Comment by dalbasal | Hacker News Reader

Comment by dalbasal | Hacker News Reader

The failure (our failure) to make the ideals and ideas of freedom in the digital age accessible and present in politics is a disaster. FOSS ideas, open culture ideas. What the world wide web actual is... It's not even that they disagree, they aren't even aware.

We spent decades fiddling arguments with one another while events just took their course. Politicians don't understand or care about any of these ideas. The public doesn't either. When "something must be done" about this or that... because digital culture progresses to some point, the deep well of ideas that dominated web culture have zero impact.

Ultimately, the encryption argument is being had between spooks and tech monopolies. Politicians are bystanders. There is no "freedom of speech" equivalent, no idea of the current technological age to guide them. No flag for the public to rally to.

The right to privacy is great, but we can't just keep arguing by analogy. We need modern age thinking to define this for modern circumstances.

I'm cynical, I think it's an impossible battle. The value being left on the table has grown year over year and that doesn't seem likely to change anytime soon. We're rapidly approaching a point where crime happens because you're either too poor for the tech or you wanted it to happen, medicine is waking up to the potential of constant biometric collection/analysis, and people are being showered in free and useful software because the the first time in history they're valuable just for existing. To contrast this, digital privacy makes everything a bit harder while protecting people from parties that just want to seek them things they'll enjoy and state actors who aren't really compelled by much more than the honor system to respect instructions to change their ways. Eventually the mountain of potential is going to simply eclipse the perceived benefits.

We have email with autocrypt to rally to.

Abandon the smart phone crap and anything with a large organization attached to it.

> Abandon the smart phone crap

https://puri.sm/products/librem-5

More,

Repairable smartphones, with various choices for operating systems from brands which doesn't seem to exhibit hypocrisy when it comes their values -

https://www.fairphone.com/en/

https://www.pine64.org/pinephone/

https://www.shiftphones.com/en/

https://myteracube.com/

But when the parent said,

> Abandon the smart phone crap

It may not just be about open hardware/OS/Apps for smartphone but the hold the carrier has on the customer and therein privacy issues. This is a hard problem to solve because cellular services are oligopolies or even monopolies and amplified by lack of open modem/radio hardware.

So ditching smartphones for a portable computer might be even a good option[1].

[1]https://news.ycombinator.com/item?id=25917178

> from brands which doesn't seem to exhibit hypocrisy when it comes their values

This is a strong accusation. Which of those brands are recommended by the FSF [0]? Which of them are actually trying to change the industry with their investments (promoting freedom/privacy) [1]? Which of them are fighting against planned obsolescence by providing lifetime updates [2]? Given all that I am not sure who is a hypocrite.

> So ditching smartphones for a portable computer might be even a good option

Librem 5 is a portable computer [3].

[0] https://www.fsf.org/givingguide/v11/

[1] https://puri.sm/posts/breaking-ground/

[2] https://source.puri.sm/Librem5/community-wiki/-/wikis/Freque...

[3] https://puri.sm/posts/mobile-desktop-convergence/

My comment wasn't targeted at Purism, I hoped a break after 'More,' would have helped make that point but I should have used better grammar.

Apart from that I stand by what I said.

Then whom did you accuse of hypocrisy and why?

Not OP, but common sense is telling me the answer you seek is "other companies not in the list by OP"

I have a pinephone. Once the modem manager stuff gets up streamed (so MMS works) and the distros make it easier to update the modem firmware (or they start shipping with updated firmware from the factory) these will probably be in the "just turn it on and use it" state.

There's been an insane degree of improvement in the software over the past 6 months.

This is kind of what I mean. This is not a flag to rally behind. Maybe for nerds, not for our society. Even then it isn't a flag. It's a refuge.

This is what I mean by "failure" to get into political consciousness and politicians heads... If you want to be free you need the freedom of others. Hiding in technical bastions is like praying in secret. Freedom of religion it isn't, even if it's better than nothing.

> We have email with autocrypt to rally to.

For those unfamiliar:

https://autocrypt.org/

There are plans to add support for it to Tutanota[0], although ironically that blog post was written over a year ago and their FAQ still says that they don't even support interoperable PGP.[1]

When ProtonMail were asked two years ago about supporting Autocrypt, their response was quite negative but also vague[2], and there doesn't seem to have been much progress since.[3]

[0] https://tutanota.com/blog/posts/email-encryption/

[1] https://tutanota.com/faq/#pgp

[2] https://old.reddit.com/r/ProtonMail/comments/8dqk5n/protonma...

[3] https://github.com/ProtonMail/WebClient/issues/120

Baking in automatic crypto to email is a lost cause, since email is not as straight-forward as let's say Signal, which only succeeds because it exists in a monoculture (iOS/Android). Email operates on 100s of different clients (and operating systems), and you get people replying-to-all by mistake, and fat-fingering sensitive data to random recipients (which is possible in Signal, but not nearly as bad as e-mail where e-mail can exist in any hostile environment it wants, unlike Signal which has a user which is more careful about what he/she sends).

> e-mail can exist in any hostile environment it wants, unlike Signal which has a user which is more careful

Could you explain why Signal users are more careful than email users? Aren't all Signal users also email users?

I suppose the reverse isn't true, and there are machines that send people transactional emails (e.g. receipts for online purchases) which it would be nice to secure with PGP.

The real problem with securing email, from my perspective, is the difficulty of creating a UX which accurately and intuitively conveys to the user whether the message they are sending is secure (and what "secure" means). By using a separate app which never sends plaintext, that's basically a non-problem.

> Could you explain why Signal users are more careful than email users?

Sorry, I forgot to mention that phones are typically seen as more secure, and phones are the go-to operating systems that people use now, and are (usually) permanently switched on, so have to be secure since they are constantly exposed to the public Internet. (Yes, Windows can be seen as secure too, but IMHO phones are more secure. Windows is getting better over the years and have mitigated and patched a lot of the common vulns you do see).

> Aren't all Signal users also email users?

No. Email is often reached from many different OSes and environments. It is common and expected to see people logging into their Gmail from potentially compromised systems at work, or at Internet cafes. They just assume that whenever they login, the are 'secure' when in some cases the Internet cafe is logging everything or their employer has setup 'monitoring' software to ensure they are actually working and not dossing.

Signal: not so much. They have a single secure device that they use to communicate with, and since Signal is tied to a SIM: migrating your old Signal 'account' to a new SIM is impossible.

> phones are typically seen as more secure

Like most popular ideas in technology this is absolutely ridiculous and I actually laughed out loud when I read it. Most consumer phones (especially outside the US) ship with malware installed. Often worse than consumer PCs especially since even someone with little skill can install completely free OSes.

Also: Almost every popular OS has FDE as an option (often the default one) which was the main feature (other than sand boxing, which browsers do well enough) that supposedly made phones secure.

I am hearing about Autocrypt for the first time. Mind filling me in on how it is different from PGP encryption?

What you propose is just burying your head in the sand and waiting for the storm. This isn't about "large organizations" this is about the tendency for governments to sacrifice freedom for greed, control, and power. It doesn't matter if the government is a progressive European government or a Authoritarian Chinese government. They all want to more transparency into what citizens are up to "for their own good". That's what we need to fight.

Reply on news.ycombinator.com