I think this is very relevant here - interview with the NSA whistleblower, William Binney, on how NSA is storing every post people are making online, so they (and FBI) can use it later:
No wonder NSA and FBI want warrantless access to private companies by lobbying for new laws like CISPA, and trying to build backdoors in services like Facebook, Skype, Twitter etc. They want to know absolutely everything you do online, besides your public posts:
I don't know if they are doing it out of malice/power grabbing/control, or purely as a way to make their jobs more "efficient". But their #1 priority should always, always, be respecting the Constitution, and not trying to skirt around it. And I think they've forgotten all about that long ago.
"But their #1 priority should always, always, be respecting the Constitution, and not trying to skirt around it. And I think they've forgotten all about that long ago."
That's the irony of the whole American security apparatus. They are in place, nominally, in order to protect American citizens rights to live with the freedoms inherently granted to them by the Constitution.
I think the point is democratic states should (need) not have intelligence agencies with unlimited powers. They corrupt the state as they establish themselves as a central pillar of power (next to the military and the government).
They don't even have any historical roots in western political systems. The country with the claim to that is Russia (http://en.wikipedia.org/wiki/Okhrana), where they were commonly used to quell internal unrest and combat opposition.
> their #1 priority should always, always, be respecting the Constitution
Presumably their #1 priority can be specified in a more rational way without random worshipping of some old document? Other countries, not blessed with the Constitution of the USA, also have intelligence and law enforcement agencies.
You know, people keep repeating this assumption that the NSA stores every post that people make online. Maybe someone should do a quick back of the envelope calculation to see how feasible that actually is?
My guess is that it's nowhere near possible given the amount of network traffic coming into/out of the US and current hard drive storage technology. IMHO the extreme amount of volume and limitations of storage space should create a necessity to be at least somewhat targeted in scope.
Not sure why people don't use common sense a bit more often...
Forget about the Constitution. Rather, they should respect basic human rights and the principles of the Enlightenment. All this focus Americans put on their Constitution makes it easier for their government to become oppressive, because it encourages complacency. As though you could write the perfect set of laws, that you could define the perfect set of operating principles for your government, and in that way free yourself of tyranny forever and guarantee a free and open society for you and all your descendants. No, the price of liberty is eternal vigilance.
First, recall that states are systems through which coercive force flows. Factions within a state may compete for support, leading to democratic surface phenomena, but the underpinnings of states are the systematic application, and avoidance, of violence. Land ownership, property, rents, dividends, taxation, court fines, censorship, copyrights and trademarks are all enforced by the threatened application of state violence.
As if we lived in a halcyon utopia prior to that. I can't buy into Assange's Manichean view of government, given the pre-governmental state of society as war of all against all, qua Hobbes: "In such condition there is no place for industry, because the fruit thereof is uncertain, and consequently, not culture of the earth, no navigation, nor the use of commodities that may be imported by sea, no commodious building, no instruments of moving and removing such things as require much force, no knowledge of the face of the earth, no account of time, no arts, no letters, no society, and which is worst of all, continual fear and danger of violent death, and the life of man, solitary, poor, nasty, brutish, and short."
Back when Wikileaks first came to prominence, it exposed malfeasance by private actors as often as states, notwithstanding the desire of those private actors to keep their doings private or even encrypted; Trafigure being a prime example (http://en.wikipedia.org/wiki/Trafigura).
States can certainly be destructive of liberty, but the absence of a state (either literally or by legal limitation ) does not necessarily yield liberty; often it results in mere libertinism.
Your argument is a non sequitur: states are necessary, therefore states are not systems through which coercive force flows.
If you want to argue that states are necessary, fine. But call a spade a spade. Can you imagine a state that doesn't wield violence? That's what a state is.
The lack of clarity on this issue leads to a lot of bad conclusions. When we argue that the state should solve any particular problem, we are explicitly saying the problem needs to be solved by coercive force. Maybe that's necessary. But let's not have any illusions about how states work and how laws are enforced.
Assange speaks truth. You cannot deny the fundamentals of the state are violence. The US speaks already of a capacity for instant global weapon strikes within the hour. You claim it is wrong to question the system, implicitly suggesting there is no alternative. But anthropology shows clearly that premodern societies had more free time, greater material and economic equality. (Try 'Debt: The First 5000 Years').
You attack a perspective, quoting on a tangent, without contributing anything meaningful except the notion that government can have value: but of course! Nobody denies this.
Assange and other politically engaged hackers like him seek improved systems of governance: greater protection of fundamental freedoms, greater availability of additional freedoms, greater truth and transparency.
Relax, nobody wants to topple your car and burn your house down.
I agree with the sentiment, but Assange's prose is a little dense. Maybe it's OK for his target audience, as I assume the layman won't be reading cryptome.org.
