For Hackers, Anonymity Was Once Critical. That’s Changing
nytimes.com
nytimes.com
People need to be able to make mistakes - or voice uncomfortable truths, blow whistles etc - without having to worry about repurcussions in some unknown future.
It's 2018, but we're still quick to grab the pitchforks and torch the place - metaphorically speaking.
In older days if you escaped the actual pitchforks you could move 20 miles away and start over. Now every moment of teen foolishness, those naive political beliefs at university, and that joint you smoked but "did not inhale" are either photographed or documented in perpetuity against your real name.
That seems a massively foolish gift to everyone with a pitchfork, or looking to spend an amusing hour assembling a lynch mob, or even a short sighted potential employer. God help you if you want to run for office 30 years after your foolish teen excesses.
So, the main point isn't to bad mouth the old USSR, but to demonstrate why the option you present is unworkable.
Just like if e.g. in an alternate prohibition-era 20s everybody had drinking photos of others (since most still drank). Still plenty of room to condemn e.g. a person with teen photo that shows they are gay.
Everyone else unless you are rich enough, or powerful enough. Thus in 2045, humanity's second great period of serfdom commenced.
Also don't be a future person that embarrasses easily.
As soon as someone realizes this, you can practically see the dollar signs light up in their eyes.
Of course, nobody holds the power forever, and eventually there would be other people who overthrow those and throw them to the pitchfork mob too. Which will eat them as eagerly as they ate somebody else at their prompting a short time ago. But it wouldn't make it any better for people that have already been eaten by the mob before that.
The only solution for this is to get rid of the pitchfork mobs.
One of the things that strikes me in reading the news is how the conflicts are roughly the same as they were in Genesis and Exodus.
My current take is that it is easier to find new land than it is to change human nature. I'm not saying it's not worthwhile to focus on changing judgmentalism and lack of grace in oneself. But I am skeptical of our species' ability to do it en masse.
Yes, but evolutionary flaws of mankind can't be wished away (and even if they could, they might have other side-benefits that we'd loose, as they co-evolved in very complex mechanisms. Perhaps having too much empathy can make you easy to be wiped out).
Anonymity, however, can be achieved with technical means.
Anonymity and privacy, on the other hand, are scalable solutions.
On a personal level, it's not even the case necessarily that people with greater empathy are kinder people. It's sometimes the case that they are simply better armed to harm you than someone who can't tell from your body language if their attack wounded you -- if it made you upset.
If you only give empathy to those who "deserve" it, you're basically doing the same thing as people who have no empathy and just treat people well or badly based on arbitrary tribal markers.
An anonymous accusation has no weight. But that's not what they're for. They're a suggestion to investigate something. Because if it's real then there should be other evidence -- third party witnesses, documents, phone records, surveillance footage, a pattern of behavior where a more recent incident can actually be proven, etc.
No one should take them seriously as evidence but journalists should take them seriously as tips. And if the journalists following the lead actually find something that can stand on its own, it's only then (and not before) that you have a real story instead of an unsubstantiated anonymous accusation.
Anonymous tips are not worthless -- they're actually really important -- they're just not evidence.
The need to ask for somebody to go public before investigating their claims is so that you can attempt to discredit their claim by discrediting their person.
Yes, that's the traditional way for the powerful to hide their misdemeanors. It absolutely does not help in getting any kind of truth.
The goal isn't necessarily to collect everything. It is just to convince the population that they're being constantly monitored. The fear that they'll be "silenced" for speaking in public about the wrongdoings of the powerful is enough for most people to submit to their demands. Anyone who claims they "have nothing to hide," is delusional. Once enough people are in that state of fear, the state can make up something you done wrong and nobody is going to risk their neck to try and defend you.
I registered this handle via Tor. I don't use it on any other sites. I'll probably ditch it after a year or two, since on a long enough timeline little bits of info slip out when making substantive comments. An astute observer can suss out what times I post, what topics I comment on, and make educated guesses about my identity.
I have a "real" identity - a public persona. It has a cutesy nickname, a twitter handle, and all the other online presence. But it's all incredibly carefully curated, since as the article points out, one slip up and you're done. The feeling when posting with it is so suffocating I rarely do.
i keep my public internet persona as public as it needs to be - but i do not want it to be connectable to my physical persona. I want people to take what i say for what it is, rather than who i am in real life.
But, i do want people to judge what i have said in the past as my public internet persona, because this will give me incentive to not be hypocritical, and also to ensure i project a single, unified point of view throughout my history.
