Richard Stallman: Online Publishers Should Let Readers Pay Anonymously | Hacker News Reader

Richard Stallman: Online Publishers Should Let Readers Pay Anonymously

theguardian.com

243 pointsashitlerferad79 comments

That is a nice and lovely idea...

Only every government everywhere hates it.

If it is possible to pay for something anonymously, then there is no following the money of others paying anonymously for other reasons. Including paying for products or services that are illegal or even with money from such sales.

Yes, you might compare this to cash. Cash that everyone used to carry around. It the higher denominations are marked (serial numbered), at least for US currency. Still it takes a LOT of effort to track their flow. For any kind of digital currency this scheme isn't tenable or repeatable. The tracking would either be too easy to prevent abuse, or too easy to abuse (get around).

Maybe we can have this level of freedom, if we admit that being at war with our population is a bad idea. If we allow the legal and controlled use of current vices. It wouldn't be perfect, but at least in that world we could probably get by with just controlling the income phase.

Though if you wanted to tax wealth (not income) you'd also need to report a total of 'outflow'. Which makes obtaining 'gifts' from sources not clearly related to work a vector suspect as tax avoidance via temporal displacement of wealth.

He's plugging GNU Taler which was specifically designed to be government friendly (allows collection of taxes and AML compliance and not easy to implement black markets). He's not talking about other kind cryptocurrencies. Stallman isn't a "down with the government" type of person despite being sceptical of surveillance.

So the title of his article is a lie, then.

> Publishers must let online readers pay for news anonymously

It's not anonymous if GNU Taler knows user identity.

GNU Taler is a technology, not a company, so it doesn't "know" things in the sense that would be bothersome here.

From GNU Taler's website:

“When you pay with Taler, your identity does not have to be revealed to the merchant. The bank, government and exchange will also never learn how you spent your electronic money. However, you can prove that you paid in court if necessary.”

OK, the exchange will know your identity. That's not anonymous.

Edit: Anonymity is a strong claim. Even Tor daemon warns "This is experimental software. Do not rely on it for strong anonymity."

Crypto signatures let you prove things without disclosing anything to a third party. Payment X was (singed by XYZ). Yo IRS I paid for it (signed by XYZ).

Looking at https://taler.net/citizens I see that Taler exchange accounts are funded by bank transfers. I see no indication that wallets are anonymized from deposit accounts. So do you argue that payments are fully anonymous?

Edit: IRS? Where does IRS come in for something anonymous?

There are ways to prove things without disclosing them using crypto.

A very simple example is using hashing. Let's say two friends A and B want to play head-or-tail in a chat discussion. If A first tells "head" or "tail" and then do the draw and win, B won't trust that A did not cheat. But if B do the draw, then A won't trust them. What you need is a way for either A or B to choose between "head" or "tail" and them commit to that choice and be able to prove it to the other after the other made the draw. This is possible without any trusted third-party:

— A choose for example "tail", they can hash that choice along with a "password" (generally called salt). For example they hash "tailLO7f-(86F" with md5, the result is "a079dcaae211e60756e5519058dcfc97".

— A sends that hash to B. B cannot know from the hash if A chose "head" or "tail", because the hash computation is way too difficult to inverse and they do not know the password to add after "head" or "tail".

— B draws a coin (or even chose the result, it doesn't really matter) and tells the result to A.

— Then A can prove to B that they chose "tail", by telling B the password "LO7f-(86F" so B can add that to "tail" and verify A's claim by computing the hash themselves.

Now this is a very simple example of how it is possible to prove things without disclosing information. It is of course much more complicated in the settings of financial transactions with multiple parties, but it shows that it is possible if necessary prove previously undisclosed claims.

Yes, I know that stuff. What I don't know is how Taler exchanges would handle customer information. The reliance on bank transfers and card payments is troubling. I've read https://taler.net/ with some care, and I'm still not clear.

At https://taler.net/governments I see:

> Taler is an electronic payment system that was built with the goal of supporting taxation. With Taler, the receiver of any form of payment is known, and the payment information comes attached with some details about what the payment was made for (but not the identity of the customer). Thus, governments can use this data to tax buisnesses and individuals based on their income, making tax evasion and black markets less viable.

However, at https://taler.net/citizens I see nothing about anonymizing deposits via bank transfer from payments. I can buy Bitcoin in the same way. But before I spend them, I can anonymize by mixing via Tor. Without that step, there is no substantive anonymity.

