Hacker News Reader

Comment by RyanZAG | Hacker News Reader

I'm in the process of moving any Saas offerings I use off USA-affiliated companies, but it's actually more difficult than I first thought. I believe there might even be a very profitable market in simply duplicating the functionality of Saas offerings at a higher price with security/privacy guarantees in Germany/HK/etc. Might be the next hot business to be in? You'd be surprised as to the number of people seeking alternatives at this point.

EDIT: Relevant XKCD for people calling for technical solutions to the problem: http://xkcd.com/538/

View on HN

It's not just going to be hosting providers that are affected by this. It's going to lawyers, software engineers, sys admins, writers and graphic designers who are going to lose work/business from SAAS companies. Software is one of the few areas where the US economy is growing somewhat sustainably (as opposed to banking/gambling/housing speculation/medical expenses for elderly). The NSA and all those NSA contractors are taking money out of our hands and destroying our professions. We should be fighting this tooth and nail.

- Politically, we should punish anything associated with the NSA.

- Socially, we should shun everyone from this date forward who works directly with or as a contractor for anything associated with NSA/FBI/CIA/DEA/DIA. We should not hire any programmer who, from this date point forward, has worked in those capacities. They are destroying our profession and businesses.

- On the engineering front, we should be designing technologies for evading the NSA et al, and spread those technologies. We need to do everything possible to make them easy to use and make them widespread.

- Any person or company who stands up to these organizations should be lionized and we should try to patronize their businesses or employee them. Especially if the suffer consequences like jail and torture.

- Facebook, Google, especially Palantir are known collaborators and we should treat them as such

The nails are already in the coffin for US internet behemoths. Any non-NSA cooperating country has strong interests in keeping their search engines, social networks, and cloud software internal to their country.

Google, Microsoft, and Facebook basically have had billions of dollars shaved off of their future market capitalization -- though I have not seen anyone say this yet.

For everyone abroad who is technically adept and talented, the vaults of wealth have been unlocked for you; just copy the successful offerings of American companies. Don't worry about software patents or trademarks unless your country is complicit, you'll have the autonomy of a oligarch (said with some sarcasm.)

There is one solution here: open source, distributed software. If you want to build a company to promote real security this is your only option.

Agreed. The nails are in for the current system, but that is not The System, just one of many potential ones.

If you are non-US citizen and your customers request a product similar to US product please do exactly as AJ007 says. It will help you, the world, and the US long term. I say this as US citizen and SW dev. Please take our jobs and customers! We don't deserve those customers if we can't protect them and their data.

However, you should only build it if customers are requesting SAAS (or other offerings). Be very careful about blindly copying US business b/c many are successful simply b/c they are almost "Apparatchik" entities, supplying and protected by the US Gov. For example, if you copy Palantir or even Google/Facebook you may not succeed b/c you won't have customers in the same way the US does. But overall, this is a great opportunity for devs from Switzerland (and the like) to get some new customers.

Caveat: If you are planning to follow the above advice, and you think your country will not enforce the wishes of the US government on such matters, check that assumption carefully before you bet your fortune and your life on it.

Thus the caveat I added in the original comment: unless your country is complicit.

Simply not true. There aren't enough people who care. Maybe 1% care. Everyone is going to keep using windows, facebook, and google. There are no nails in any coffin for any of these companies.

It is a major national security issue to any country to have foreign countries spying on them. The only controversy in the US is that the NSA is spying on American citizens in America. Any and all communication by foreigners at home and abroad is fair game. There is a reason why Google & Facebook are not market leaders in either China & Russia -- vkontakte, baidu, yandex, etc.

Likewise, this is also very bad news if you are a Chinese or Russian internet company and expect to become a dominant player in the US consumer web/digital/mobile market place.

The safeguards for foreigners are much less than those for US citizens. For example, the NSA doesn't need to go through FISA court to spy on non-citizens. So if you store your data on a non-US server, you're probably just making it easier for them to get to it, not harder.

Not to mention, most countries will pretty much cooperate with the US when it comes to intelligence. The only ones that might not are countries like Russia or China that have their own military-industrial complexes, which are just as eager to get at your data and a lot less scrupulous about using it.

