Notifications for targeted attacks
facebook.com
facebook.com
The way to preserve what HN has that is good (and I'm not saying it's great, only that it's better than it might be) is to have a clear set of principles and communicate them. If you know a better set of principles, where the fitness function is high-quality discussion at scale, I'd love to hear what they are. Otherwise I'm going to suspect you of magical thinking, in which HN's current level is assumed to just happen for free, and for some reason meddlesome thought police keep intruding on it.
I guess I would draw a clear distinction between aggression and sarcasm. I do believe you that it's a difficult task to make things function healthily at scale and I'm sure those involved in issuing recent guidelines were correct to do so. And of course I agree that we shouldn't be aggressive (though waveform apparently needs a reminder of this). But I'm pretty uncomfortable with eliminating sarcasm. That's really a very common mode of communication in some cultures. It feels very sterile/corporate to not be allowed to simply be sarcastic. Especially when the target of sarcasm is basically western hegemony, as it was here!
The guidelines don't rule out sarcasm. They ask for comments to be civil and substantive. The Venn diagram of those things may not have a lot of common area but there's definitely some. Just don't ask me to specify what it is—that's probably too hard.
I don't see why any non-Western countries would be interested in me, so yeah.
Sounds like quite a story; any details you can share?
Didn't really think much of it, account logs showed no access from outside of my own IP addresses and analysing all the emails I had received in the past few months found nothing out of place. Leads me to believe (Well, hope.) that the attack was detected and blocked by google.
About 8 months (had to double check that, since it sure felt like less) later I flew over to defcon and the FBI searched my hotel room, seizing my throwaway phone and laptop. On my way out of the country I was again stopped at JFK by a bunch of agents holding a grand jury subpoena.
Ended up being asked a bunch of rather silly questions regarding some ORNL hack(and others) that I couldn't really answer.
Wasn't arrested, got to spend an extra day in the states and flew out.
Curiosity, that's all.
Small, fun little world we live in. I was amazed to learn that you were so young. Hope you stay out of trouble and put your curious brain to good use. :) Don't forget your SOCKS.
Looks like that, although I remembered it being more red.
Interesting story. For completeness, how do you know it was the FBI that searched your room?
This is an important aspect. The affected individual might be using several other services that don't have the sophistication of Facebook's security team. Facebook might have been able to thwart the attack but his/her other online accounts might have been compromised.
That said, I find SMS-based 2FA to be pretty dodgy as well. Cloudflare was hacked once by somebody who managed gain access to an admin's mobile phone by social engineering their telco. If a site does not offer TOTP based 2FA I usually don't bother using it.
This is just propaganda by Facebook showing everyone that it cares about your privacy. Unfortunately, I believe government all around the world are going to have a talk with Facebook about what is acceptable levels of privacy.
Imagine getting a message like this out of the blue, not even knowing who's after you. What are you going to do?
It's hard to fight a faceless enemy, especially when you can't even be sure if they really exist.
Protestors in Syria or China could probably already guess what such a message means, so I'm curious as to the amount of information needed for a person to be able to act on it?
As Snowden demonstrated there's no lack of westerners being spied on just because they happen to work at a telecom company.
The fact that there's no more information provided makes it far too easy for those people to just ignore these warnings as mistakes and go on with their lives.
I don't know if Facebook is going to be showing this to any western people, but when google showed me their version of the warning there was very little I could do with it since looking through my logs and emails showed no signs of any attempted attacks.
NSLs typically contain a nondisclosure requirement, frequently called a ''gag order,'' preventing the recipient of an NSL from disclosing that the FBI had requested the information.
...however:
The nondisclosure order must be authorized by the Director of the FBI, and only after he or she certifies "that otherwise there may result a danger to the national security of the United States, interference with a criminal, counterterrorism, or counterintelligence investigation, interference with diplomatic relations, or danger to the life or physical safety of any person.
So it seems this is regulated to some degree, though it is unclear what counts as "interference with a criminal, counterterrorism, or counterintelligence investigation".
- How would facebook detect nation-state attacks?
- How do we make the policy around it participative and open?
- Etc."We do this by a combination of traffic monitoring, incident tracking and utilizing cellular network infrastructure to notify the engineers responsible for sending the warning in time between the NSL reaching front desk and CEO becoming aware of its content."
> - How do we make the policy around it participative and open?
"Everyone is free to receive a warning about being targeted by a state or state-sponsored actor, regardless of race, religion, gender, income and sexual preferences of said actor."
That is, unless we're talking about their newest PHP optimizer or ad toolkit.
While FB as a company certainly is not altruistic, they employ quite a few privacy-minded engineers. Data leaks to the outside of their walled garden are very likely treated as company-wide problems, but as the LGBT doxes showed, there are wide implications even within their walls. [0]
As they try to capture ever larger parts of the online population, they will* keep colliding with non-Western, non-SV norms. The privacy issues may be nothing but a canary in the goldmine, because they are mostly an expression of non-SV values. For example, I have my doubts about how long images of traditional Hindu artwork would be allowed to stay up...
0: http://www.huffingtonpost.com/2015/03/27/facebook-authentic-...
Personally, I'm beginning to feel Google and Facebook are getting more and more open about US politics going against their interests.
> These countries tend to use fairly obvious and naive attacks, as opposed to the US that might be able to demand information by an NSL.
I don't think I agree with that point. Isn't the exact opposite the case? Russia, China, et al. have to actually do the work and hack the US citizen, while the US GOV can just send the NSL and have the data delivered on silver platter by US companies, who are bound by law to comply?