What we really need is a champion to explain in relatable, plain English why encryption is essential even for mom and dad, and to explain it in a more mainstream venue. I think a big reason why people don't encrypt mail, etc., is because:
1) they don't know why it's important because nobody can explain it to them in relatable terms (like saying: when you send an email, Google keeps a copy forever, and the FBI can read it just by picking up a phone and asking nicely), and
2) if they do know the importance, the practicalities of encryption are explained impenetrably. A blur of acronyms, bad metaphors ("keys?" terrible choice of metaphor, considering how a pair is intertwined and their actual use), and no well-known authority you can trust to explain it all simply.
The problem isn't that people don't care. They would care if they knew the realities of how their communications are stored, processed, and exposed to their governments. The problem is that nobody can explain it to them in a way that's not ridiculously complex or laden with terms like "Platonic realm" and "transnational dystopia".
You are right, people care. But not about things that would make reducing government power likely nor encrypting things by default probable.
They care about getting to work in the morning and getting home at night. They care about dinner with the family and a couple hours mindless television. They care about being safe while they do these things, and they've fully bought into the government's mantra of "we will protect you", so, as long as that's happening, they don't care about anything else.
Go talk to just about anyone outside of sites like Reddit or HN about the TSA, and you will be told how good a job they are doing. When the government tells them it is time to randomly drop their pants for the cavity check, as long as they are told it is making them safe, they will willingly oblige.
As much as the government's power grab, the complete lack of concern for it scares the hell out of me.
Either you use a 3rd party service to encrypt, its easy and also extremely dumb (since its not end to end encryption).
Either you use PGP or SMIME and guess what: it's too hard. Their design is fine. I especially like GnuPG (PGP), but the UI, even in CLI, is terrible, terrible!
Most people don't even understand that a GnuPG keychain generally contains 2 private keys, not one (one for signing, one for encryption!) or the concept of master signing key and subkeys.
These concepts are relatively simple, but their use is hard. Terribly hard.
For this reason I am fond of Jonathan Zittrain. Not that he particularly aligns with Assange but he is very good at presenting these issues in a compelling manner.
I think you are overly optimistic here. Let's put it this way: if people were told that they had to report one crime committed by their neighbors in order to watch the superbowl, what do you think would happen?
"They would care if they knew the realities of how their communications are stored, processed, and exposed to their governments"
I have a lot of friends who know this, some of whom know it in more depth than many HN readers. Guess what? They all stopped bothering to maintain a PGP key. They all carry cell phones, and they do not even take the time to try to disable location services. They are all users of at least one of (Facebook Twitter Google+ GMail LinkedIn). If the people who know these things do not care, what make you think that people do not know these things would care if they became knowledgeable?
It's a very hard problem IMO. Not just finding the words, but everything. For example, before learning linux to a degree where it wasn't a pain to use as a desktop, I thought it made no sense to waste time learning this or that security feature (like email encryption), because an expert would probably be able to fuck me anyway. Now that I have a better understanding, and I can mentally trace the information from end to end, know where it could be compromised, etc, I started caring, secured everything the best I could, and my friends now call me a paranoid (that didn't stop me from installing Thunderbird and Enigmail in their PC's).
So I think someone should explain to the people in a clear way that you don't need 100% security, but you need to understand when and where your information can get compromised, and what you can do about it. Eg:
- Private message on facebook - you are screwed
- Messenger - you are screwed
- Post on a blog - you are screwed, unless you posted anonymously and hidden your IP (which is not that easy, we know of many geeks who were caught even when they were using Thor, because they didn't fully understand the technology - hint: exit nodes)
- Email - you can encrypt it, and you are safe as long as both computers (sender's and receiver's) stay safe (assuming you store your private key there)
- Data on your computer - you are safe unless malware is installed, or someone gets physical access. You can use full disk encryption, but you will probably have to use Linux (personally, I use Ubuntu), so this is a far fetched goal for the regular Joe. There is also truecrypt for windows, but it's not full disk if I recall correctly.
- Etc.
I'll add a recent anecdote here: Just the other day a friend of mine replied to one of my emails, saying that gmail broke the encrypted email (meaning he couldn't read it, not that gmail decrytped it). In his reply, I received the broken email, and four emails from a private conversation he was having with other people. Something happened in gmail, something went wrong, and I got those emails. They came with headers and everything, he didn't copy/paste those (he wouldn't know how to do that). So there's another reason to encrypt emails: mails server can make mistakes apparently.
A sufficiently motivated government has a nearly infinite amount of tools available for breaking encryption. Ignoring the possibility that it might know proprietary weaknesses to various systems (a hypothesis that is unknowable), there's just so much you need to secure at each node in a computer system.