I guess the obvious question to this post is:

What are you doing on your own checklist? Those are some pretty extremist notions.

If part of your hiring criteria was to exclude anyone who had worked for a contractor or directly for a government organization, I doubt many people would want to work for you. Not because they had violated your criteria, either.

Generally, I won't be hiring them, in hiring interviews I'd recommend against them for ethical reasons, and I'll avoid doing work for them if possible.

I'm referring to a very small percentage of the government and contract workers who are involved in security and surveillance. I'm not talking about VA or even the regular marines/navy/police.

I won't be doing this explicitly.

Whether people would want to to work in a place that explicitly will not work with former NSA contractors depends on the area. In SF, Boston, NYC, Portland, maybe LA it would probably help you hire good workers. Obviously, in DC or Houston it would be more controversial and hurt the company. Remember these organizations/contractors are destroying our jobs, especially in silicon valley.

I'd love to believe that the authorities in Germany are not also tapping lines like France or the UK. Do we have any proof that is the case? I agree this has made me think twice about hosting in the us, but also about crossing national boundaries full stop without encrypting traffic.

The difference is that the authorities in Germany don't have the legal framework to force someone to do this and threaten them to stay silent.

Ostensibly the US doesn't have that framework either, the Constitution would seem to preclude it (I realize we are talking about a myriad of offenses at this point so it may get hazy). But as you can see, shit gets ignored. Secret government agencies in Germany could ignore laws there just as easily as the NSA does in the US.

There are no countries where you are allowed to go public on surveillance measures applied to your customers, user etc. – at least not before the surveillance has been completed. And while traditional surveillance measures have an end, today's +/- total surveillance is continous.

At some point, maybe the citizens of the world will understand that laws don't apply to the people who make them. They never have, and they never will.

If you're German, would you prefer to be surveilled by the German government or by both the US and German governments?

If you're in the US it seems kinda pointless to try to move to overseas hosting; the NSA will probably just focus on the client side.

Under data sharing agreements, if the NSA takes an interest, your data will probably go to them without questions or oversight. Drone bases (Ramstein) and listening stations (Dagger Complex) are located in Germany, and Germany was one of the most targeted locations in the boundless informant set of slides. It's probably illegal, and hopefully will be challenged in court, but it does apparently go on on a massive scale, with or without our consent.

http://www.spiegel.de/international/world/bild-908609-515222...

Accountability and culture. German intelligence services are "weaker" in the sense that they (seemlingly) still are under the control of the legislative body (secret contracts with the Western Allies sadly nonwithstanding). They are also regarded with deep distrust by large parts of the populace and by a significant segment of the legislature.

It is quite possbible that, come September, some of the government parties might lose a few percentage points due to the citizens being annoyed about the erosion of the rule of law. We'll see.

>Accountability and culture

The culture that brought us the SS and the Stasi.

  The culture that brought us the SS and the Stasi.

Really? Really? With an account that is as old as yours you cannot avoid posting a comment like this? Do you consider that mature? Useful? Reasonable?

I don't. You just disqualified yourself from any meaningful discussion, ever.

My wife treated people with mental issues for some time and I have the utmost respect for people that can handle this stuff.

You, instead, are without protection. You post stuff like this and shout out to the world that you have no clue, that you have no idea what your are talking about, what the topic of this thread is and .. just show that HN really should provide a feature to ignore other people.

Please - go away. You didn't contribute and you're a sad, sad idiot.

Bad memories of those periods are a non-trivial part of why they are surveillance adverse today.

No, it's the reverse. The nazi era and the Stasi have resulted in a modern Germany that is fiercely oppositional to anything that leads in this direction.

There are very strong open source, transparency and anti surveillance movements in Germany. Stasi is the entire reason WHY we have strong privacy laws here.

As Goebbels pointed out, all it takes is the right kind of threat, either real or manufactured ("Think of the children!"), and those "transparency movements" you speak of will fade out more rapidly than the grandparent post.

That doesn't work as well if the culture has been inocculated.

How does one do that?

