Hacker News Reader

I used to be the same way but then I became victim to a very sophisticated and coordinated cyberattack. It all started when one of my financial accounts was compromised. I was able to get that mess cleaned up and I beefed up my security everywhere but then I started to get very strange things happening. I would get phishing e-mails that were very well crafted, so much so that they were able to get past g-mail's filters. I would get e-mails from "lost friends" trying to get in contact with me. They knew my name, my address, my phone numbers, where I worked, and even places I had visited on my day's off. I would get calls where the person would appear to sound like normal. They knew my name and all pertinent details. They would try to get me to small chat with them before asking out of the blue questions like what type of car was my first car. I am somewhat of a paranoid so I do not disclose any of this information willingly.

It was very very freaky to say the least. I've beefed up all my security credentials and deleted a lot of my social media accounts as well. Most of what I do online now is pseudonymous.

Lots of people say stuff like "I have nothing to hide" but trust me, you definitely do. You don't want people to know your first and last name, your address, where you work, your phone number. There are criminals out there that will try to rip you off any second they get and try to pull all sorts of tricks to get access to your money. The level of effort I saw in these attempts was significant and I could see how lots of people could get tricked by it. I would say that all of the attempts from the calls to the e-mails were custom written specifically based on the information they knew about me.

In hindsight, this is all my fault. I was too trusting of big tech companies putting my information out there for all to see and now I am paying the price for it.

Methinks scammers are just getting better at phishing and extortion.

Eg, scammers are now scrapping haveibeenpwned.com, then matching it with all the other publicly available information. I imagine non-geeks easily believing the extortion emails I now routinely receive.

The other major problem is how public information can so often be used to authenticate as you. Someone asked Amazon customer support for the last address I had something shipped to after supplying them with my name and an address I used to live at.

No amount of security best practices on your part can save you from these sorts of attacks.

It's a form of the tragedy of the commons. Any given individual generally has little to actually lose by allowing themselves to be surveilled by corporations. In aggregate, however, that increasing surveillance has a deleterious effect on society.

You make a good point, but I think individuals underestimate what they have to lose. We all have something to hide (in many cases including intimacy, trade secrets, client confidentiality and our plans for negotiations/auctions/etc). To submit to blanket corporate surveillance is to risk that data leaking to criminals or being taken by governments.

They aren't aware of it though.

I guarantee you that if brand X would have explicitly stated what they were doing the outcry would have ended it all rather quickly.

They have nothing to fear or lose. So that one guy gets his promotion while everyone's privacy is sold for pennies.

Facebook popularity (among others) challenges your guarantee :)

I recently lost a domestic argument over Google Home Minis in my kid's rooms... we just sound like conspiracy theorists, even in this post-Snowden era. The response is a shrug of the shoulders more often than not. Honestly it's just going to be played out. The masses will need to get screwed badly before we collectively wake up.

I'm opting to simply prepare myself for the fallout, like rampant identity theft, loss of privacy, lack of objective / critical news coverage, etc. As an example, the SASS service I built and run does absolutely zero user tracking / analytics, anticipating that some day this will be appreciated.

> my ISP can see what I'm pulling on the net

You could use a VPN if you wish to avoid that.

Generally, I agree with you and wrote about my thoughts:

https://austingwalters.com/the-last-free-generation/

My concern is really that we wont have any kind of freedom in the years to come. There's pretty much nothing you can do. Only thing we can kind of do is provide some privacy, sometimes...

Then the VPN company knows what you are pulling on the net...

And still the ISP to some extent. Content fingerprinting just from the packet sizes / timing is unreasonably effective. It doesn't matter that the packets are encrypted.

Some VPNs conduct third-party audits to be able to say that they don't persist info about your traffic. That's usually more than what an ISP is willing/able to say.

I worked for quite a lot of companies that had a few planned and random audits by third parties, including government. We did things one way when they were there. We did it totally differently when they weren't. Made me doubt the value of anything other than live surveillance of the company or network, remote and with well-paid person stationed there.

I, admittedly don't know enough about VPNs. But could I just ssh tunnel to an ec2 instance and browse the web with a sox proxy?

You'd still be leaking through dns (and basically all non-http communication) and applications which don't adhere to proxy settings, which are a lot. Webrtc doesn't go through the proxy either iirc

Also, you're still trusting Amazon to play by the rules, which is unlikely if state actors are involved as the comment (which spawned this discussion) insinuated

It's educational to try.