Are you personally sure no backdoors exist in the physical hardware you use? In the operating system you use? In the compiler used to build your OS? In any of the applications on your system? Are you sure that there's not a hardware keylogger on your keyboard, and do you check every day before sitting down that there's not one? Are there any secret cameras pointed at your keyboard, or sensitive microphones hidden nearby that can distinguish what keys you hit?
And once you're sure of all that, are you just as sure everyone you communicate with is equally diligent?
And, while we're at it, have you come up with a solid patch to prevent the well-known rubber hose vulnerability that exists in all cryptographic systems?
That doesn't mean the crypto-anarchist project must fail. Encryption is invaluable: while the vast majority of other technological advances--sedentary agriculture, writing, maths, roads, sewage systems, paper, the telegraph, electricity, the light bulb, cars, "computers," satellites, Google--have all increased the legibility of the world to the State, encryption does the opposite. The panopticon isn't an existing, established system but instead an equilibrium point that the State has to constantly push us toward: anytime the economic cost of that push is increased, it gives us more opportunities for creating spaces of genuine human autonomy.
But once you recast crypto-anarchism in that more moderate and stronger form, encryption moves from "our one hope against total domination" and a "hope that with courage, insight and solidarity we could use to resist" to something more banal: one tool of many. Not even a particularly effective tool: governments don't care about a bunch of nerds throwing PGP parties, and all the encryption in the world hasn't prevented the State from throwing Assange into jail (a pleasant jail with some fine Ecuadorian decor, but a jail nonetheless) and obliterating his organization.
In Cory Doctorow's talk at Google, he said that all routers today have interception technology in them. It's only a matter of being enabled or not in some countries or in others. But it seems so many have asked for it, that they don't even bother to build routers without that interception technology in them, so now their default router has interception built-in by default.
Even using encryption that is trivially defeated is effective at resisting broadly applied surveillance as long as the fact that it's trivially defeated isn't public. That's because you need to restrict the application of the technique to a rather limited circle to maintain secrecy, which more or less guarantees that it's only applied in a targeted fashion.
My idea is that encryption must be so easy as to be used by all without configuration. It will make much harder mass surveillance, all other methods you cited are much more expensive methods, in most of them you must have physical contact or dedicate an attack against somebody, but to find that somebody you need to follow his correspondence.
This kind of over-the-top writing confirms what I already thought, which is that despite whatever good he might do in terms of exposing corrupt governments in the world, Julian Assange is just desperate for attention.
Being this paranoid he should be advocating "post-quantum cryptography", i.e. cryptographic methods that are secure even once somebody develops a quantum computer.
Nice username you got there. So you're saying this all conspiracy theory stuff? I think we've gotten way passed the point where the fact that the government monitors everyone online is just a conspiracy theory.
A few people took on the risk of giving him a treasure trove of stolen documents (the VAST majority of which did had zero positive impact in being released), and he turned it into a soapbox.
I think that more focus, at least in the short term; needs to be put on making crypto accessible to windows users. As an example, consider the following project website:
An invalid security certificate, and even that only if you go out of your way to specify https. If the vast majority of users saw this, they'd go running; including myself. I can't in good conscious recommend crypto that doesn't have it's own security certificates under control.
I have as yet not seen any less shady open implementations of PGP out there.
Of course, because of the proprietary nature of windows, it is totally possible for them to have back doors which will break your encryption, but I'm fairly sure that there are ways to verify, even without source code; that Microsoft isn't pulling any funny business.[0]
[0]: Besides, I'd prefer a situation where politically unsavory backdoors have to be used to read your data, as opposed to it being plain text and free for all.
I feel pretty safe predicting that most communications are moving to mobile, vs. desktops. Even if you have a desktop, most of your communications will happen on a mobile device.
The thing we really need (and what I'd fund if I had a spare $Xmm or so) is a great crypto API and solution to the user key management problem for iOS and Android, hooked into apps. It's technically easier to do on Android. On iOS, you're kind of stuck due to the core apps (mail, messages, etc.) being first-party Apple). It basically would take Apple deciding they cared about this issue, then building it into the OS in a way which didn't actually require trusting Apple completely, to work very well. Android has some steps toward this with some NSA projects, and wouldn't even necessarily require a full forking.
Some way to do tokenization and thus fairly transparent encryption on the client (phone) inside apps like the Facebook App, Twitter, etc. would also be nice. That's both a technical challenge and a UI/UX problem.
Silent Circle (from Jon Callas, Phil Zimmerman, Vinnie Moscaritolo (the PGP team...) and some Navy SEALs and defense contractors I knew from Iraq) actually seems like a pretty viable choice for sms, email, and voice right now. It unfortunately doesn't integrate into the social networks and other services people use, though.
I also find Eric Hughes much easier to rally behind than Julian Assange, although John Gilmore is better still (although largely focuses on drug policy, now). Or John Perry Barlow or Mitch Kapor.