Well, I don't know if this is still done today, but when I was in 7th or 8th grade, they (school) drove us, by the busload, to visit a concentration camp.

We were shown the lampshades and wallets made of human skin. The place to stand where inmates would be executed during what they thought were medical examinations. And so on and so on.

It is quite possible that the next "Western" genocide will happen somewhere in Europe. But as somebody who has grown up here, I can assure you it won't be in Germany.

I just wish that history was thaught like this everywhere.

I have to agree. I spent two days in Berlin this week and went to the Holocaust memorial, etc. I was impressed with the way these things are talked about with such openness - to make sure that this stuff never happens again. Also, I've traveled to several european countries and found Germans to be quite open minded regarding race, religion, etc. since I think the past has a lot to do with that. Happy that the german education system and culture appears to have a strong culture of 'learning from mistakes'. Clearly that isn't the case for the US with Vietnam, Afghanistan and now Iraq.

To be fair there are still lots of racist and intolerant people here. And nazis, though the antifa usually kick their asses.

But the tolerant and open minded strain is pretty dominant. Germany is 9% foreigners. Frankfurt is like 30%

This may be the most ignorant comment I've ever -- and I mean ever -- read on a web discussion board. And I frequent many discussion boards.

Current German culture is equivalent to German culture under the Third Reich? Really?

Is current American culture equivalent to early-through-mid 19th century American culture? Should we discount everything the USA does because you once kept/traded/abused black people as property? Then continued to legislate such thinking via Jim Crow well into the 20th century?

Now that I look, I notice your post history is littered with anti-German racism rooted in complete historical ignorance. I'm wondering what your angle is.

Encrypting is a given - obviously you'd want to only be using Saas services in Germany etc that are fully encrypted. The problem in using USA services is that even if everything is fully encrypted, the USA can and will send goons around to take your data. Encryption is simply useless when dealing with a company in the USA who is forced to hand over the keys and whose data-centers can be legally entered and modified by thugs. Once someone has physical access to the server, the game is over.

Germany is a better bet. While they are no doubt tapping lines, Germany and the EU have made no moves to actually perform hostile interventions into data-centers or private servers. This means that encryption is still a very viable security measure for protecting your data in the EU. The EU simply has a far better track record with privacy related issues.

It's not about perfect security, it's about getting the best security you can hope for - and that means moving away from anything USA hosted.

EU is a very generic term here. There is very little consistency across member states on this topic; UK laws, for example, are probably worse than US ones in most cases. I'm not 100% sure, but I believe Italian ones aren't much better atm.

The short-term answer is to encrypt everything users have to store, and don't handle their keys, but it's a stop-gap: the only real answer is political and that's where things have to be fixed for good.

Then the most obvious answer to me seems to use technology to affect the political landscape.

How that actually manifests itself, depends on how desperate people become to retain some sovereignty over their livelihoods… which begs the question, where are we now and who could provide the resources/environment to foster the type of change that is needed?

Where exactly are these keys going to be stored?

Users can not and will not securely manage key material.

The EU has minimum standards for surveillance and most EU member states are clearly American vassals. Even France proved to a vasall in forcing the Bolivian president's aircraft to make an unplanned stopover in Vienna … and even the neutral countries are full in favor of surveillance – Switzerland for example is just revising its surveillance laws and many other legal areas, for example copyright, see an increased level of surveilance too.

I thought France disavowed that involvement? Wasn't it just Austria bloviating, or was it hasty ass-covering by France?

Don't choose Germany. We may have strict privacy laws here, but we also have the BND cooperating with the NSA, tapping directly into the main internet nodes (Frankfurt). And don't forget that part of the method of the NSA is to use a mule inside the target company, which would be very easy in Germany given its status of being a wannabe ally of the USA and the longstanding sympathy of the german public for the USA.

And Germany has also laws which force every mail provider to install an access point to the German authorities and intelligence agencies. I am not sure if also a generic saas platform would have to do it, but it is quite possible.

Better pick Switzerland or Island.

"And Germany has also laws which force every mail provider to install an access point to the German authorities and intelligence agencies. I am not sure if also a generic saas platform would have to do it, but it is quite possible."

