaway 12y ago

Is that your blog? I really don't think you've "caught him out" by saying his first paragraph contradicts his second. One paragraph is the present state of affairs, the other suggests future behaviour that can change the present state of affairs. Snowden doesn't have the luxury of communicating with people who have covered their tracks. All of your bullet points thereafter merely describe the present state of affairs and do not in any way contradict the concept of using encryption to change them. It's the defeatist attitude that I find the most defeating about this subject.

xnull 12y ago

Dropbox was revealed as a participant of the PRISM program: anything you store there is searchable. The same is true of Facebook and Google and Yahoo, Apple, all cell phone carriers, all internet carriers and other cloud storage companies including Skydrive/Onedrive.

skuhn 12y ago
Dropbox is mentioned in the PRISM slide deck as being a desired participant, not an actual participant. I worked at Dropbox when those slides were released, and none of us on the operations team knew what it could possibly be talking about. Every company that wants to continue to operate in the US has to comply with US government orders, that is just a fact of life. No one in the technology industry is super excited about going to jail or having their equipment seized. But the kind of compliance that PRISM implies is not something that you just sneak in without anyone noticing. There was an internal accounting of every server and network connection -- it would have required a shadow ops team running shadow datacenters to sneak it by us.
- xnull2guest 12y ago
  > Every company that wants to continue to operate in the US has to comply with US government orders, that is just a fact of life. No one in the technology industry is super excited about going to jail or having their equipment seized I understand this and it is not contrary to my point. I'm actually trying to point out that the companies Snowden mentions have been specifically mentioned by NSA slides/documents and I think this has colored his suggestions. He suggests moving to others - but ultimately anything he suggests will get subverted if enough interesting material gets stored there. Not that that in itself is a reason not to adopt new technologies. > To sneak it by us... They aren't sneaking it by you as a company. They cooperate with the corporation and its internal organizational model to create a solution that fulfills the requirements. Most employees, however, can be blissfully ignorant. I think you overestimate your ability to know such things. I know plenty of Google employees that had no idea about Google's involvement, Facebook employees with no idea about Facebook's involvement, Apple employees with no idea about Apple's involvement and Microsoft employees with no idea about Microsoft involvement. I also work at a large company, and would have thought I would have seen clear indications of PRISM (& other) activity. Unfortunately that is not the case. Condolezza Rice (of all people) joined the board of Dropbox. This is their full time job and their professional expertise. I'm sure that PRISM infrastructure (or beta versions) were accounted for in full. Edit: It's not condusive to conversation to downvote something merely because you disagree with it. The downvote button (and upvote respectively) are for designating whether you believe something is irrelevant to (/contributes to) the topic.
  - skuhn 12y ago
    It's always hard to be absolutely certain about what goes on at a company, but I'm pretty confident about Dropbox not participating in PRISM (defined as a government system that automatically collects considerable data from within a company's private systems). I haven't been at Dropbox for a year now, but for most of the time I was there I was one of only two SREs that ran the production infrastructure. I knew every piece of server hardware in every datacenter, and what services ran on them. It was my job to qualify and deploy hardware, do the systems level automation, and run the user facing frontends. There is literally no way that something like PRISM could be put in place without my knowledge except by what would amount to sabotage. Keep in mind that while Dropbox is large for a startup, it only recently surpassed 1,000 employees (150 when I joined). The vast majority of those people are in customer service, and the number of people with access to production is likely still well under 100. For the first five years of the company's life there was one datacenter manager and network engineer (the same person), one SRE up until I was hired, and so on. In operations, we did more with less. However, this shouldn't make you feel like your data in Dropbox is guaranteed to be safe from prying government eyes. Dropbox can and does comply with government requests -- every company operating in the US does so, or they would not be operating anymore. I agree with your distaste towards Condoleezza Rice joining the board. It doesn't look good, but I also doubt that she has any day-to-day authority or responsibilities whatsoever.
lern_too_spel 12y ago
You left out half a sentence. "Anything you store there is searchable" if the US government has a court order for your data. This has always been the case. Other governments have similar systems for processing data obtained via legal requests, under different names.
- yuubi 12y ago
  Don't we have some examples of such court orders, basically "Acme Telecom is ORDERED to reveal ALL THE THINGS"?
  - lern_too_spel 12y ago
    PRISM specifically isn't about revealing ALL THE THINGS. The documents reveal it is for ingesting specific users' data.
- xnull2guest 12y ago
  Right, but the Snowden revelations showed that the FISA court was/is? a rubber stamp circle without any real due process - and in fact they can search the data and afterwards make a request via the FISA court. The data is also collected and stored and processed by algorithms without any court oversight, it is just when they want a contractor to look through the data manually that the minimal paperwork is involved. It would be misleading to include that half sentence without also mentioning this.
  - lern_too_spel 12y ago
    "The data is also collected and stored and processed by algorithms without any court oversight." This is false. PRISM doesn't get any data that wasn't specifically requested with a court order. It sounds like your understanding is still based on Greenwald's original reporting, which has since been shown to be inaccurate.
    - xnull2guest 12y ago
      "Collected" legally means looked at by a human. I'm talking about sent to the NSA, processed by algorithms and stored. That's not 'collected'. It's a word game they play. My original assertion stands. And be careful of "not under the PRISM program". The "not this program" has been shown to be false over and over (in spirit) as there are many related programs that do joint work on shared datasets. Regarding Greenwald's reporting, can you link to something comprehensive (and trustworthy) about inaccuracies?
newscracker 12y ago
What's worse with Dropbox is that it deduplicates data across users. So it's really easy for someone who "needs to know" (like the NSA) as well as people who "would like to know" to "takedown" a single user for something and identify every other Dropbox user who has the same content.