> The world is not sliding, but galloping into a new transnational dystopia. This development has not been properly recognized outside of national security circles.
I agree with Moxie Marlinspike on that, we were preparing for fascism but got social democracy[1]. Assange is still preparing for fascism.
You mean the guy who is in internal exile in Britain because as a journalist he revealed war crimes committed by Britain's partner the United States? He's the guy who is delusional about the form of government that surrounds him, huh? Glad it's as simple as that.
In maybe five to ten years, the internet will effectively split in two. There will be major, commercial service providers such as Facebook-type social media hubs, major news sites but there will also be an invisible internet that is everything internet used to be, and in addition to that encrypted, anonymous, and untraceable.
How it shows most prominently at the moment is file sharing. Setting the endless copyright debates aside, what happens is that governments and large companies want to interfere with the privacy of what citizens are doing with their own bits. They say copying is theft while citizens consider twiddling their own bits a private matter that's none of anyone else's business. The citizens don't understand that while it's de facto legal to form a sneakernet—the actual legal status probably varies from place to place but nobody has ever been sued for sneakernet filesharing because nobody else never knows about it—it's illegal to form a filesharing network over the internet.
I don't promote or demote filesharing per se: it's just the cutting edge where the future trends will show years before they land elsewhere and that's what it makes it so interesting. A marginal slice of file sharing has already moved to anonymous darknets but in a few years and after a few more bad copyright/freedom-of-speech incidents with bad publicity, there will eventually be a breakthrough and the whole filesharing activity will go underground en masse.
When the masses go for it, the capacity and availability of invisible darknets will raise in orders of magnitude. That means there will be other providers in the anonymous networks as well, websites and services. There already are some, from anonymous wikis, anonymous project pages to anonymous forums but currently those are playgrounds. That is not so in ten years: there will be a major "bazaar" going on underground. While everything is anonymous and untraceable, everything is also secure. An online bank could very well operate in the anonymous network because the traffic is already cryptographically signed, and users can enjoy strong authentication if they wish to or remain a pair of anonymous public/private keys.
At that point the traditional grasp of internet control is lost.
The institutions governing the internet and the copyright and whatnot are faced with a big dilemma: do they dare to ban and make illegal anything that's not specifically permitted on the internet and if so, how to go about it in actuality. Do they lobby for laws that only allow ISPs to let citizens connect to a http proxy that validates all traffic to be "approved"? Do they extend the charges for any use of the invisible internet that is deemed illegal, to cover all users of the invisible internet?
We're still in the shadowdancing mode but the stakes are going higher, and in at most ten years the problem of control versus anonymity will have come out in the public.
This is why I'm glad HTTP 2.0 intends to implement SPDY's always-on encryption. It probably won't be long until governments find a way around that, especially the US government, who can pretty easily gain access to companies like Google, Verisign, and even ICANN, but it would be a good first step in the right direction. Hopefully future steps like web crypto will help increase the security of people's conversations online further.
Does it seem strange to anyone that the whole book isn't available for free? This doesn't appear to be intended as mere entertainment. This is supposed to be about maintaining freedom . . . it seems like a case where you'd want to get your ideas out and save the day over earning money from it.
I think his call to action at the end is too abstract. It's important to understand that there is a problem, but the solution lies in understanding why the government is the way it is and why people vote to have such a government (fear).
The battle is winning the minds of the average person, by showing them that an encrypted, unmonitored, uncensored internet is in their best interests and not something to fear.
Or in the worst case, show that an all powerful (and therefore eventually corrupt) government is the greater of two evils. The proper tool for this is probably cheap, scalable marketing stunts and compelling media that spells this out in layman's terms.
It is interesting that this preface has been extracted and hosted on Cryptome. Given the history of Cryptome and Wikileaks; and having had the opportunity back in 2009 to ask Assange in person about his views of Cryptome, I am no doubt his eyebrows would raise as well. I wonder if John Young posted it himself or it was submitted. IIRC part of Assange's concerns around Cryptome were some well reasoned arguments around editorial and source protection policy.
I feel that we have to understand that using technology to fight legal battle never is the right answer. As soon as the government sees a particular technology as a hinder, threat or even an inconvenience, they can legislate against it. This holds true for encryption, VPNs and all other technological "saviours" that internet evangelists keep ranting about.
The truth is that the only reasonable thing to do is to become politically active.
Why it is highly recommended not to implement your own encryption method, we shouldn't be using something that could easily be decrypted by the wrong people either. We need to study methods that we use extremely well, and be aware that encryption susceptible to decryption via brute-force with significant resources are just as dangerous as backdoors.
I also advocate development of wireless mesh networking technology to handle larger adhoc networks. While those that wish to spy could still become a member of an adhoc network, it would significantly complicate things for them.