Thanks for the heads up - as I said in the OP, it really is a difficult task. Those kind of laws are exactly what need to be avoided when choosing a country to host in. I don't believe that this kind of thing can be carried out in absolute silence though, so if a country is actively modifying and silencing hosts it's fairly likely that word of it will leak somewhere.

If I get a chance, I might try to put together a red/orange/green overview of known laws and practices in different countries that would affect hosting services there. Unless someone is already working on that and needs a hand?

If you do that, could you send me a mail? I'd be interested.

Please do this! This would actually be very useful..

Please do. If there's anything I can do to help, reply to this comment as I don't have any contact info on my profile.

Since there seems to be some interest, I put together a very simple map with a couple countries filled in at random with shaky data.

It's up on github, so hopefully everyone can submit pull requests with data and we can crowd source ourselves a very informative map.

https://github.com/Ryan-ZA/hosting_safety_map

EDIT: I also submitted a link to it on HN. Hopefully interested people will see it and can help out with data.

https://news.ycombinator.com/item?id=6182001

I was surprised to see Canada green on that map.

We have a great privacy commissioner ( http://www.priv.gc.ca/index_e.asp ) but the office holds no power so far as I can see, and the Canadian government has a pretty solid track record of being obsequiously cooperative with u.s. interests

Canada is green simply because nobody familiar with Canada's security politics and policies has chimed in yet and there does not seem to be any evidence of foul play that is visible from an outsider's perspective.

Cooperative with U.S. interests is generally assumed by almost any country - this map is more about the (hopeful) safety of your servers in data centers in different countries.

I think you can pretty much colour the Echelon Five Eyes countries (USA, Canada, UK, Australia, New Zealand) red right off the bat. If they don't have totally intrusive surveillance legislation yet they will have soon - New Zealand is currently trying to implement it.

It took me a while to understand that you probably mean Iceland.

I did - Island is german name. Happens from time to time that I mix languages.

Germany sends goons to take data as well, as does every country in Europe.

http://arstechnica.com/tech-policy/2011/05/german-police-sei...

Line tapping is pretty much a given. Looks like the BND has the possibility to do so. But this is still not officially confirmed. However a german blogger (fefe) had some examples for overly detailled dementi from german companies. E.g. no foreign intelligence service can read your traffic...

But in regards to cryptography and chances for legally fighting against such orders it could be better. At least on paper. The most likely outcome if lavabit would be hosted in germany would be a police raid that would take all servers for investigation with them. This happenend e.g. for poeple running Tor exit nodes.

Moving services off USA-based companies is like using two bicycle locks instead of one. A determined government is still going to get your data, they just need to spend a bit more time.

Focus instead on encryption.

It is just as bad or worse. You have to move the data in/out of the country. It definitely isn't protected when it leaves the country. The only advantage I see is that it punishes US businesses for failing to protest.

I don't blame the companies; they're about as much a victim of USgov as we are IMHO. That being said, if all the online-storage/cloud-server/email-providers/social-whatever companies in US start going out of business because nobody trusts them I strongly suspect something will have to change. It's just too bad we have to do a "scorched earth"[1] to bring about change.

1. http://en.wikipedia.org/wiki/Scorched_earth

> I don't blame the companies; they're as much a victim of USgov as we are IMHO.

While it's true that they are victims, they are in a far better place to demand change or to defend themselves. Money buys the ears of lawyers that the average person couldn't even afford to speak to.

This is where I disagree. I do blame companies like Google for not fighting this more. At the very least they make users aware that these laws exist, even if they cannot detail specifics related to their surveillance involvement.

You can't convincingly make that argument since you don't know what lawyers have been doing behind the closed doors of secret court rooms nor do you have knowledge of their relevant lobbying, you're just assuming things. No to forget that Google was the first to publish a transparency report in which it publishes the number of NSLs, so there is that - it's not correct to use "Google" as a shorthand for "US tech companies".