If I understand correctly, the reliance on bank transfers and card payments is only to put money in your wallet, which is a distinct (and asynchronous) operation from anonymous purchase. Kind of like a cash withdrawal irl (except it is not as obvious as looking at the bill's serial number to track where you spent the money).

For more information you can take a look at https://gnunet.org/sites/default/files/taler2016space.pdf (the Taler specific part starts at page 7).

Thanks :)

> The focus of this paper is GNU Taler, a new free software payment system designed to meet certain key ethical considerations from a social liberalism perspective. In Taler, the paying customer remains anonymous while the merchant is easily identified and thus taxable. Here, anonymous simply means that the payment process does not require any personal information from the customer, and that different transactions by the same customer are unlinkable. Naturally, the specifics of the transaction|such as delivery of goods to a shipping address, or the use of non-anonymous IP-based communication|may still leak information about the customer's identity.

That sounds pretty good, except for merchants ;)

But exchanges would clearly know customer identity, and they also handle payment to merchants, so there's the need to trust a single party. Real anonymity is impossible under those circumstances.

Have I missed something?

It seems like you are assuming a lot about how GNU Taler works. I don't know that you're wrong, but I'd be pretty confident that Stallman knows what he's doing and is not one to take the word "anonymous" lightly.

I don't much about Taler, but here is the site so you can see for yourself if you believe it: https://taler.net/

Lying is a strong, loaded term to toss around for a difference in opinion.

From the context, it's immediately clear that Stallman was referring to the relationship between the reader and the publisher. That still counts as anonymous from their perspective even if the reader also has other relationships with different parties (ISP, bank, government, etc.) on different terms.

It's disingenuous, at best, to style a system as "anonymous" when it's providing only a very limited sort of anonymity. Consider the dispute between the FBI etc and Apple over backdooring iPhone encryption. By the logic that you propose here, Apple could claim secure device encryption even with backdoors.

Indeed, claims about anonymity are a red flag for bullshit. Because it's so nontrivial. And because failure tends to be calamitous.

You seem to be claiming that Taler doesn't work without providing any actual arguments.

I've read the website and whitepaper carefully. I see no language about partition of trust between users' deposit accounts and payment systems. Yes, payments are blind-signed. But it's a single entity that's handling the entire process.

It does better than Bitcoin (taxes can be collected) but it looks like it could still be used for money laundering? The whole point is to make it impossible to find out who paid for what document, so money can be legally collected in one place without disclosing where it came from, beyond that it was sent through Taler.

As lumberjack said, you should look into GNU Taler [1]. Their goal is precisely to provide a privacy-enabled form of payments that is compatible with the rule of law in a democracy.

[1] https://taler.net/

The official stance of US law enforcement is already that large sums of cash are presumed guilty of illegal activity and you must prove the money innocent. My state has a state question coming up to require criminal charges to seize money and you should hear the DA's grinding and gnashing their teeth over how this will flood the state in crime and drugs.

With Bitcoin you get the best of both worlds, it's possible to be anonymous, but it's also possible to follow the money.

Is this really the reason people block ads?

I don't actually mind tracking as part of a useful service (like Google Maps). I block ads because they're 1) annoying 2) funding mass media.

Depriving Bezos' WaPo or Slim's NYT of revenue is definitely a feature. If billionaires want to push propaganda, the least they can do is foot the bill.

Tracking is a distant third. If an outlet I cared about ran ads, I'd white-list them. It just so happens that valuable sites like HN or developers' blogs either don't feature ads or do so in a way that adblockers don't interfere with (look at job posts here).

I personally block adds, not because of annoyance, but because of tracking. I find private collection of information a bigger threat than I do government tracking. I like neither, but given the option, I would rather be tracked by the government.

I am not accusing the OP of any bias or failing in ideals, just pointing out an interesting perspective on things that I got from reading [0]. 'Mistrust of government is pretty much universal, and that’s a good thing. Outside of the United States, however, people trust corporations even less.'

[0]http://www.disruptingjapan.com/how-ubers-failure-in-japan-ca...

> I find private collection of information a bigger threat than I do government tracking

Why?

Because the inherent idea is control of power. One would trust a small company over the government because the small company can't do much damage with only that much data, whereas the government can, combined with all the other data. The small company can earn more money, what we can rely on given that they are in it for the money, with helping us with the data than they can by selling the data.

How ever, as the company grows, or uses a system developed and controlled by a larger entity, the data being collected can be combined with other larger data sets and can become much more powerful and potentially hurtful for us. In the same scenario, the power of the government has still remained the same, and given the history of Power, we the common people have some measure of control over them. More control than one would have over the large corporation.

