Hacker News Reader

Comment by zexodus | Hacker News Reader

I'm so tired of these...

Is there really no way we can make it technologically impossible for them to exfiltrate user data?

You can make it technologically impossible, but they can also come and arrest you just for using such technology. So its not really a technical problem, its a social/political one.

Sure, but then they need to send a physical person, which is expensive and impossible to scale. Making it extremely expensive is probably good enough.

(Feels like we have this same discussion over and over on HN.)

I don't understand this take. There is no real way in which a private person can make law enforcement "more expensive". The government can always find means as long as it is supported by a sufficiently big fraction of its people.

1 person using encryption vs 1 million people using encryption.

Sure, they won't go out and arrest all one million, but from an individual perspective it's basically security by obscurity.

Once that's the case, otherwise legal activities (e.g. protesting, or making political statements) run the risk of making you a target. Law enforcement can then punish you for your legal activity by selectively enforcing this other law.

The resulting situation is one where everyone knows to some extent "you better shut up if you know what's good for you", and puts a chilling effect on otherwise legal forms of civic engagement.

You might point out that there are already laws on the books that let them do this, but I'm sure they wouldn't mind another.

It needs to be done on both fronts.

Privacy-conscious apps and communications tools need to be developed, and we need to build the consensus that privacy is important.

edit: Anyone know why Briar doesn't have the feature for known contacts to be a "courier" for other contacts?

Background: Briar is the encrypted messaging app that works over tor, local wifi and bluetooth. If Alice sends a message to Charles but she isn't connected, the app will hold it until it detects Alice and Charles are in proximity.

My desired feature: If Bob is a verified contact with both Alice and Charles, Briar should be able to hand the message from Alice to Bob, and then deliver it to Charles.

I don't think there's a way with a phone that people would actually be willing to use. At some point it has to be decrypted to be displayed to the user and there's always the chance there's a flaw somewhere in the stack from hardware to OS to app etc that will have a gap to exfiltrate the data.

Avoiding centralised services is generally a good start. You could also do something like encrypt any messages through PGP even if the service you're using is already "e2e encrypted" like iMessage or signal

There are no technical solutions to human problems. This has been explained over and over again, most famously in Randall Munro's XKCD comic where the secret police resort to hitting someone with a $5 wrench until they give up the password.

If you're in a repressive state and you're worried about your data being exfiltrated the best security practice of all is not to create records of illegal activity. If you have to store such material, don't keep it on a communications device, put it on an external storage device, hide it somewhere outside your home, and don't tell anyone about it.

The problem is they'll legislate for the providers to insert back doors, negating cryptographic hardness.

They have to make custom software illegal at some point.

Given how many of these stories have been coming out, I'm sure they're considering it.

They don't have to make it illegal. They can just create all kinds of barriers like only allowing government approved OSes for essential services, and then using custom software can become grounds for suspicion and subject you to searches, etc.

I'm certain this is the direction we are all heading, unfortunately.

Governments will sanction the major proprietary OSes and compel Apple, Google, Microsoft to participate in their surveillance programs, and those will have remote integrity attestation and will be the only hardware and software you will be able to use to access essential services and the internet as whole, most likely.

The usage of alternative software won't be outright illegal, but will get you on a watchlist. Like you said, they don't need to make other software illegal, just make circumventing the blocks illegal.

They can't arrest everyone, but, it's one more gray area thing that can and will be used against you should the government ever decide they have a bone to pick with you specifically so you can get away with it for a long time, until suddenly you don't.

https://xkcd.com/538/ User data can only be as safe as the user.

Reply on news.ycombinator.com