See this comment : https://news.ycombinator.com/item?id=6182179

Fighting the USgov isn't a decision to take lightly regardless of how much money & resources you have. I cannot condemn a company that backs down from that battle. It could hurt an employee(s) significantly, or the whole company. While I agree they have the most resources to fight it, they're not immune to harm from USgov.

Do you remember google asking for your telephone number? They knew what they were doing.

You say that as an American obviously. It makes a lot of sense for everyone else.

>It makes a lot of sense for everyone else.

Absolutely!

Dual US/Polish citizen here. Just wanted to say that in many cases abroad (i.e. Poland) the case isn't about the laws protecting your privacy but rather about the Government having no means (technical, resources, know-how, etc) to enforce ridicolous things like reading and storing email contents of all the people. Even with court order just to read stuff in your inbox, I would imagine that the Polish police would have big time difficulties doing anything. These are guys making 700usd a month and the Government doesn't have money and/or the need/desire to hire folks who could execute these things. And I can just imagine that in places like Ukraine the law may say whatever but what happens is this what the highest bidder asked for ;-) Remember, not the whole world works the way the first world or the USA does.

Unless of course, what you referred to is that most of the traffic goes via the US soil anyway. But then again, why to stay in the US? Move whole business and yourself abroad :-)) Ironically, I found much, much, much more freedom in post communistic Poland than - oh irony! - Land of the Free.

I second to that. If you want security (at least on a servers/ISP level) choose some 3rd world country which government (preferably not very fond of USA) does not have technical means on surveillance. I live in a small EU country and government’s IT forces are just laughable, so I can just imagine that in less civilised countries it should be close to non-existent. Combined with strong encryption to protect data in broad Internet it should do, at least for a while..

The problem is that most 3rd world countries will just come knocking on your doors and take everything away, if the US goverment requests it.

After all, those countries wouldn't be 3rd world countries, if they had the power to resist US threats/requests. Or they are part of the "axis of evil" (or whatever the current propaganda term is), in which case the internet connection to that country could either be cut off, or be heavily censored, if it isn't already happening.

I would imagine that for example in Ukraine US may request stuff, but then the low level chief of the Police in the town where you reside would give you a hint in exchange for money. That's how it rolls there. What US is going to do about that? Bribe the Ukrainian police to bring you to their Embassy? ;-)

That's a good point but don't assume that the CIA/US-govt is above bribing or even threatening/blackmailing agencies in foreign countries. They do this all the time!

But they still need proper, court issued warrant. At least there would be no invisible laws or secret agencies involved.

I understand what you mean but I think the term '3rd world country' could be a bit discouraging to some of our American friends who might not have a clear picture about realities in our part of the world.

For example I also live in a small EU country. By no means this is a 3rd world country - we have pretty strong IT industry (e.g. some globally successful antivirus companies etc.) and the country is certainly developed enough to host companies providing SAAS. Yet we have certain advantages against the US:

1. our government is way weaker than the US government - their resources are obviously not even close and they would not be able to do what US government does even if they wanted to. But we are still an EU state and we can use EU as a shield when Americans come knocking.

2. it is a post-communist country and people still remember the experience of living in totalitarian/authoritarian country. Opposition against any sign of 'bad old times coming back' seem to be much stronger than the opposition of common American people against recent freedom-stripping. For example there was a proposal that our internet providers should be required to block un-licensed online gambling. The public backslash against 'censorship' was so big that the plan had to be abandoned in few days and the politician who proposed it had to apologize. Many things that are now normal in US or UK and some other western countries would not be possible here.

3. we are still an 'American ally' but the US are not nearly as popular with common people as they used to be here and anti-Americanism seem to be growing. Many politicians exploit that and see opposing to American requests as an easy way to score political points (we have seen this for example when US government wanted to build a part of their missile defence system here).

Hah, good point. I bet most of Americans (no offence here) imagine that "3rd world" means "people still live in caves and hunts wild animals for food". However, a very good counter example is Skype which went worldwide even though started in a small, 3rd world country known as Estonia.

Although I really hope that nobody would label Estonia (or any other EU country) as '3rd world' country now.

Yes, however, all of the mobile internet providers are censored with the infamous Wikipedia-blocking UK internet filter, and it can't be turned off.

