My Privacy Plan | Hacker News Reader

My Privacy Plan

benrmatthews.com

58 pointsbenrmatthews44 comments

Well, I don't think I've ever felt so paranoid. Thanks President Obama, this is the exact opposite thing we wanted you to do when we voted for you.

I think people are beginning to realize that the demorepublican party is two sides of the same coin. Tails you lose, heads they win.

Ha, no. Save possibly Rand Paul, I still think the Republicans are way worse.

There are good guys and bad guys in every movie. They are all actors in a movie that gives the illusion that they are actually governing in people's interest. Read Chomsky's Manufactured Consent and see beyond the illusion.

I've read Chomsky. I get the argument, but I reject it. It fails to address that I actually agree with a lot of things the Obama Administration has made progress on, especially regarding domestic policy. Health care, gay rights are some big ones.

I think a Republican administration would have would have been way worse on those issues, and not much different on civil liberties or privacy.

Obama 'started' supporting gay marriage in 2011. Given the current trajectory of public opinion, I would be surprised if the GOP candidate for president in 2020 or 2024 doesn't support gay marriage.

I have a difficult time getting excited that one party changes their mind when 51% of voters support something, while the other party waits until 60% support it.

You can repeat that story with the drug war (fighting over the 18:1 or 200:1 disparity in crack:powder cocaine sentences without actually reexamining what the hell we're doing) or fiscal policy (should we cut taxes for 99% of people or 100% of people, and should we cut government spending by $1T or $1.1T) or even health care (where no one has the stomach to even mention the words 'single payer').

Well, the proposition was that Democrats and Republicans are the same side of the coin. In terms of state surveillance, that certainly is appearing to be true. On social issues, it's clearly opposite, because I got my gay rights 9 years earlier than your proposition argues.

> I have a difficult time getting excited that one party changes their mind when 51% of voters support something, while the other party waits until 60% support it.

Okay, don't get excited then, that's your right. I just can't buy the argument that a McCain or Romney administration would have been no different than the Obama Administration on all the issues. That's painting with a broad brush.

Would that be the Rand Paul who said this?

"I’m not for profiling people on the color of their skin, or on their religion, but I would take into account where they’ve been traveling and perhaps, you might have to indirectly take into account whether or not they’ve been going to radical political speeches by religious leaders. It wouldn’t be that they are Islamic. But if someone is attending speeches from someone who is promoting the violent overthrow of our government, that’s really an offense that we should be going after — they should be deported or put in prison".

http://articles.baltimoresun.com/2011-06-08/entertainment/ba...

I realize the consequence of throwing support behind Rand Paul, because as an Obama supporter, there's clearly a lot I would disagree with him on. But, enough with the cult of personalities; if he's going to make waves on this issue in Congress, then I support him on it. That does not mean I suddenly agree with all of his policy positions. This is politics, not football. I care about the issues, not the teams.

There is a fundamental problem with being truly secure online. That flaw is that the sites and services we use are compromised. In order to me to write this comment, I'm relying on the free wifi at Starbucks to not log my actions. I'm relying on their ISP to not log the traffic to HN's servers. I'm relying on Google's Chrome browser to correctly recognize HN's certificate and encrypt my packets properly, and I'm relying on Entrust Certification Authority to correctly assert that I am actually sending my data to HN and not an intermediary. Then I'm relying on HN to receive my data and store it securely (well, as secure as I should expect a public forum to be, but the scenario applies just as well to banks and email providers). Finally, I'm relying on all software installed on my laptop (including the operating system) to respect my privacy by not logging keystrokes.

Any 3-letter agency that wanted to track my internet usage only needs to collude with one of these services to compromise my privacy. I think the solution to privacy is a combination between government transparency and accountability, and our own due diligence to carefully vet the programs and services we use.

>In order to me to write this comment, I'm relying on the free wifi at Starbucks to not log my actions.

No, you aren't. Hacker News is HTTPS-exclusive.

They still know where to send my packets, and it's possible that they are proxying the SSL (although that requires a secondary breach in Chrome's CA list and/or Entrust).