Hurtful how?

I admit I've really never understood that part of the argument.

To go with your example, ok, you have tracking data with a dozen smaller companies you've done transactions with online. Now they all merge and become one huge company, all that data is combined. How were you hurt by this action?

It gives the company power over you, either to raise your insurance rates because you like pork rinds, or to embarrass you or your underage sister because you've been linked and she just had an abortion. And like we're learning from facebook, there's a herd immunity component to it. If I vaccinate myself against tracking but you don't, you can infect me anyway.

It's a really shitty thing to do, and the problem we as a society face are people who are unable to abstract the idea into the dangers we can all face and protect ourselves against dangers we can't foresee.

That's what principles are for. We stand on basic principles of privacy and freedom because if we don't we get into a nonlinear mess of unintended and unforseen consequences- and we don't even know it.

Just like the deer that doesn't even know it's being hunted, we are in this game and don't even know what's eventually at stake. So we should stop it now.

I'm ok with banner ads. I'm not ok with tracking.

People have a right to privacy, and there's social expectations which ensure that people generally have it. Generally speaking, people don't like it when other people spend huge amounts of effort trying to learn things about them that they would prefer not to share.

It's more-or-less equivalent to if someone spent all their time looking through your trash and monitoring you 24/7 to learn if you're pregnant, what meds you're on, how much money you spend in a week, etc etc.

Well right, but that's not what I'm asking. The claim is that collating lots of small data sets together can cause harm to a person. That's what I'm asking about.

This information can be used to infer things about you, such as your sexual orientation, political positions, personality type, unhealthy behaviors and so on. Then machine learning algorithms can be used to deny you health insurance, credit or employment based on this data.

Or they can sell that data to other companies that will deny you any of these things. So better be careful with out you say, with which books you read, who your friends are and so on.

Or they can make deals with governments to reveal information about you, in exchange for regulatory favors.

Or maybe you're a robot with nothing to hide, but they can still make mistakes or wrong inferences and hurt you in the above ways.

And advertisement can be improved to bypass your cognitive defenses, or catch you at a vulnerable moment (all things that can be detected with enough data) and manipulate you into making decisions against your best interests.

In short, data disclosure can get you killed, poor and/or sick. If that was not the case, why would corporations be so secretive about their own stuff?

By the way, all of the above examples are not hypothetical. They are all based on things that are demonstrably already happening.

> By the way, all of the above examples are not hypothetical.

Then you have some citations?

http://www.nytimes.com/2012/02/19/magazine/shopping-habits.h...

http://www.forbes.com/sites/kashmirhill/2012/02/16/how-targe...

http://www.forbes.com/sites/robertlenzner/2013/09/23/attveri...

http://gawker.com/5669316/is-facebook-outing-gay-users-to-ad...

http://americablog.com/2013/03/facebook-might-know-youre-gay...

http://www.theatlantic.com/technology/archive/2016/01/why-go...

https://en.wikipedia.org/wiki/Parallel_construction

http://bgr.com/2014/01/23/apple-targeted-ads-mood-based/

http://arstechnica.com/business/2013/10/denied-for-that-loan...

http://www.wsj.com/articles/SB100014240527487046486045756207...

Ok well I'm not going to read like 500 links posted with no context.

The first one doesn't say anything about harm that I can see from my skimming, and the second one is the government paying the phone companies directly, which is concerning but it has nothing to do with tracking cookies or combining data sets. That's as far down as I went.

Egyptian police use gay dating apps to identify 'criminals', tax dodgers are being identified by their lavish lifestyles on instagram.

I don't think there was ever much doubt information can be used against you.

And Egyptian police are getting that data via. tracking cookies tied together? Or just going to the dating app companies directly?

If you're trying to convince people, saying, "it makes it easier to catch tax dodgers" is unlikely to be very effective. Also, catching tax dodgers on Instagram doesn't require tying together cookie data, does it? I mean tell me if I'm wrong and it does.

Asymmetric information put you at a disadvantage when you deal with them.

If you don't want to fund mass media, why are you reading it?

Reading it implies it has some value.

The same reason browser exploits are valuable: I cannot scrutinize every site I will visit in a second. Links pop up here, on Twitter, on IRC... It requires constant attention which is something computers are much better at than humans.

Also, I don't mind reading Bezos' blog. He doesn't need a tip jar though.

I read all kinds of things that I wouldn't want to fund. I read things that I would pay to get unpublished. I've spent hours reading Stormfront and Breitbart. I've even read Tom Friedman, god help me.