Why It Matters: [...] This blog isn’t terribly controversial. But if only the “controversial” stuff is private, then privacy is itself suspicious. Thus, privacy should be on by default.
My initial thoughts are, I don't know if this is the right way to combat widespread warrantless search and seizure, although maybe it is. I'm not sold either way.
Let's say there were some massive breech of probable cause before billions of people used the internet every day. Maybe some king is issuing multitudinous search warrants to go and seize all postal mail correspondence within some large sector of the population. I'm thinking of something "old tymey" here.
Okay. Well, it seems to me, the 18th century version of Julian Assange would essentially argue that people need to start getting good at writing in and decoding cryptograms. What we really need is the 21st century version of James Otis.
I know, it's a very, very unfair analogy. But it explains my point. If this stuff that William Binney is talking about is really going on, wouldn't a legal or a socio-political (not sure if I'm even using that term correctly) response be more lasting and effective than having everybody start writing letters in the form of a NY Times crossword puzzle?
This article seems to propose that encryption is the solution to everything. However, it should be relatively easy to discern an encrypted message from an unencrypted one. When everbody starts encrypting and this really poses a threat to intelligence agencies and governments it will simply be outlawed and payload that is deemed encrypted will not be routed.
[+] [-] mtgx|13 years ago|reply
http://www.youtube.com/watch?v=TuET0kpHoyM
No wonder NSA and FBI want warrantless access to private companies by lobbying for new laws like CISPA, and trying to build backdoors in services like Facebook, Skype, Twitter etc. They want to know absolutely everything you do online, besides your public posts:
http://www.wired.com/threatlevel/2012/05/fbi-seeks-internet-...
I don't know if they are doing it out of malice/power grabbing/control, or purely as a way to make their jobs more "efficient". But their #1 priority should always, always, be respecting the Constitution, and not trying to skirt around it. And I think they've forgotten all about that long ago.
[+] [-] artichokeheart|13 years ago|reply
That's the irony of the whole American security apparatus. They are in place, nominally, in order to protect American citizens rights to live with the freedoms inherently granted to them by the Constitution.
[+] [-] revelation|13 years ago|reply
They don't even have any historical roots in western political systems. The country with the claim to that is Russia (http://en.wikipedia.org/wiki/Okhrana), where they were commonly used to quell internal unrest and combat opposition.
[+] [-] Myrmornis|13 years ago|reply
Presumably their #1 priority can be specified in a more rational way without random worshipping of some old document? Other countries, not blessed with the Constitution of the USA, also have intelligence and law enforcement agencies.
[+] [-] xfs|13 years ago|reply
[+] [-] dguido|13 years ago|reply
My guess is that it's nowhere near possible given the amount of network traffic coming into/out of the US and current hard drive storage technology. IMHO the extreme amount of volume and limitations of storage space should create a necessity to be at least somewhat targeted in scope.
Not sure why people don't use common sense a bit more often...
[+] [-] Ntrails|13 years ago|reply
[+] [-] bluedanieru|13 years ago|reply
[+] [-] frozenport|13 years ago|reply
[+] [-] anigbrowl|13 years ago|reply
As if we lived in a halcyon utopia prior to that. I can't buy into Assange's Manichean view of government, given the pre-governmental state of society as war of all against all, qua Hobbes: "In such condition there is no place for industry, because the fruit thereof is uncertain, and consequently, not culture of the earth, no navigation, nor the use of commodities that may be imported by sea, no commodious building, no instruments of moving and removing such things as require much force, no knowledge of the face of the earth, no account of time, no arts, no letters, no society, and which is worst of all, continual fear and danger of violent death, and the life of man, solitary, poor, nasty, brutish, and short."
Back when Wikileaks first came to prominence, it exposed malfeasance by private actors as often as states, notwithstanding the desire of those private actors to keep their doings private or even encrypted; Trafigure being a prime example (http://en.wikipedia.org/wiki/Trafigura).
States can certainly be destructive of liberty, but the absence of a state (either literally or by legal limitation ) does not necessarily yield liberty; often it results in mere libertinism.
[+] [-] ef4|13 years ago|reply
If you want to argue that states are necessary, fine. But call a spade a spade. Can you imagine a state that doesn't wield violence? That's what a state is.
The lack of clarity on this issue leads to a lot of bad conclusions. When we argue that the state should solve any particular problem, we are explicitly saying the problem needs to be solved by coercive force. Maybe that's necessary. But let's not have any illusions about how states work and how laws are enforced.
[+] [-] contingencies|13 years ago|reply
You attack a perspective, quoting on a tangent, without contributing anything meaningful except the notion that government can have value: but of course! Nobody denies this.