In today's environment, the most secure person computing set-up might be Richard Stallman's. I don't think I could do it though, as it is too restrictive.

http://stallman.org/stallman-computing.html

There's one more thing all Tor users with good bandwidth should consider: start relaying.

I relay when I can, which is not very often because I am mostly behind a NAT which I have no control over.

If everyone uses Adblock, it could be detrimental to a lot of free web services that are supported solely on ad revenue. I am not sure if there is a good solution here...

I feel like this is a rather porous plan for privacy.

> 1. Sign up to relevant pressure groups

Ok, I like this one. No reason not to. Support the EFF.

> 2. Install HTTPS Everywhere

Since I believe that the NSA likely already have all of the relevant private keys, I'm not sure about this one. HTTPS is still better than no HTTPS, but don't overestimate it.

> 3. Install Adblock Plus

Yep ok. Making it harder to be tracked across the internet is good.

> 4. Review my browser use

Sure. Use Chrome + best practices.

> 5. Review web services I use and switch if necessary

Suddenly this appears: a catch-all "change everything I do on the internet". Stop using Facebook, Skype, Gmail, etc. Probably not going to happen. I'll come back to this in a second.

> 6. Download and Use Tor

Given my belief that the government is probably running enough nodes to reconstruct Tor identities, I'm not convinced that this helps much.

> 7. Use the Onion Browser on my mobile

See #6.

> 8. Run "host-proof" Web applications

This is an extension of #5. I like the idea, but this is hard. Startups like Ciphercloud and Social Fortress are ostensibly working on it; I look forward to when they're available. I imagine that if any significant percentage of people start using, say, Social Fortress on Facebook, Facebook will make it against the TOS.

I do think that the NSA has probably broken RSA. It's notable that they haven't approved it for securing classified data, despite the fact that it would significantly simplify the DOD's current pains around key distribution. This, of course, takes SSL with it, but importantly takes PGP, too. Running GPGMail on a desktop isn't enough.

###

My privacy plan will involve learning more about politics. Who are our representatives? What districts play disproportionate roles here? How are the oversight committees formed? Who's on them and why? What can we do to be involved? This is a much longer timescale play -- it's a lifetime of being involved, rather than a quick technological fix now. I'm not confusing a personal interest here with having influence -- I'm just one person, and not a high-profile one, and alone I won't have much impact. But, I don't believe that there's any substitute for a politically engaged constituency.

I don't believe that Washington is fundamentally corrupt or irreversibly damaged. In the Snowden video he spoke about how these decisions are viewed as policy and not law -- so a future president may decide to go off the deep end into despotism. But since it's still policy, there are systems for this. It's not ok to simply complain that the system will defend itself and there's nothing you can do. Apply the same mindset that drives you through the multiple brick walls that are a startup to changing Washington.

>> 4. Review my browser use

> Sure. Use Chrome + best practices.

If you care about your privacy your best bet is Firefox, not Chrome

I was thinking much the same thing. "Yeah, lets review our browser use, and then switch to the browser made by one of the companies pointed to in this whole mess.

I think that's a completely simplistic and disingenuous statement. The Chrome team have done a _lot_ the last few years to strengthen security on the web. And you're forgetting that the main attack vectors these days are through plugins, not the core browser itself. Chrome's decision to bundle their own secure version of Flash (that actually updates without a hassle) has probably done more good for people's computers than anything else peddled by other companies recently.

Last time I checked Chrome it wasn't possible to remove certificates from the store, has this changed yet?

> 5. Review web services I use and switch if necessary > Suddenly this appears: a catch-all "change everything I do on the internet". Stop using Facebook, Skype, Gmail, etc. Probably not going to happen. I'll come back to this in a second.

You say that, but having switched to DuckDuckGo[1] for the past few weeks I'm slowly but surely losing my reliance on Google for personal stuff. Sure, it's not as good as Google in terms of finding relevant results or having the rest of the ecosystem, but it's no worse than using the web a few years ago, which to me is good enough (and I make some pretty esoteric searches).

I'm looking further into moving away from the traditional Internet to something a bit more self-hosted and it looks possible.