I had to tunnel dns through openvpn to make dnssec reliable.

On a wifi router, there's loads of leakage; mdns, ntp, things devices do to check for captive portal, weather apps, etc etc.

You can mitm https, but breaks hsts sites, unless you hack your browser

Agree, a simple VPN is not enough. You need to know how to use the more advanced security tools like using bitmessage for e-mail/messaging, signal with end to end encryption, TOR etc. Everything needs to be encrypted directly on your computer before it is sent and using super strong passwords on everything. All big companies and tech companies provide zero protection for their customer's. It is your duty to do it if you want true security/privacy.

All of which is never going to happen for all but the most knowledgeable and dedicated. What is one blank spot on a map but an invitation for the cartographer to devote more resources toward discovery. If this matters to us, we need a more universal solution.

I had been wondering about that. Are there any mechanisms in say, Nord VPN, that stop them from tracking you or is it just shifting your trust from the ISP to a VPN provider?

There's a few mechanisms but they're essentially all market/regulatory forces which might not be adequate enough for some. At the end of the day you're still just shifting your traffic from the ISP to the VPN provider and you still need to trust your VPN company like you would (or wouldn't) your ISP.

As far as the forces go, the first and biggest force should probably be the legal one, companies generally can't lie or mislead while advertising or entering contracts. If a VPN company advertises that they don't keep logs and it's discovered that they keep logs it's a pretty good case for a claim against the company to get out of the contract at the very least. This all depends on specific countries, VPN companies involved, what claims those companies are making, etc. It should be noted that an employee doesn't need to leak anything for this to be the case, if the VPN company is involved in a public court case then it can be inferred whether they actually keep logs, this has been the case with at least one company.

The second force tends to work in favour of the VPN company and is the market forces involved, generally you might only have a handful of ISPs to choose from if you even have a choice as you could be stuck with a single cable company for instance. This isn't the case for VPN companies as you have literally thousands to choose from and they can be located anywhere in the world, and while this might not be a big deal if you're from a first world country with good network infrastructure and regulatory environment already it'll be a bigger deal for people living outside of these countries.

The third is somewhat related to the second, there's obviously a use case for privacy focused VPN companies whose value added product is simply to provide a good service and there's more than enough people that will want to make a business out of it. This is obviously the case for ISPs too where their value added product may be technically competent staff and ensuring that they'll uphold your privacy and won't engage in censorship, etc, but again access to these ISPs may be limited.

The other really good point I read about a while back is one of jurisdiction. Your isp is essentially guaranteed to be and operate in your country, giving your government jurisdiction over your ISP's information on you. A VPN may be in a different country, making things a hell of a lot more difficult for your government.

Good write up!

Although I pay for ProtonMail, this year I started using gmail again for almost everything - I found email search and automatic calendar integration compelling, especially for travel arrangements and keeping organized while traveling.

I am starting to regret the switch back to gmail because I am slipping on privacy for the sake of convenience.

EDIT: as a self labeled liberal, I find Kevin Williams very conservative politics somewhat disagreeable, but I still find his new book “ The Smallest Minority: Independent Thinking in the Age of Mob Politics” well worth reading and has slightly changed my viewpoint on the importance of personal liberty.

I recently setup a home security system for on a renovation project, so we wanted something that could send us notifications. There was exactly one system that works by SMS only, and I like the simplicity: no ads, no phoning home to some server etc. I check the bill on the Sim card that the only activity is texting with my phone.

In the larger context it's easy to forget that good compromises are available, it doesn't have to be all surveillance or nothing at all.

Do you mind sharing more with me about your setup? I've been researching options, including diy, but don't want/need all the bells and whistles espoused by the "easy"corporations.

It's a system made by Smanos, not diy, and has a central unit with battery backup, rfid tags and remote control. There are a bunch of sensors, standard stuff. The part that attracted me was the simplicity of using only text messages to control it and receive notifications.

"I try to live my life as if I'd become president one day and the CIA/FBI/NSA would use everything in their power to find something heinous they could use to destroy my life"

It's a smart move. It's more likely to happen during a regime change, shift in popular opinion, etc where a group is labelled unpopular, not to be tolerated, and/or dangerous. That has happened many times in my life. Then, the Patriot Act passed letting them black-bag people for torture flights or hold them indefinitely due to what they claim to find via secret surveillance whose methods aren't peer reviewable ("classified").