Assange and other politically engaged hackers like him seek improved systems of governance: greater protection of fundamental freedoms, greater availability of additional freedoms, greater truth and transparency.
Relax, nobody wants to topple your car and burn your house down.
[+] [-] graeme|13 years ago|reply
Further, Hobbes' state of nature has zero grounding in empirical fact. Which historical state of nature does it refer to?
[+] [-] unknown|13 years ago|reply
[deleted]
[+] [-] acabal|13 years ago|reply
What we really need is a champion to explain in relatable, plain English why encryption is essential even for mom and dad, and to explain it in a more mainstream venue. I think a big reason why people don't encrypt mail, etc., is because:
1) they don't know why it's important because nobody can explain it to them in relatable terms (like saying: when you send an email, Google keeps a copy forever, and the FBI can read it just by picking up a phone and asking nicely), and
2) if they do know the importance, the practicalities of encryption are explained impenetrably. A blur of acronyms, bad metaphors ("keys?" terrible choice of metaphor, considering how a pair is intertwined and their actual use), and no well-known authority you can trust to explain it all simply.
The problem isn't that people don't care. They would care if they knew the realities of how their communications are stored, processed, and exposed to their governments. The problem is that nobody can explain it to them in a way that's not ridiculously complex or laden with terms like "Platonic realm" and "transnational dystopia".
[+] [-] SoftwareMaven|13 years ago|reply
You are right, people care. But not about things that would make reducing government power likely nor encrypting things by default probable.
They care about getting to work in the morning and getting home at night. They care about dinner with the family and a couple hours mindless television. They care about being safe while they do these things, and they've fully bought into the government's mantra of "we will protect you", so, as long as that's happening, they don't care about anything else.
Go talk to just about anyone outside of sites like Reddit or HN about the TSA, and you will be told how good a job they are doing. When the government tells them it is time to randomly drop their pants for the cavity check, as long as they are told it is making them safe, they will willingly oblige.
As much as the government's power grab, the complete lack of concern for it scares the hell out of me.
[+] [-] zobzu|13 years ago|reply
Either you use a 3rd party service to encrypt, its easy and also extremely dumb (since its not end to end encryption).
Either you use PGP or SMIME and guess what: it's too hard. Their design is fine. I especially like GnuPG (PGP), but the UI, even in CLI, is terrible, terrible!
Most people don't even understand that a GnuPG keychain generally contains 2 private keys, not one (one for signing, one for encryption!) or the concept of master signing key and subkeys.
These concepts are relatively simple, but their use is hard. Terribly hard.
[+] [-] 18hrs|13 years ago|reply
[+] [-] betterunix|13 years ago|reply
I think you are overly optimistic here. Let's put it this way: if people were told that they had to report one crime committed by their neighbors in order to watch the superbowl, what do you think would happen?
"They would care if they knew the realities of how their communications are stored, processed, and exposed to their governments"
I have a lot of friends who know this, some of whom know it in more depth than many HN readers. Guess what? They all stopped bothering to maintain a PGP key. They all carry cell phones, and they do not even take the time to try to disable location services. They are all users of at least one of (Facebook Twitter Google+ GMail LinkedIn). If the people who know these things do not care, what make you think that people do not know these things would care if they became knowledgeable?
[+] [-] saraid216|13 years ago|reply
[+] [-] easytiger|13 years ago|reply
[+] [-] mylittlepony|13 years ago|reply
So I think someone should explain to the people in a clear way that you don't need 100% security, but you need to understand when and where your information can get compromised, and what you can do about it. Eg:
- Private message on facebook - you are screwed
- Messenger - you are screwed
- Post on a blog - you are screwed, unless you posted anonymously and hidden your IP (which is not that easy, we know of many geeks who were caught even when they were using Thor, because they didn't fully understand the technology - hint: exit nodes)
- Email - you can encrypt it, and you are safe as long as both computers (sender's and receiver's) stay safe (assuming you store your private key there)
- Data on your computer - you are safe unless malware is installed, or someone gets physical access. You can use full disk encryption, but you will probably have to use Linux (personally, I use Ubuntu), so this is a far fetched goal for the regular Joe. There is also truecrypt for windows, but it's not full disk if I recall correctly.
- Etc.
I'll add a recent anecdote here: Just the other day a friend of mine replied to one of my emails, saying that gmail broke the encrypted email (meaning he couldn't read it, not that gmail decrytped it). In his reply, I received the broken email, and four emails from a private conversation he was having with other people. Something happened in gmail, something went wrong, and I got those emails. They came with headers and everything, he didn't copy/paste those (he wouldn't know how to do that). So there's another reason to encrypt emails: mails server can make mistakes apparently.