Being _too_ anonymous means you don't consider what you say, nor what the effects might be. It may lead to detrimental results for large systems, and i won't be part of that.
The language I use in work related emails is very different than the language I use socially online.
From a technical perspective, using an additional long-standing nym isn't much different from just using a single one! The people they're profiling (!) are essentially microcelebrities - notable in their circles, presenting in meatspace, being photographed, etc. I'm sure their [stated] nyms are still serving many purposes, but preserving privacy they aren't!
Meanwhile (and this is why I take issue) there most certainly is a type of "working" anonymity that all kinds of people rely on, which is in the process of being involuntarily destroyed. It's almost inherently impossible to report on without resorting to indirect narratives, primarily based on some kind of disempowerment. But I think what they all really boil down to is our individual self-determination over the scope of our own relationships.
It's a parallel je ne sais quoi to dragnet surveillance. I personally don't have anything to hide, and if a government agent wanted to get up in every aspect my life I would be powerless to prevent it. BUT we all benefit from keeping the unnotable generally unnoted, rather than cataloged, characterized, and used to presume to know us removed from our personal context.
(I know I haven't done a great job describing this - it's awfully tough to describe the indescribable/unenumerable. But someone is going to have to, in some very persuasive universally-appealing words, if we're to retain any of it).
Regarding your latter point, re. self-determination, I'll try a stab at making it more relatable. Let me know if this approaches that ineffable problem.
Our presentation of ourselves is essentially plastic; with few exceptions, changing social or temporal variables change our self-expression. We do not act around our family as we would around our colleagues or around our close friends. We did not act as a child as we did as a teenager, or young adult, or elder. It is socially acceptable and even expected to modify "who you are" to fit the situation you are in.
The internet and mass surveillance has crystallized that plastic nature. You are not just the person you are now, but also the person you were ten years ago. You are not just the person in front of your employer or parent, but also whoever you are to your friends or romantic partners. You are no longer allowed to pick and choose how to represent yourself to another person; your entire history is available for their perusal. The best representatives for the downside of this, I think, are teens. Everyone can remember stupid things they said or did as a teenager, and for the first time, none of that history will ever be erased. The words you spoke at one of the most irresponsible and impulsive parts of your life will forever be a Sword of Damocles hanging above your head.
(Oddly enough, I think this is not, fundamentally, an awful thing, but for the fact that social understanding has not advanced past the monkey-brain thinking that the perusing in front of you will act according to the sum of information you have about them. In the old days, you would see that they were a decent enough worker and that would be it. But now you know they like to, I don't know, drink a lot or smoke weed in their own time and that colors everything else about them in your eyes. I can't help but feel that within a few generations the old way of thinking will die out, by necessity if nothing else, but agree that for the present it represents a significant problem)
They key here is that the Cardinal can hang virtually anybody just by willing to do so. The justification is secondary, just for appearances' sake - if the Cardinal wants somebody hanged, they'll hang (unless they find a more powerful ally, of course), and "finding something" is just a formality, like signing the documents in proper places with proper name. Wielding this power is the key, and that key would decide whether your past words would be your doom or a justifiable youthful digression. If you look at how it happens, you can see the power currents of the society the same way you can see the magnetic field lines by watching metal dust affected by it.
It prevents me from writing harsh things. I figure that anonymity is temporary, that real identities can always be determined if someone digs hard enough. I don't want something I say in the heat of the moment to come back to haunt me years later.
It's not for everybody. I've probably made some secret enemies that know my name. But for me, it seems to be the best way.
People see it as a right to say whatever they want to whomever they want, but really should we be able to do that without consequence?
Anyway, I love this idea - it just sucks that I can tend to have what some would consider politically extreme ideas that some employers may or may not find off putting. I inevitably create "alt" accounts on sites like Reddit to voice these views.
Also, as a rule I only use this name on sites that are clean and professional, ie: github, where I know I will only post sophisticated things that could benefit my career, unlike reddit where i just want to fuck around.
That's a terrible policy. Anyone can create a username as you then and post offensive things and you'd be screwed.
Also some names are super common and therefore cannot be proven to be just one person. Just google Rick J Wagner and tell me if you only find one of them.
In 2010, I could have said "women do not have a penis" and faced zero criticism. But if I say the same thing today in the ultra SJW woke society of 2018, it's grounds for instant allegations of transphobia, sexism, and a whole bunch of accusations that result in social and professional ostracizing without any sort of verification or context. All it takes for this is one person who dislikes me enough to dig through $age years of online history and finds that one statement that does not hold to this instant's ultra progressive intersectional social justice standards.