This is only because our mobile market is so small that we only have 3 providers and they are all subsidiaries of global companies (O2, T-Mobile and Vodafone) with headquarters under different jurisdictions. This is not enforced by our government and if anyone wanted to circumvent this filter (which would be easy - VPN would do) AFAIK it would not be illegal here.

Are you czech by any chance ? I think it's a great place and completely understand why your people would be against government surveillance. The days of asking random people for IDs just to make sure they aren't spies still aren't forgotten there.

Yep. And thanks. And to be honest, I think that asking random people for IDs was the smallest thing. People from always-free countries do not realize how much authoritarian regimes damage society. It's not just that some people became victims of the regime. Maybe the worst thing (at least in my opinion) is that society in an authoritarian regime is set in such ways that the system rewards dishonesty and cowardice and the most unscrupulous people get to the top... and stay there even after the regime falls.

Some countries have a problem with bribery and corruption. Routing sensitive data through those countries risks that data being exposed by anyone in the chain who is willing to take a bribe.

I am much more worried by corrupt workers in my ISP or telephony provider than I am about my government.

That's an issue with plain text data. However, nowadays absolutely no sensitive data should be transferred/stored unencrypted. The problem is, that it seems like eavesdropping is not enough for some certain governments and now they require physical access / backdoors to companies' servers in order to bypass encryption and/or other security means. What I, and few others have suggested is to move services away from such countries so their governments would have harder times to obtain physical access.

> The problem is, that it seems like eavesdropping is not enough for some certain governments and now they require physical access / backdoors to companies' servers in order to bypass encryption and/or other security means. What I, and few others have suggested is to move services away from such countries so their governments would have harder times to obtain physical access.

Many governments are much worse than the US; they not only snoop on data but they imprison or kill people as a result of the things they find.

I'd be interested to hear about countries who will i) stand up against the US & ii) not be at large risk of corrupt employees.

(http://www.freedomhouse.org/report/freedom-net/2012/egypt) etc.

The goal is not necessarily security (I have nothing to hide (I still do hide as much as possible))-- the goal is political change. That's the only real way out of this mess. By not using US companies, you incentivize those to lobby for better laws.

Much of the data traveling over the internet passes through NAPs controlled and owned by the USA.

Did you respond to the right comment? He said the goal was not security, it was political change.

Political change on it's own won't work. They will still keep the infrastructure in case they need to spy on someone(with a court order). But if they have the infrastructure , conceptually it's just a press of button again to full blown illegal surveillance.

there has been infrastructure to read snail mail contents for 200 years. Doesn't matter, the US Gov isn't routinely reading snail mail because of politics. I think he's right, make it a political issues. Actually, more: make it political issue, encryption issue, hosting issue, social issue (denied nsa contracting recently based on Snowden), I mean total war - make their life as difficult as possible using all means possible. As long as it's legal of course.

Mass reading of snail-mail has traditionally been a question of manpower. You don't just flip the switch on that without anybody noticing.

Doesn't really matter. To read a regular mail you just need so much more in legal terms compared to reading somebody's email that it's just not worth contemplating no matter what. It's not like with emails where after 6 months they automatically are open to the Government sniffing. Because of the political reasons it's not even worth contemplating -- look -- you need regular court order, not some BS whatever rubber-stamp.

There's not even the time factor. Western countries at least might theoretically not spy on their own citizens but the exchange data with partners intelligence services. And the US is by far not the only country that mandates surveillance cooperation for providers etc.

Encryption is OK but doesn't solve the problem. There's always metadata and whom can your trust with your encryption? You have to assume that hardware and software you use has backdoors. Mobile phones for example has even official backdoors, your SIM card can be remotely changed and so on …

> Western countries at least might theoretically not spy on their own citizens but the exchange data with partners intelligence services.

Hoping that this is true, moving to services from one’s home country would make some sense. Of course, this is more easily possible for people from larger countries than, say, Luxembourg.

It would be really unfortunate if people started getting polarized into encryption / social / legal camps. All these things are necessary.

