Going dark: online privacy and anonymity for normal people • Hacker News Board

Re: Going dark: online privacy and anonymity for normal people

#61

Post by INTPenis » Thu, May 19, 2016, 2:01 PM UTC

coldpie wrote: post #53

INTPenis wrote: post #48

Earlier quoted context omitted.

I do a lecture at local hackerspaces about basic security for the common person and anonymity is far down on the list. Much higher on the list are basic protection from dangers on the internet, like browser based exploits. So Noscript is one major selling point for Firefox due to most browser based exploits using Javascript. Even if you whitelist all the sites you're still more secure with noscript than without simpl…

I wonder if there's any demand for a pre-built whitelist for NoScript that includes stuff like Amazon, Google, Apple, banks, and most other popular sites. The admin would err on the side of allowing scripts to run, while the default-block rule would still block unknown and ad/tracker domains. It would obviously be less secure than an intelligent user making all their own decisions, but it would make the barrier to us…

There is and I've given that so much thought. I've gone as far as to sync my own Noscript lists. Since Firefox Sync will not sync noscript whitelists I have to do that myself. So that's a major feature request from me right now.

Not only to have pre-built lists but also to share your own list between devices.

Re: Going dark: online privacy and anonymity for normal people

#62

Post by kevingrahl » Thu, May 19, 2016, 2:01 PM UTC

Skimmed the article, saw that he reccomended using Googlemail. Looked at the title of the post again. Looked at Googlemail reccomendation. Laughed and made a mental note not to trust "Troy Hunt".

Re: Going dark: online privacy and anonymity for normal people

#63

Post by INTPenis » Thu, May 19, 2016, 2:03 PM UTC

tunap wrote: post #58

tombrossman wrote: post #55

Earlier quoted context omitted.

I do similar talks for regular users* and I try to explain how to prioritize risks, and why they might not be focused on what's really important. Purchasing an anti-virus suite and identity theft protection and worrying about online banking are way overrated. Strong consumer protections exist in many developed nations which limit your liability, it is the banks who stand to lose. No doubt it can be a hassle if your c…

I've been installing NoScript, and instructing how to use it, on "regular" users' browsers for years. The sad inevitability is I end up instructing most of them on how to enable "Allow scripts globally(Dangerous)" option to help quell the flood of phone calls concerning their "broken internets". Many just can't be bothered &/or don't care enough to learn. Free will can be such a bitch, sometimes.

The big problem with noscript, and this has already been mentioned on here, is that it requires a certain level of experience with the web to operate.

You almost have to be an experienced webdev to recognize which domains are necessary and which aren't.

But this is also why I emphasize that you can freely use the global whitelisting option and still be much safer than without noscript. Simply because the sites that will get you are often the sites that open unexpectedly. Unknown domains that you did not request.

Re: Going dark: online privacy and anonymity for normal people

#64

Post by nxzero » Thu, May 19, 2016, 2:10 PM UTC

spangry wrote: post #21

sleepychu wrote: post #14

Earlier quoted context omitted.

I'm having trouble finding it but the perfect example of this is a census that collected religious affiliation (for innocent statistics) that some brave citizens went to great lengths to destroy when they came under Nazi occupation in order to try and protect Jewish residents.

Another example would be the internment/deportation of 120,000 Japanese-Americans during WW2. I'll bet when they were ticking the 'Japanese ancestry' box on their census form they had no idea they were signing up for future imprisonment without due cause or due process. http://www.scientificamerican.com/article/confirmed-the-us-c...

Might be worth noting that children that were in these camps are still alive today.

Re: Going dark: online privacy and anonymity for normal people

#65

Post by Intermernet » Thu, May 19, 2016, 2:11 PM UTC

kevingrahl wrote: post #62

Skimmed the article, saw that he reccomended using Googlemail. Looked at the title of the post again. Looked at Googlemail reccomendation. Laughed and made a mental note not to trust "Troy Hunt".

Maybe try reading the article instead of skimming. He mentions options to Gmail if you don't want to deal with them.

Pro tip: don't comment if you've just "skimmed the article".

Re: Going dark: online privacy and anonymity for normal people

#66

Post by stinkytaco » Thu, May 19, 2016, 2:17 PM UTC

INTPenis wrote: post #48

sixhobbits wrote: post #26

I'm surprised he doesn't mention NoScript, Privacy Badger, etc. "Normal people" should be more concerned about about the highly detailed profiles that companies are building based on browsing habits. "Normal people" read about data breaches and embarrassing leaks that force politicians to resign. "Normal people" know nothing about the behind the scenes tracking that goes on when you google medical symptoms[0] or visi…

I do a lecture at local hackerspaces about basic security for the common person and anonymity is far down on the list. Much higher on the list are basic protection from dangers on the internet, like browser based exploits. So Noscript is one major selling point for Firefox due to most browser based exploits using Javascript. Even if you whitelist all the sites you're still more secure with noscript than without simpl…

I have done a number of "Internet Safety and Security" classes in my position as a public librarian. My focus is not so much on anonymity, as much as understanding the problem of identity. I explain the certificate system and how a hacker might actually target you. Phishing -- probably the biggest security risk I see on a day to day basis -- is a problem of identity, giving money to someone you do not know and cannot verify.