[+] [-] scarmig|13 years ago|reply
Are you personally sure no backdoors exist in the physical hardware you use? In the operating system you use? In the compiler used to build your OS? In any of the applications on your system? Are you sure that there's not a hardware keylogger on your keyboard, and do you check every day before sitting down that there's not one? Are there any secret cameras pointed at your keyboard, or sensitive microphones hidden nearby that can distinguish what keys you hit?
And once you're sure of all that, are you just as sure everyone you communicate with is equally diligent?
And, while we're at it, have you come up with a solid patch to prevent the well-known rubber hose vulnerability that exists in all cryptographic systems?
That doesn't mean the crypto-anarchist project must fail. Encryption is invaluable: while the vast majority of other technological advances--sedentary agriculture, writing, maths, roads, sewage systems, paper, the telegraph, electricity, the light bulb, cars, "computers," satellites, Google--have all increased the legibility of the world to the State, encryption does the opposite. The panopticon isn't an existing, established system but instead an equilibrium point that the State has to constantly push us toward: anytime the economic cost of that push is increased, it gives us more opportunities for creating spaces of genuine human autonomy.
But once you recast crypto-anarchism in that more moderate and stronger form, encryption moves from "our one hope against total domination" and a "hope that with courage, insight and solidarity we could use to resist" to something more banal: one tool of many. Not even a particularly effective tool: governments don't care about a bunch of nerds throwing PGP parties, and all the encryption in the world hasn't prevented the State from throwing Assange into jail (a pleasant jail with some fine Ecuadorian decor, but a jail nonetheless) and obliterating his organization.
[+] [-] mtgx|13 years ago|reply
http://www.youtube.com/watch?v=gbYXBJOFgeI
[+] [-] trotsky|13 years ago|reply
[+] [-] Egregore|13 years ago|reply
[+] [-] georgeorwell|13 years ago|reply
Being this paranoid he should be advocating "post-quantum cryptography", i.e. cryptographic methods that are secure even once somebody develops a quantum computer.
https://en.wikipedia.org/wiki/Post-quantum_cryptography
[+] [-] mtgx|13 years ago|reply
[+] [-] dsl|13 years ago|reply
A few people took on the risk of giving him a treasure trove of stolen documents (the VAST majority of which did had zero positive impact in being released), and he turned it into a soapbox.
[+] [-] unimpressive|13 years ago|reply
https://www.gpg4win.org/
An invalid security certificate, and even that only if you go out of your way to specify https. If the vast majority of users saw this, they'd go running; including myself. I can't in good conscious recommend crypto that doesn't have it's own security certificates under control.
I have as yet not seen any less shady open implementations of PGP out there.
Of course, because of the proprietary nature of windows, it is totally possible for them to have back doors which will break your encryption, but I'm fairly sure that there are ways to verify, even without source code; that Microsoft isn't pulling any funny business.[0]
[0]: Besides, I'd prefer a situation where politically unsavory backdoors have to be used to read your data, as opposed to it being plain text and free for all.
[+] [-] rdl|13 years ago|reply
The thing we really need (and what I'd fund if I had a spare $Xmm or so) is a great crypto API and solution to the user key management problem for iOS and Android, hooked into apps. It's technically easier to do on Android. On iOS, you're kind of stuck due to the core apps (mail, messages, etc.) being first-party Apple). It basically would take Apple deciding they cared about this issue, then building it into the OS in a way which didn't actually require trusting Apple completely, to work very well. Android has some steps toward this with some NSA projects, and wouldn't even necessarily require a full forking.
Some way to do tokenization and thus fairly transparent encryption on the client (phone) inside apps like the Facebook App, Twitter, etc. would also be nice. That's both a technical challenge and a UI/UX problem.
Silent Circle (from Jon Callas, Phil Zimmerman, Vinnie Moscaritolo (the PGP team...) and some Navy SEALs and defense contractors I knew from Iraq) actually seems like a pretty viable choice for sms, email, and voice right now. It unfortunately doesn't integrate into the social networks and other services people use, though.
[+] [-] rdl|13 years ago|reply
I also find Eric Hughes much easier to rally behind than Julian Assange, although John Gilmore is better still (although largely focuses on drug policy, now). Or John Perry Barlow or Mitch Kapor.
[+] [-] derrida|13 years ago|reply
[+] [-] spindritf|13 years ago|reply
I agree with Moxie Marlinspike on that, we were preparing for fascism but got social democracy[1]. Assange is still preparing for fascism.
[1] https://www.youtube.com/watch?v=eG0KrT6pBPk
[+] [-] droithomme|13 years ago|reply
You mean the guy who is in internal exile in Britain because as a journalist he revealed war crimes committed by Britain's partner the United States? He's the guy who is delusional about the form of government that surrounds him, huh? Glad it's as simple as that.