You don't listen to anybody you wouldn't pay? I listen to people I would pay to have behind bars.

1) security 2) annoyance 3) disagree with tracking 4) speed (rural internet yay!)

I find it particularly annoying when clients demand adverts on paid-product sites, i.e. they have a site which is fully funded by their sales but they want that tiny bit extra at a huge cost to site appearance and load times.

Yup. I pay for the WaPo subscription. I don't mind banner ads, but I don't allow tracking.

True. Ad blocking is also a stance against advertising per se. Reasons to block ads that may come before the tracking issue for a lot of people. In no particular order:

- Plain dislike of ads

- Miss targeted ads are (even more) annoying

- Malware

- Getting rid of visual clutter (from an aesthete's perspective)

- Irrelevance

- Browser speed

- Attempt to remove distraction

- Boycott / meaning harming a particular organisation’s finances

- A combination of those

- …

But tracking awareness is growing and resistance understandable. As users profiling grow, their liberty decrease.

> Is this really the reason people block ads?

I block ads mostly because they take up a lot of bandwidth and I don't have an unlimited amount on my cell. Plus, many ad networks don't seem to protect the users from malevolent javascript. I also block Flash for the same reason.

I'm not opposed to ads, I'm opposed to auto-play video script fests that try to sell me the thing I just browsed on Amazon.

I've thought before about online commerce, and wish we could find some way to adopt a Vending Machine model.

A vending machine is autonomous. It neither tracks nor engages the customer. It takes your money, and dispenses product. Since cash is untraceable, it keeps no record of what was bought and by whom. I feel at peace knowing I will give a vending machine a dollar, and I will receive a Coke, without fearing that I will start seeing targeted ads on my browser or in my inbox showing me more Coke products.

The problem, of course, is that the amount of money lost to a vending machine is negligible. And so if the soda machine eats my dollar, I will probably swear for a bit, but I'm not going to do much to seek recourse. That model would be difficult to extend to, say, Amazon, where I might buy an $800 laptop and need Amazon to have a record that I bought it in case they ship me a lemon.

Nonetheless, I still feel that the Vending Machine Model is something we should aspire to in the e-commerce age, even if we haven't reached it yet.

Maybe for the Amazon model they could issue a (public- that you keep private) key that allows you to challenge a request for proof of purchase. In other words, if you want a refund you show that you have this digital receipt.

Are vending machines really that analogous?

Vending machines are all about placement & location, and the ability of a vendor to find high traffic locations to put machines.

Machines get placed based on info about locations whether it's demographics, or a kind of business or whatever.

Individual transactions may not have identity tied to them, but it's not like the business is devoid of information about users, or hypotheses about them.

And on the internet... how do you get that info from your users aside from usage analytics (even if it's gross analytics)?

Vending machines certainly track purchases. They just don't track the people making the purchases.

The Internet can be the same. Lots of people buy X. Let's offer more if that. Y is a high traffic location (L as in URL). Etc.

I think you are thinking of cash in general rathe than vending machines in particular.

(But you can obtain receipts for cash transactions, which enable to legal recourse.)

And I agree with your point, and I've been using cash more often in my daily life for exactly this reason (anonymity and lack of data collection by credit card co's).

I mean he's right but as a business model it doesn't work. Also for people who haven't realised this is a plug for GNU Taler.

Anyway. I think the reason it doesn't work as a business model is that really, honestly, reading the paper provides very little in terms of value to the average person. It's a very mild source of entertainment and nothing more. It used to be that the newspapers where the only media to get important information (classifieds, job ads...etc). Not any more.

I strongly disagree.

I order a physical (weekly) newspaper for two reasons:

a) It provides a broad range of interesting articles on topics which are otherwise outside my filter bubble. This is incredibly important in an era where many people get all their news through their facebook feed.

b) It's perfect to flick through over breakfast :)

What is the name of the newspaper?

Coincidentally enough, given TFA:

https://en.wikipedia.org/wiki/The_Guardian_Weekly

It should also be mentioned that The Guardian is one of those newspapers that is willing to experiment with different models. E.g., they have a premium tier on iOS and Android for 3 Euro per month without ads:

https://www.theguardian.com/info/2013/aug/12/1

I'm still appalled when an ebook accepts Bitcoin but still asks for your "billing address".

Welcome to the fun and inflexible world of enterprise software. I attribute that to legacy code more than actual malevolence.

I don't know about other countries, but here in the EU businesses are often required to collect customers' billing address to comply with EU regulation, such as the VAT MOSS.