I also cover basics like using better passwords, not reusing them and ways to keep them safe (keepass, last pass, a password memo book, etc.). And I emphasize over and over again to keep your software up to date. Let companies that have experts on staff do the work for you. Update Windows, your web browser and all Internet connect applications regularly (also applicable to iOS, the App Store and the Play Store).

Finally, I cover basic anonymity tools like ad-blockers and Disconnect.

The final paragraph loses a lot of my clientele, so NoScript is a non-starter for them.

Re: Going dark: online privacy and anonymity for normal people

#67

Post by stinkytaco » Thu, May 19, 2016, 2:18 PM UTC

tunap wrote: post #58

tombrossman wrote: post #55

Earlier quoted context omitted.

I do similar talks for regular users* and I try to explain how to prioritize risks, and why they might not be focused on what's really important. Purchasing an anti-virus suite and identity theft protection and worrying about online banking are way overrated. Strong consumer protections exist in many developed nations which limit your liability, it is the banks who stand to lose. No doubt it can be a hassle if your c…

I've been installing NoScript, and instructing how to use it, on "regular" users' browsers for years. The sad inevitability is I end up instructing most of them on how to enable "Allow scripts globally(Dangerous)" option to help quell the flood of phone calls concerning their "broken internets". Many just can't be bothered &/or don't care enough to learn. Free will can be such a bitch, sometimes.

I'm at the point where I refer people to an ad-blocker and Disconnect. Not perfect, but a whole lot better than nothing.

Re: Going dark: online privacy and anonymity for normal people

#68

Post by stinkytaco » Thu, May 19, 2016, 2:23 PM UTC

amelius wrote: post #41

> Going dark: online privacy and anonymity for normal people Caveat: normal people don't care about such things.

I don't think this is true. I think people either don't understand it, or have a different comfort level than others. I work at a public library with people who struggle with basic information literacy, but they are very protective of their phone number. That's a piece of private information to them, despite how much safer it would keep them in the event their email account is compromised (or they inevitably forget their password when they arrive a week later to check their email for the first time). When I assist someone in setting up an email or Facebook account, I spend time to explain this problem to them.

People care, they just don't know.

Re: Going dark: online privacy and anonymity for normal people

#69

Post by rmc » Thu, May 19, 2016, 2:33 PM UTC

sleepychu wrote: post #14

WA wrote: post #9

Earlier quoted context omitted.

The problem: "Nothing to hide" depends on the context. Maybe you don't have anything to hide under the current laws, but what about laws in 20 years from now? Maybe times change and suddenly, you've got a lot to hide.

I'm having trouble finding it but the perfect example of this is a census that collected religious affiliation (for innocent statistics) that some brave citizens went to great lengths to destroy when they came under Nazi occupation in order to try and protect Jewish residents.

@idlewords has a few examples here: http://idlewords.com/talks/haunted_by_data.htm

e.g. A gay Russian who opens a LiveJournal account in 2004. Before LJ is bought by a russian company and russia becomes more homophobic.

Re: Going dark: online privacy and anonymity for normal people

#70

Post by stinkytaco » Thu, May 19, 2016, 2:34 PM UTC

pdkl95 wrote: post #11

huuu wrote: post #5

Doesn't this create a risk of committing fraud and identity theft in some countries? I can understand it wouldn't be a crime to create a random email address but creating a fake house address and using this for payments sounds a little tricky.

What you call "fraud" I call "privacy". Anonymous transactions happen all the time with cash, and any new payment method needs an equivalent. In the modern era where it is no longer possible to gain privacy by being unobservable, a new definition of privacy is required. Dan Geer has a very good replacement definition; privacy is "the effective capacity to misrepresent yourself"[1]. If cash isn't possible, misrepresen…

In the interest of discussion, I'm going to play devil's advocate here. Please don't attack me personally.

The difference between a cash transaction and, say, a bitcoin transaction is one of scale. To make a cash transaction requires us to be in the same place and to have at least a basic understanding of identity. A fraudster can obviously profit in this situation, but their targets are limited to who they can physically meet.

The Internet is an order of magnitude larger scale. Fraudsters can work in bulk and hide their transactions easily. It's wholesale and not retail, so to speak. That is a problem worth at least considering.