If you want a counterpoint to this, I have one:
http://news.ycombinator.com/item?id=1690871
The article touches on this towards the end.
http://news.ycombinator.com/item?id=1690871
The article touches on this towards the end.
While he certainly has a point that badly done circumvention tools give a false feeling of safety, I don't think completely giving up is a solution either.
No matter what, activists in such countries are already daring their lives (through off-line activities). It is important to get some information out there, through regimes' firewalls, and the only way might be through such tools.
And only circumvention tools (such as TOR) that are public, open source, and actively being used can be subject to scrutiny (otherwise it'd be a completely academic exercise), which improves the security of the tools over the long run.
Edit: Also, with the recent push for internet censorship even in western countries it's starting to be pretty clear we need the tools here too.
That's fallacious because our need for circumvention tools is irrelevant. You are talking about moral imperatives and I'm talking about engineering.
The fact of the matter is, there is no way to build an assuredly secure messaging system; every attempt to build cryptographically secured messaging has failed, often multiple times. It isn't unlikely that every fielded cryptographic system is broken right now, and we're just waiting to find out how.
In the real world, resources matter. Nothing is perfect, so really we're talking about a contest between two parties. Will the circumvention tool authors figure out the flaws (that expose their messages, that allow attackers to use technical flaws in their tools to mislead users into compromising themselves, that allow attackers to easily pinpoint circumventing traffic, &c), or inadvertently fix them by laying more countermeasures into their code? Or will governments find those flaws first, and use them to turn the tools against their users.
The governments we're talking --- Iran, Syria, China --- have zero scruples, unlimited funds, and (if you're under the delusion that dictatorships have a hard time finding technical talent or that money doesn't simply buy it like anything else) demonstrated access to research and development skill in this specific area.
It doesn't matter that we need these tools. I'm betting on the hostile governments. If you think the dictatorships will win, you need to keep in mind that the worst case isn't "false sense of security". The worst case is, "run this tool and a government computer somewhere silently puts your name on a list".
Yes, that was very clear. I wish I could be amoral like you.
The worst case is, "run this tool and a government computer somewhere silently puts your name on a list"
Not always a problem. If enough people use the tool (which will be automatically the case as more ends up in the firewall), it's impossible to distinguish the people that use it for serious purposes (like anti-govt activism) or less serious purposes (like trolling anonymously or watching porn...).
Even circumvention tool authors --- I'm guessing I know more of them than you? --- will tell you that's not an uncommon pathology.
And I don't have any illusion that just geeks can "save the world", but they can at least provide support in some areas, such as allowing journalists to communicate with activists.
So you think the world would be a better place without any circumvention tools?
Those of us behind the "relative safety of a western computer keyboard" may have more of an obligation to act than those under more strenuous restrictions. At least in our case we likely won't be hanged from a crane, as you say. Or at least our governments will have the good courtesy to have us shipped off to a friendly tinpot dictatorship first so we can be spared the humiliation of having such a thing done at home.
I don't think marketing really comes into it, all the circumvention tool vendors are quite direct and honest with the current state of their efforts and the extent upon which they can be relied. Also, they're not commercial efforts, and the creators stand to make no real direct economic gains from their adoption.
I wouldn't criticize someone using circumvention tools in Iran. I might criticize an American who tried to make a name for themselves by building half-assed tools for Iranian dissidents. That was my point.
I think the chances such a theoretical user who will engage in subversion at any rate no matter the risk level is much more likely to be less capable of creating a circumvention tool than say the tor team.