> You say that, but having switched to DuckDuckGo[1] for the past few weeks I'm slowly but surely losing my reliance on Google for personal stuff.

Everyone you converse with via email still uses Gmail.

Game over.

> [DuckDuckGo] not as good as Google in terms of finding relevant results or having the rest of the ecosystem, but it's no worse than using the web a few years ago

About a year or so ago I was using DuckDuckGo for every search, but after a couple months switched back after falling into the habit of following almost every DDG search with another one on Google to make sure I was getting the real results.

Frustratingly, where DDG failed most was on the generic stuff where I expected to find results on the bigger sites. Esoteric searches are harder to judge, as neither engine reliably presented what I'd consider high-confidence results on first query.

The trick about using DDG is their !bang [1] notation, which you can use to pipe searches directly into the search of another site. ( At least for many large sites.) Especially, if you prefix your search with !g you will get the Google result page for that search. This is of course a privacy vs usability trade off, but Google still sees only a few searches. With this, I actually think that DDG beats Google as search engine, since quite often I want to just search Wikipedia (!w) or Stackexchange (!se) and in this cases DDG takes me directly to these sites.

[1]https://duckduckgo.com/bang.html

Wait, in what world would RSA be able to be broken with current tech to the degree that the NSA can decode it fast enough to make it essentially plaintext?

I get the whole keeping it for later decryption bit but really, 4096 bit RSA is not going to be easily borked no matter what scale of computing power you throw at it.

A quantum computer would generate private keys readily. Quantum computers are well within the accepted laws of physics and there are multiple companies working on them. None is believed to exist with sufficient power to find an RSA private key quickly today, but I'll just mention that the first conventional computers were invented in secret for breaking codes.

> use encryption at rest, e.g., encrypt your documents with > AES before you send them to Google Drive.

Syncdocs http://syncdocs.com does Google Drive encryption at rest with AES256, however, who knows if the NSA has already cracked AES?

The mobile Onion Browser, as disclosed on their website and not app store description, has secure security shortcomings that make it at best worthless at worst dangerous.

This is a good start, but in the end the NSA can bypass any of these measure if needed (even the cryptography). The only think that really can change this situation is a protest versus your political representatives.

You think NSA has a way to break AES/RSA?

https://sslimgs.xkcd.com/comics/security.png

I don't think that scales very well...

Alas, the NSA can afford a million dollar cluster to crack your password...

A million dollar cluster won't make a dent in cracking an AES key of a proper size. Not unless the NSA have managed to solve some pretty baffling math problems and keep it secret.

The NSA is currently the largest employer of mathematicians in the US. To think they haven't found anything of use would be naive at best. http://www.nsa.gov/research/tech_transfer/advanced_math/

AES is a specification of the U.S. National Institute of Standards and Technology (NIST). USA use it to encrypt the most sensitive informations. It's hard to think that they would use a broken cryptographyc algorithm themselves

All the computers in the world wouldn't be able to brute force AES with a strong key in less than 10 quadrillion years [1]. They would be better off spending millions in four-leaf clovers and faceroll the password.

That said if they knew a way to crack AES or RSA it would be a different story (a nightmare).

[1] http://blog.agilebits.com/2013/03/09/guess-why-were-moving-t...

the common xkcd-answer when it comes to cryptography.. http://xkcd.com/538/

It simply does not need to scale very well to scare the few people which understand crypto and plausible deniability.

Learn and understand crypto, develop and follow procedure to embrace secure end-to-end communications with your peers.

Move out of the US.

I did that five years ago after coming to the conclusion that the US didn't care about any of these abuses and that decades of surveillance state would go by without any improvement. I implored everyone that would listen to leave; I thought that was the end of it.

After Snowden proved me absolutely and indelibly wrong, I decided this week to come back.

These people operate in secret because they can't justify their actions in a free and open debate. The secrecy has now been lifted.

There's a war coming. It's time to fight.

Here's what I did. http://www.battle-school.co.uk/Blog/2013/06/08/its-our-own-f... Got rid of every cloud based service I use.

I use Dropbox with encfs. But now I'm wondering if the client could have a backdoor, since it's a binary.

Reply on news.ycombinator.com