Comment by izzytcp | Hacker News Reader

Comment by izzytcp | Hacker News Reader

Parent Full thread

All of you smart arses out here and there, we know it, we know. We know, VPNs and other stuff in between are not so secure and not private. Stop saying it, don't you have some other piece of knowledge to be proud of? for god's sake. Tor and Signal are better than Public Cloud, Chrome & SMS if you're looking for privacy. Don't you have common sense?

- HTTPS is more secure and private than HTTP

- Signal is more secure and private than SMS/Skype/Messenger

- Tor/Browser is more secure and private than Cloud/Chrome

- FileVault, BitLocker and LUKS are more secure and private than RAW unencrypted disk data

- 2FA and Hashing is better than raw Passwords

- List goes on and on.

All you have to do is: get out of your desperate situation where "everything's controlled", because it's not true, at least not everything. We don't have the best security and privacy but we have some of it AND we need to fight to keep and expand it.

Now go on and tell me how smart you are and how you see things different and generalize stuff again in replies. Or you can just shut up and stand up to contribute and improve it.

There are two parts.

1) Yes, you can build better encryption and privacy preserving technology. That is a technology and adoption problem.

2) There is so much you can do once the law says you can’t encrypt certain kinds of things and if you do, the state will be after you. That is a social problem. Our elected leaders aren’t serving us.

Not mutually exclusive. We have to do both. Build better tech, educate others and esp our politicians who can change the fabric of society.

3) People are willing to sacrifice freedoms to protect kids, likely a result of not understanding the complexities of such a nightmarish problem and how much freedom will have to be sacrificed and how little protection will be gained at great cost. Why? Because our society does not allow us to perform cost benefit analysis on a child's well being despite reality giving us no such relief as removing the need for such.

> Because our society does not allow us to perform cost benefit analysis on a child's well being

I hate this sooo much! Having children really makes some people entirely unable to think. I've heard people entirely willing to outlaw any form of encryption to "protect" their children from pedophiles despite the likelihood of getting their identity stolen, bankrupt and unable to feed their children being significantly higher than a pedophile targeting their child even now, and would increase by several orders of magnitude if we suddenly weren't allowed to encrypt things like e-banking and email.

4) real freedoms for imaginary kids.

This tirade and "go improve it" recommendation may make sense in a vacuum, without governments undermining encryption and criminalizing parts of the activities to provide secure, private comms "because terrorism/pornography/covid/whatever".

In the real world, many states freely admit that they will fight against secure, private messaging between citizens (say, because law enforcement needs a backdoor to solve crimes). And while governments can, and do, make laws to that effect, improvement will be legislated away beyond a certain point. This also produces a chilling effect on engineering: why work on a technology that will likely be outlawed if successful?

In most cases when the government is making laws to criminalize X trying to overpower it with better engineering just does not work. My 2c.

Why not work on said technology? It can even end up being very lucrative to take up the cause. Do you forget that prior to the 90s (and also during part of the 90s) much of the lead-in to the completely common, widely commercially and privately used digital encryption we have today was completely discouraged or even made illegal by governments except for their own use.

It was a generation of pioneers who weren't quite so timid about working on new technology and fight absurd, archaic laws that built the foundations of modern consumer/commercial encryption. The U.S government especially tried very hard to chill these efforts too, and failed (so far at least).

I agree vehemently with your call to go work on this stuff.

What I don’t understand is why you seem to be suggesting that as an alternative to opposing legislation which would prohibit such work.

Both can be done, activist opposition, and a practical move to build the tools that make circumventing such privacy-hating regulatory nonsense all the more easy to pull off. More simply put: while active public opposition to bad laws is good, few things nullify bad laws better than a fait accompli that's out of the bag.

The first half I disagree with: if a law is passed, circumvention tools won’t help. This is what it seems like you have been arguing for up till now, and frankly not getting traction.

However, the second part (about the fait accompli) is a very important point.

You’d have to achieve widespread usage among the general population for this to be effective to be effective.

I don't see how you could disagree on the first point though. Not only is is often done today to varying degrees of success depending on country and technology, it was exactly how much of consumer crypto got its start back in the earlier days of the internet. During the 90's technologies like RSA, PGP and others basically got built and released while constantly treading all over extremely shaky legal ground. It was their widespread usefulness and steadily growing adoption by users that allowed them to in effect circumvent archaic laws until they were simply recognized as legally usable.

I am well of the history.

Treading shaky legal ground is not the same as circumvention.

This time around, if encryption is banned, they will do more than just hound Phil Zimmerman for years on end.

They’ll come after the end users, and ‘circumvention’ won’t help.

I don't understand what people have against VPNs. I don't want my ISP knowing when I use Tor, since my ISP is in the same country as me and that makes it easier for them to have access to me if they wanted to. Using a VPN means my ISP only sees me connecting to a VPN (which is arguably more innocuous). Then you can use Tor from there. And if you only use HTTPS sites, then only you and the end site can read the traffic. And obviously don't login to accounts created outside of Tor or that use details that can lead back to your real identity.

There are some points against using VPN with Tor here: https://write.privacytools.io/my-thoughts-on-security/slicin...

>> We don't have the best security and privacy

We today probably have the best privacy tools in all of recorded history. Modern encryption means that anyone on the planet can send a message to anyone else on the planet without fear of government decryption in transit (asymmetric public keys, Tor, PGP, pick your tools). Using freely available tools I can encrypt a file on a USB drive in a way that even an NSA data center running for a billion years wouldn't decrypt. Those sorts of things were not possible a hundred years ago. They weren't really possible only a generation ago.

We also today probably have the best surveillance tools in all of recorded history. Modern phones mean that anyone on the planet can have their location tracked in real time, and if exploited (perhaps by a malicious update to the OS or apps to add a backdoor), the most intimate information about the user can be harvested in bulk, or they can be watched and listened to, without being served a warrant, even in their own home. These sorts of things were not possible a hundred years ago. They weren't really possible only a generation ago.

I mean, fair enough to a lot of the above, but you’re decrying people saying VPN’s are insecure then showing how wrong they are by talking about six otherwise unrelated security technologies.

The VPN’s people will actually use are a poor trade-off that will leave most people with a false sense of security at best, and probably with significantly less rights over what happens to their data regardless.

Don’t disagree with you on the rest of the above.

You know because some smart arse said it.

I don't have the technical skills to improve it. Someone I inform might.

Sit down dude. You think you are standing up for rights, but are making a case for weaker security by trusting, i.e. that MS and Apple won't backdoor you in an instant if they must. You are literally, actually, a shill, especially with this pompous presentation.

None of your list is better than nothing, if the authoritarians want your data. Except, maybe, Tor, and only if people contribute to running exit nodes.

If it isn't end-to-end, and only you know and control your keys, you are already doomed. In other words, you cannot trust any service with your keys. That includes https and signal.

> If it isn't end-to-end, and only you know and control your keys, you are already doomed. In other words, you cannot trust any service with your keys. That includes https and signal.

https://en.wikipedia.org/wiki/Security-in-depth

Reply on news.ycombinator.com