Part of the complaint about surveillance is the chilling effect it has of "someone is always watching over your shoulder", and the self-censoring which ensues; if you're going to "live as if I'd become president one day", the surveillance culture is having that chilling effect on you already even though you try to opt-out.

(And you're not getting any of the benefits those technologies could have; worst of both worlds).

I've got one of these smart devices in every room of my house. Love it. Fantastic experience. Maybe some day I'll pay for this. My take: I won't. I'm going to be fine. And I have no anxiety about this.

You're right. Most people "get away" with all this crap.

My take on this is that I can't miss what I never had. Knowing myself, once I get used to some convenient tech it's hard to go back. I got my first smartphone only two years ago and even then consciously restricted my usage by basically just using it like my old phone plus email and a browser. No WhatsApp, no cloud services, no voice assistant.

And every now and then when visiting a friend or colleague I'm amazed to see what's actually possible with modern tech if you fully embrace it. So I just fiddle around a bit out of curiosity and that's it.

I respect that. Personal discipline. I think you can make your life better with these things, but if you've tried them and determined they're not for you, then not having them seems sensible.

You can smoke and get away with it.

It's stupid anyway.

Nah, you can't. There is a continuous deleterious effect on your health, not just the increased risk of lung cancer. I used to smoke. The difference is huge when you don't. I've lived without the devices when I've been elsewhere for a while and I don't feel better in any way.

Corporate surveillance "pollutes" democracy like a car pollutes the air we breathe.

You'll get away with using a internal combustion engine. You'll be fine.

But you are harming me and everybody else.

I don't think you've demonstrated the externality. You don't have to come to my house. Chances are I probably won't invite you.

The externality is that a fosters an environment in which surveillance capitalism is able to thrive. It's not limited to just your home.

While one of your devices collected a conversation about wine and sells it to my insurance company years later. Tata nerd!

> I don't think you've demonstrated the externality.

Forbo's answers points it out.

> Chances are I probably won't invite you.

Can't you come up with a better argument?

You spoke against the hive mind on this forum and are getting downvoted. The agenda some people push on this forum is a bit asinine. Everyone is spying on me and intentionally out to get me. Corporation X, Y, Z are “evil”, etc. I wonder sometimes if this forum is turning into Reddit.

> my ISP can see what I'm pulling on the net

Will DNS over HTTPS help mitigate this?

No if the DoH Is performed by Cloudflare. We need decentralised DNS over HTTPS services, to guarantee anonymity. Obviously, no service should log users' activity as well

Your ISP won't see your DNS requests if you use DoH from Cloudflare. Cloudflare will, but so would whoever else you resolve queries with if it wasn't Cloudflare.

Never trust a tech company to give you privacy. Big mistake.

They still see traffic to an IP, and the hostnames in the certs. Also the request/response lengths can reveal what was fetched

ISPs will quickly move from domain names tracking to IPs tracking. How many times pornhub changes their IP? Never?

Its also a good idea (and costs nothing, not even time) to always put in different garbage information whenever you have to enter a name, dob, or whatever, anywhere. Even before widespread computer use I think,it made sense to always spell your name in a different way on every form. Slow the bastards down at least!

This is a good idea

I feel uneasy visiting friends with Alexa and all that.

I am not doing it.

Shouldn't be any more than friends who just have a smart phone.

Not at all. Alexa in known for uploading plenty of audio recordings. If phones were doing the same on a large scale people would notice the network traffic!

how do you inspect the cellular network traffic?

> how do you inspect the cellular network traffic?

You can investigate cell traffic with an SDR.

Various cheap devices catch plenty of interference from a phone in transmission. You don't have to analyze traffic to realize that phones are transmitting all the time without a good reason.

Also, you can easily intercept traffic over wifi. You can even do that while switching off GSM.

I used to joke about being uncomfortable with people visiting my apartment carrying smartphones, now I'm actually becoming uncomfortable with people visiting my apartment carrying smartphones. All of my technology is dumb as shit/rooted. I've physically taken the webcam out of my new laptops for years before the first power up, which is with a Debian DVD.

And I honestly think that I'm taking the lazy approach because I'm not overly concerned about being targeted, just caught in dragnets. Anybody practiced and willing to put in a few hours of work could own me. I could own me, so I know it's true. People who aren't technical with software, hardware, and web architecture just have no chance.

If you carry a phone, all the rest is just gravy. There's an old saying, "if you are going to get screwed anyway, you may as well try to enjoy it".