[+] [-] codeulike|13 years ago|reply
[+] [-] ahelwer|13 years ago|reply
[+] [-] yason|13 years ago|reply
How it shows most prominently at the moment is file sharing. Setting the endless copyright debates aside, what happens is that governments and large companies want to interfere with the privacy of what citizens are doing with their own bits. They say copying is theft while citizens consider twiddling their own bits a private matter that's none of anyone else's business. The citizens don't understand that while it's de facto legal to form a sneakernet—the actual legal status probably varies from place to place but nobody has ever been sued for sneakernet filesharing because nobody else never knows about it—it's illegal to form a filesharing network over the internet.
I don't promote or demote filesharing per se: it's just the cutting edge where the future trends will show years before they land elsewhere and that's what it makes it so interesting. A marginal slice of file sharing has already moved to anonymous darknets but in a few years and after a few more bad copyright/freedom-of-speech incidents with bad publicity, there will eventually be a breakthrough and the whole filesharing activity will go underground en masse.
When the masses go for it, the capacity and availability of invisible darknets will raise in orders of magnitude. That means there will be other providers in the anonymous networks as well, websites and services. There already are some, from anonymous wikis, anonymous project pages to anonymous forums but currently those are playgrounds. That is not so in ten years: there will be a major "bazaar" going on underground. While everything is anonymous and untraceable, everything is also secure. An online bank could very well operate in the anonymous network because the traffic is already cryptographically signed, and users can enjoy strong authentication if they wish to or remain a pair of anonymous public/private keys.
At that point the traditional grasp of internet control is lost.
The institutions governing the internet and the copyright and whatnot are faced with a big dilemma: do they dare to ban and make illegal anything that's not specifically permitted on the internet and if so, how to go about it in actuality. Do they lobby for laws that only allow ISPs to let citizens connect to a http proxy that validates all traffic to be "approved"? Do they extend the charges for any use of the invisible internet that is deemed illegal, to cover all users of the invisible internet?
We're still in the shadowdancing mode but the stakes are going higher, and in at most ten years the problem of control versus anonymity will have come out in the public.
We better know what we want, at that point.
[+] [-] mtgx|13 years ago|reply
[+] [-] aurelianito|13 years ago|reply
http://xkcd.com/538/
[+] [-] yakiv|13 years ago|reply
[+] [-] coopdog|13 years ago|reply
The battle is winning the minds of the average person, by showing them that an encrypted, unmonitored, uncensored internet is in their best interests and not something to fear.
Or in the worst case, show that an all powerful (and therefore eventually corrupt) government is the greater of two evils. The proper tool for this is probably cheap, scalable marketing stunts and compelling media that spells this out in layman's terms.
[+] [-] skrebbel|13 years ago|reply
Not entirely false, but http://xkcd.com/538/
[+] [-] contingencies|13 years ago|reply
[+] [-] strictfp|13 years ago|reply
The truth is that the only reasonable thing to do is to become politically active.
If you can't beat them, join them.
[+] [-] genuine|13 years ago|reply
Unfortunately, that is how you know if someone has gone off the deep end.
I agree though that we should all be encrypting communication, but our government helped develop the methods of encryption, and some methods have been known to have backdoors: http://www-cs-faculty.stanford.edu/~eroberts/cs201/projects/...
Why it is highly recommended not to implement your own encryption method, we shouldn't be using something that could easily be decrypted by the wrong people either. We need to study methods that we use extremely well, and be aware that encryption susceptible to decryption via brute-force with significant resources are just as dangerous as backdoors.
I also advocate development of wireless mesh networking technology to handle larger adhoc networks. While those that wish to spy could still become a member of an adhoc network, it would significantly complicate things for them.
[+] [-] mseebach|13 years ago|reply
Why It Matters: [...] This blog isn’t terribly controversial. But if only the “controversial” stuff is private, then privacy is itself suspicious. Thus, privacy should be on by default.
https://www.tbray.org/ongoing/When/201x/2012/12/02/HTTPS
EDIT: Ironically, I accidentally linked to the non-HTTPS version. Fixed.
[+] [-] jimmytucson|13 years ago|reply
Let's say there were some massive breech of probable cause before billions of people used the internet every day. Maybe some king is issuing multitudinous search warrants to go and seize all postal mail correspondence within some large sector of the population. I'm thinking of something "old tymey" here.
Okay. Well, it seems to me, the 18th century version of Julian Assange would essentially argue that people need to start getting good at writing in and decoding cryptograms. What we really need is the 21st century version of James Otis.
I know, it's a very, very unfair analogy. But it explains my point. If this stuff that William Binney is talking about is really going on, wouldn't a legal or a socio-political (not sure if I'm even using that term correctly) response be more lasting and effective than having everybody start writing letters in the form of a NY Times crossword puzzle?
[+] [-] mrich|13 years ago|reply