Customers and law may demand that the data is stored in the EU. For businesses with demands hosting in the US is simply not an option.

This was a concern earlier but my guess is that this will only increase in the near future.

I had the impression that government does not need to decrypt anything. They just request it from a company, and the company has to comply.

I will take mine government over yours. I can atleast try to deal with mine.

Not quite. Storing ciphertext and keys in legal jurisdictions (like the US) that can be forced to turn over both is a bad idea.

Also, practical key management is still an unsolved problem. The web of trust never took off and the PKI is fucked. Encryption is only as useful as the keys being used to encrypt.

No, do both.

Focus on encryption, to keep ahead and protect the data.

Move out of the US, because it sucks, is far from 'the land of the free' anymore and needs to learn that its place in the digital world is not at the top, but more around the center. Between lots of other states that fail and fail again, in terms of surveillance..

Yep, as an added bonus you stop financing the US war and terror machine.

I saw a frustrating article the other day on a mainstream news site that was saying that the economic damage to the US for the Snoden leaks was in the tens of billions of dollars because of all the non US business that will be leaving US based cloud providers.

That's infuriating. It's the same as having an insecure system and then charging a hacker millions of dollars in restitution to re-architect the system to do it right.

Those firms wouldn't have to leave the US cloud providers if they had assurances that the US wasn't spying on them for no good reason.

Infuriating? It's awesome (if you extend it out further). Pocketbook damage is the only thing that governments and mega-corps understand.

Considering what just happened to LavaBit, your advice doesn't make any sense.

If they were outside of US-and-friends jurisdiction, they wouldn't be shut down and there wouldn't be a gag order.

Encryption is useless when the government knocks on their door and says give us a backdoor to your system.

If enough people leave US based companies for foreign companies it will put pressure on the government. I have a feeling this pressure is already underway.

The problem with encryption in this case when it comes to US companies is that the US can compel US companies to install custom backdoors while pretending they are still secure and not notify their customers that this happened.

> I'm in the process of moving any Saas offerings I use off USA-affiliated companies, but it's actually more difficult than I first thought.

You should try finding a SSL cert retailer that's outside of the US. The only ones I could find that would actually sell me certs without a phone call charged at least $200 for a basic certificate. https://swisssign.com/en were the most sensible looking ones I could find.

This part doesn't matter. Where your cert comes from is irrelevant.

It has implications for certificate pinning (like that used in Chrome) if you can only pin to CAs that operate in a single regulatory domain.

Indeed, I hadn't considered that.

Though, if you are pinning in an app and not just in-browser, you can bundle your internal CA cert in the binary and sidestep the whole mess.

This is what I advise my customers that have security-sensitive stuff do. The PKI can no longer be trusted.

"No longer"? It could never be trusted, and many of us said so when it was first introduced. It's just taken a while for everyone else to realise that we were right.

from what I know you never give your private key away, they just sign your public one. so that would be irrelevant.

There's StartCom (StartSSL) from Israel. Have you tried them? They even offer free SSL certs, by the way.

They are from Israel, a good friend of the US, and for free. What part of that does not scream 'run for the hills' exactly?

Lulzily, a browser trusted CA can actually fuck a customer of that CA slightly less than a non-customer, since you'd at least be vaguely aware of multiple certs issued for the same site from the same CA with different keys (maybe). No one would know if Iran were using a pet CA to go after specific users going to sites which normally used a cert from another CA.

Somebody call the Samwer brothers!

How about a local cloud? I understand that this may seem pointless, as you're owning and paying for all the hardware, but it would really help in deployment, scaling and maintenance just like a "classic" cloud service can.

That sounds great. What if there were an email client that included an email server? If families left one desktop on 24/7 they could all use it as an email server. An open source email client could also include built in PGP or OTR encryption. Anyone know if it's feasible from a deliverability standpoint? Domain registration and DKIM signing may be tricky for the average user. As well as dealing with blacklisting, of course. But if it became prevalent maybe all of these difficulties could be overcome by instituting a new, truly decentralized infrastructure. Key exchange would still be an issue but could be achieved using a mobile app with QR code scanning.

Reply on news.ycombinator.com