Hacker News Reader

Comment by mirimir | Hacker News Reader

Maybe a better question is how to prepare in advance. You can design your systems to avoid retaining user data. Or you can do business from a jurisdiction that doesn't recognize NSLs. Or perhaps from an unknown jurisdiction.

View on HN

> Or perhaps from an unknown jurisdiction.

Good luck with that, unless your vision of doing business doesn't involve ever charging customers, especially for b2b.

This is one of the primary use cases Bitcoin was invented to address.

I'm interested to see if the US is able to do anything to Bitfinex now as a litmus test to see how wide their reach is in 2018. As far as I know they have zero US presence, and don't offer services to US customers.

BTC-e went down hard for example. But they had some much more obvious links with criminal enterprise.

Although even if it is possible to stay outside of the reach of the US, losing access to the international banking system is quite the handicap for any business.

Given that even payment processors like Stripe are removing it because the verification time is too long, it is sadly not satisfying solution in any way.

Also, again, good luck getting any b2b when you tell them they need to pay in bitcoin only.

Luckily that's no longer an issue now that interest has faded and the mempool has cleared. Also, reducing on-chain transactions (and thus keeping the mempool clear, on-chain fees low, and verification times low) is pretty much the main use case of Lightening Network. The massive rise in fees and tx congestion was caused by the massive interest in BTC at the end of 2017. Something tells me if you are doing B2B in a shady jurisdiction, the companies you are doing work with would be more than willing to jump through hoops to deal exclusively in BTC

Yes, that's been a benefit of the collapse in speculative interest. Now transactions are affordable again. And regardless of Bitcoin's eventual fate, I'm rather confident that something like it or better will be available ongoingly.

You still have to buy crypto with real money. Real money CAN be traced.

Not necessarily. One can earn cryptocurrencies. That's especially so for coders and such. But yes, conversion with "real money" is problematic.

For small amounts, meatspace trades are doable using LocalBitcoins.com etc. For huge amounts, I suspect that expert assistance is available. It's the middle ground that's nontrivial.

> You still have to buy crypto with real money

False. You can mine it, you can receive it for free from someone else, and you can exchange goods/services for it.

Stripe removed it primarily because they got almost no adoption (most merchants I know using stripe weren’t even aware they offered it; merchants had to opt in).

Verification times are clearly an engineering problem, not a fundamental issue. Long-term solutions are currently under experimentation (lightning, DAG currencies, etc.)

Yes, it's certainly not a viable option for mass-market business. But there are niches where such OPSEC is standard practice. Some, such as drugs and arms dealing, were huge well before Bitcoin. Also hosting services for spam and botnets.

What Silk Road and Bitcoin demonstrated is the huge popularity of dark markets for retail drug sales. With product authenticity and seller reliability attested through customer reviews. And without risk of meatspace violence (except if busted, of course).

And sure, that stuff is still widely illegal. However, when laws are ignored by substantial minorities, their legitimacy becomes questionable. African Americans didn't end segregation in the US through petitioning legislatures. They broke the laws, creating a crisis, and forcing the federal government to act. Lesbian and gay activists did much the same, at least initially.

> Or you can do business from a jurisdiction that doesn't recognize NSLs. Or perhaps from an unknown jurisdiction.

That means not doing business in the US at all.

Which makes it fair game for direct targeted attacks by the NSA.

You can still be targeted if you’re a foreign business operating in the US.

Yes, you can and will be targeted. So if you go that route, you'd better know what you're doing.

The entire universe is fair game for the NSA.

Right. They pretty much do whatever they want, and lie as necessary to frustrate oversight, and protect operational methods. They are, after all, a branch of the military.

For someone outside the USA, a targeted attack by the NSA is no different than a targeted attack by anyone else. They are breaking the law, and you are allowed and supposed to defend against them. If you are within the USA, however, they can use things like these National Security Letters which you are not allowed to go against.

This is incorrect for a few reasons: you can certainly defend against NSLs, even those that you can't defend against are targeted (see the ones Twilio received), they're from the FBI and not the NSA, and as hackers the NSA is more skilled and more well-funded than most other attackers you're defending against.

The NSA does have lots of skilled hackers. But so do other national TLAs. And there are many freelance hackers.

Most countries will happily throw anyone under the bus if the US intelligence services ask them too. Besides if you're doing something the NSA doesn't like local law enforcement probably won't like it either.

Most countries, yes. But some countries, clearly no. Snowden is still in Russia, for example. And China typically doesn't cooperate with the NSA and its friends.

The NSA has made direct targeted attacks at US companies in the past. Just look at Google, they got NSLs and had to cooperate with PRISM yet at the same time the NSA still dug up their fiber and tapped it.

With the NSA's twisted logic that a search is not a search unless it matches and it's fine to search data so long as there's a chance it involves a non-US citizen I think jurisdiction is largely irrelevant for attacks other than the necessity of one seeing as the NSA has access to a secret court that has a history of never siding against them.

I'd view eliminating tyrannical government orders as a plus.

Indeed. The NSA has also intercepted device shipments, in order to install backdoors. And some US firms have resorted to shipping through more-or-less anonymous intermediaries to circumvent that.

If you sell physical goods, maybe not. If you’re a middleman or you sell digital goods, you still can do business with people living in the US.

Not if you want to get paid.

There are many ways to get paid. Even before Bitcoin etc.

You can do business with US customers. It's not uncommon. Maybe they need some OPSEC, but hey.

>You can design your systems to avoid retaining user data.

This helps for data from the past, but TLAs can order you to change your code such that it will in future retain data they want to see.

Right, that's why Lavabit shut down. And that's why ProtonMail operates from Switzerland, and CounterMail from Sweden. But the best hardcore option is not being vulnerable to coercion.

Reply on news.ycombinator.com