Put simply: I do not trust society at large to remain rational enough to want to attach my real name to anything but the most mundane of statements.
Plugins please, maybe tor-browser run out of the text-based-web-speeder 'request policy'-plugin -and no, 'ublock' is not an option (-;
Meanwhile pseudonym hacking continues (e.g. Phineas Fisher) and interesting data dumps make their way to journalists ( https://en.wikipedia.org/wiki/Paradise_Papers)
The NSA / MI# / [Military Intel of Country X] know me. I know them. I don't do shit. They don't do shit beyond some pranks and exchanging banter. What are people so paranoid about?
When you get to meet the boogeymen, they have amazing tech developed by someone else, but the people who use it are stupid, incompetent, paranoid military average joes who more often than not shoot themselves on the foot or cause the problem they were trying to prevent because they never de-escalate.
Secrecy, violence and a carefully-built media reputation just hides how ineffective they are despite mass surveillance and infiltration of all public online communities.
If you are able to think critically about risks, going to Defcon isn't very risky.
Mass surveillance means that "the man" probably knows[1] you have an interest in security whether you attend or not.
Hackers of many skill levels attend Defcon... merely showing up isn't going to suddenly make the FBI start bugging you.
[1] https://thehackernews.com/2014/07/beware-of-nsa-if-you-are-p...
What is still lacking AFAIK are services that can guarantee anonymity for the average user without jumping through a ludicrous number of hoops that ultimately looks suspicious.
I also think there's a bit of survivor bias here - yes, many old-times hackers came out of the shadows of anonymity or pseudonymity, either voluntarily or involuntarily, either because they grew up and got a family and a business and a personal brand, or because they're not into shady stuff that requires hiding anymore, or because whatever they have been doing became so successful one can't be anonymous anymore, etc. That doesn't mean others still don't have anonymity, just NYT did't got to talk to them - because they're anonymous and don't want to talk to NYT either...
I never knew what the meetup organizer's name was. Everyone always referred him with his userhandle and they did not know either.
This reminds me of "malwaretech" from wannacry
https://www.reddit.com/r/IAmA/comments/6cmmdf/iama_the_accid...
If even hackers don't care about privacy anymore, how can we expect it from the general population?
Anonymity is great for side projects that amount to practice, that you don't expect them to turn out well, or things you might be embarrassed of in the future, like comments on Reddit and hackernews.
For example,I am using a VPN now and my browser has strong privacy protections configured. I am very confident that my identity could still be revealed by analyzing my writing style and correlating other behavorial metadata. Although I am not certain,I assume anyone in infosec that is interested in my off-work activity is monitoring my hn posts.
Ways I've screwes up over the years:
* Forgot to sanitize my whois
* Used my regular email when consulting about IT work with IT/infosec people I did not know
* Reused passwords for many years.
* Didn't change reused password after inadvertently posting it on a public forum/chat.
* Didn't use a VPN or Tor for many many years.
* Assumed for a long time that 0days were used by an elite few and that nobody would burn one on a boring person like myself.
* Assumed IT coworkers/bosses would never actively stalk me off-work because I assumed only a serious psycopath would do that to a human they see everyday.
* Assumed my home computers' security without considering how easy it is for anyone to literally break into my place (has happened).
* much more
All in all, acheiving a reasonable level of security and privacy is a very difficult task for an individual.
One of the reasons I got into security is because I kept thinking "I do IT for a living. What about all the normal unsuspecting people? What about my family members,heck pretty much anyone." It feels too much like a one-sided war against the 99% of people who are not tech-savvy. I want to help protect people who don't know how to protect themselves. Interestingly,the most diffult part is making people understand that they are under attack by extremely hostile parties.
Fortunately there are many pros that share my view. @evacide on twitter for example helps women who have had their devices hacked by a stalker/hacker.
For someone who does not work in IT, being monitored by a hacker practically drives them into extreme paranoia. It causes real mental harm. IMO,it should be treated as assault.
I realize most of what I said is about hackers deanonymizing people and not the other way around like the article. I just thought it was important to note how many hackers are part of the problem and that we should consider how much more non-hackers need anonymity,pseudonymity and privacy in general.
Lastly, I'd like to say this to anyone who tracks or monitors people(analytics count): consent is key. Imagine someone looking at you bare naked,this is fine if and only if they have your consent.