Comment by clicks | Hacker News Reader

Comment by clicks | Hacker News Reader

Parent Full thread

You bring up good points.

And speaking of privacy in anonymous forums and NSA snooping, I've been thinking as of late:

We can reasonably conclude now that NSA is probably in the game of data mining in a manner much like Google or Facebook, graphing networks and all. Data mining is considerably easier to do on social networking sites like Facebook where there's a push from the beginning to tie accounts to real identities, unlike anonymous forums. Now, the thing is, Reddit/4chan is a breeding ground for contrarian thought, indeed it is where a lot of the interesting stuff is born in the eyes of three-lettered agencies -- half of the Lulzsec memebers were active Redditors, Edward Snowden was a Redditor, every other programmer with unorthodox political interests is on Reddit. So I am really very confident that NSA/FBI keeps a special tab on Reddit, but what I'm curious about is how they go about doing that. I don't think Reddit staff has made a deal with three-letter agencies to help them tie anonymous accounts to real identities... but I wouldn't be surprised if these three letter agencies are putting a concerted effort on gathering data from anonymous networks in hopes of linking all things said and done under the guise of anonymity back to some real world id. (I imagine are probably sitting on a good many zero days, and can presumably carry out operations in which they surreptitiously steal a lot of data that can help them to tie Reddit accounts to real id's, for example).

First, basic reddit isn't even encrypted. Many probably use it that way because their https is slow.

Now since there are time stamps on reddit posts, even https could be possibly annonimized using traffic analysis.

And if you use Tor, there are tools that might work against Tor.

Considering all this, the fact that reddit sells anonymity, and people use it for really personal info - which could easily be hacked even by someone with a network sniffer - is not honest.

I don't think the point of this post was anonymity against those with large resources, but rather day-to-day anonymity for social interaction.

The parent asked about NSA. i replied.

But the lack of default https IS relevant to day to day hacking: the case of a wifi sniffer.

I wouldn't trust Tor. It's surely deeply penetrated by the NSA, if in fact they didn't create it to begin with.

This keeps popping up again and again. The source code for Tor is public.

The idea that Tor is compromised by the NSA, if true, is not by releasing compromised source -- it's from the NSA running the tens or hundreds of thousands of Tor nodes required to compromise the system.

That's a red herring.

It's the network that is compromised. If you operate enough exit and relay nodes, you can be pretty damn well sure of where the traffic originated.

Anonymity hinges on the nodes, if an entity controls most of the nodes then the network is pretty much an effective honeypot.

Given that the FBI has been incredibly vocal about their efforts to take down Tor, and the fact that it is synonymous with illegal activity (drugs and child porn); operating enough nodes to investigate and bust criminals seems right up their alley.

There are user options to specify which entry and exit nodes to use [1]. I'm not saying there aren't ways to defeat Tor but I dislike this knee-jerk reaction that a lot of people have with it because of its origin.

[1] https://gitweb.torproject.org/torspec.git/blob/HEAD:/path-sp...

That doesn't prevent the 99% of Tor users accessing hidden services exposing the location of the service to whoever is operating the majority of honeypot nodes.

It also doesn't prevent owners of relay nodes from construing the origin of traffic. It may not be as accurate assuming the user routes their traffic through uncompromised entry/exit nodes, but given the resources certain agencies have they can cross reference ISP etc traffic logs to determine the identity of tor users.

Reddit doesn't really sell anonymity in the face of someone who is determined to find out who you are. People expect a basic level of anonymity, but they don't expect it to hold up before NSA level scrutiny.

I've given some thought to anonymity on reddit and I've come to the conclusion it is all but unobtainable. Every now and then you see it happen, posting similarities or offhand comments are tied between accounts exposing what happened to so-in-so in the myriad of subreddit dramas. I change my account every so often, mostly because I tend to come across as a dick. Still I gain karma fairly steadily yet I prefer being blunt on reddit and that's not the person I wan't friends and family interacting with online, so I change it from time to time to keep my visibility low. So while I may not be 'strong' anonymous it still serves a purpose for me and allows me to engage in discussion whereas on other sites such as G+ or FB I completely abstain from conversation for fear of offending someone. At the end of the day that is useful even if I know full well those with the inclination could easily discern who I am.

I think you should try being less of a dick in general. It happens to me too, as I get easily offended, however what I noticed is that if you want to educate people, it is far better to do it with well reasoned and nicely phrased arguments. Few people get away with being dicks, like Linus or Jobs, but that only happens for people that earned respect and credibility.

Incidentally this is why I prefer HN for the moment. The comments on Reddit tend to get too negative and full of insults. Anonymity is a doubly edged sword, sometimes bringing out the worst in people.

I agree that it is unobtainable.

I mode one of the top 50 /r/ on reddit, as well as some much much smaller ones. I have multiple accounts - but not in a gaming-the-system sense; I had a primary account and a novelty account... I wound up posting "primary" comments under my novelty account by mistake after leaving myself logged in with that account some time ago... now my novelty is my primary and my primary is dormant.

In the smaller /r/ I mod - I post instructional vids, and google linked them back to my real name. Even though I have an anonymized account for youtube, I also have a real-name account.

Once when posting, for reasons which are obfuscated by google, my uploads went to my real-name account which I posted to reddit...

So... ultimately, its easy to tie all these together as strong-selectors back to me :(

I have an idea on how to deal with tracking which may completely eliminate the ability to track a browser, but the issue is that even with 100% anonymity of an account on a site like reddit, ultimately you will post something that connects that account to your real-ID.

I imagine these agencies as being the same as big companies - huge bureaucratic messes with, hmm... not the best employees.

Yeah I remember reading this article a while back:

http://www.bbc.co.uk/news/uk-england-gloucestershire-1414498...

Basically, GCHQ have to operate on the same pay-schemes as other civil service departments. Which means roughly £20k starting salary. Now if they want to hire the best of the best, straight out of university, they're going to have to compete with the City firms who will offer £90k+ to fresh grads. Not to mention the fact that GCHQ is in Cheltenham, not exactly an exciting cultural hotspot for young 20-somethings.

Makes me slightly less worried about government spying when I realise the trouble they have to go through to keep anybody half-decent.

No idea whether it's the same in the US. Do anyone know if they have strict guidelines on what they can pay civil servants?

You are forgetting that most governments then take in contractors in big IT projects, which in many cases have outrageous budgets. Now you've got the A+ people employed.

Just look at the prime real world example: Edward Snowden was a contractor, and not employed by the government.

Cogs that are missing a few teeth will still turn most of the time, albeit inefficiently. No matter how much of a bureaucratic mess a business or government department is, shit always seems to get done ... eventually.

Reply on news.ycombinator.com