I find it interesting that this article is published on a platform that makes uBlock block 27 requests and most certainly does contain non-free javascript. Richard Stallman talks a lot about how these thing inhibit freedom and that we should not support those companies. But when he publishes an article on ad blocking he does this on a platform that absolutely does not meet his standard on freedom.

Maybe that's so he's not preaching to the converted? I'd imagine that most non-tech people wouldn't have any idea about the multiple layers of problems that online ad platforms can generate. I'm no tech genius, but I'm my friends' go to guy for anything computer related, and all of them have no idea about any of this, but most of them are tech literate at a 'general' level. I'd think the vast majority of people have no idea any this is even happening, let alone the downsides.

> But when he publishes an article on ad blocking he...

This is not an article on ad blocking.

It's an article on the need to be able to pay for things anonymously - to avoid being tracked.

Like how cash works in the real world.

I can highly recommend reading the actual article.

I'm guessing he's going for the lessor of (n) evils?

I don't think I've ever seen Stallman taking the "lesser evil" philosophy. As a smarter man than me said: "The lesser of two evils is still evil, and the enemy of my enemy is not my friend."

While the guardian website does contain non-free javascript, it is not required to read the article. I currently have noscript enabled and can read the article just fine. I don't even see any ads this way, and I'm not using an adblocker.

So I'd say the website does meet his standard for freedom, because you don't need any non-free software to read it.

> and most certainly does contain non-free javascript

You do not have to execute any javascript for the article to be read properly -- maybe it's what matter from his point of view.

The article can probably be viewed using LibreJS with GNU IceCat, that's the bar he uses for most websites (however he states that for GNU package hosting and things that the FSF supports, this bar is not high enough and outright denies any non-free JavaScript in those cases).

Is this something Brave is implementing with its "Brave Payments" [0]?

[0] https://blog.brave.com/introducing-brave-payments , HN discussion: https://news.ycombinator.com/item?id=12411405

Brave uses Bitcoin, which is otherwise known as "prosecution futures", so doesn't really fit the bill.

Got it, thanks.

See previous discussions on Taler

GNU Taler 0.0.0 released https://news.ycombinator.com/item?id=11840453

GNU Taler – Electronic payments for a liberal society https://news.ycombinator.com/item?id=10258312

A lot of them do. Per article. It's called https://blendle.com. Only an email address is required. And money. And it's not libre.

If it takes fiat currency it's probably not anonymous.

We accepted bitcoins from day one. Not sure if they still do as it was used I think 8 times over the course of 2 years. But given the people working there I wouldn't be surprised if they still accept them.

(Disclaimer: Former employee. Left in sept 2015.)

Blendle also tracks which articles you read. They also are working on an algorithm that picks the news for you, creating a filter bubble.

The filter will be opt-in, obviously.

And, again obviously, they need to keep track of which account is allowed access to which article. If only to allow you to read the article across multiple devices.

(Former employee here. Not in the exact loop these past 12 months)

I find it surprising that we havent already got a payment gateway that handles the entire user identity, including email forwarding.

I also hadn't realised Stallman wrote for the Guardian, but going through his historic articles shows a healthy number of articles.

Who will integrate such things? Everybody want's to know who is paying you.

As a startup it doesn't quite work, as the large companies that will want that info.

As a feature added to an existing gateway - say Amazon or Google - it could allow anonymized demographics whilst not exposing you to all kinds of data protection issues.

One of the main reasons for using a payment gateway is to avoid the legal requirements for card handling, it seems like a logical extension to me.

It could be a really good use case for a crypto currency. But eg. Bitcoin needs too long for a finished transaction (I don't want to wait ~10 minuntes until I can read an article). And you still can track down a person who purchased (separately) two articles by his keys or analysing the block chain.

I know we've a lot of crypto currencies right now, but I really hope that there is finally a new one coming, which is just simply fast, secure and somehow helps you paying anonymously.

In case of an article (which is cheap) there is no need to wait for confirmation, it's enough to wait for transaction to appear in mempool and have enough fee.

Seems like this is what Brave is trying to do, too:

https://blog.brave.com/introducing-brave-payments/

> Tracking, as we know, gives companies and governments dangerous power; the intimidating effect of general surveillance has been measured and is massive. The rate of visits to some Wikipedia pages – those about “al-Qaida”, “car bomb” and “Taliban” – declined by one-fifth after Edward Snowden showed us how much the US government spies on our internet activity.

Reply on news.ycombinator.com