Live data from Hacker News

Going dark: online privacy and anonymity for normal people

troyhunt.com

111–120 of 125 posts

Re: Going dark: online privacy and anonymity for normal people

#111
post #9

Earlier quoted context omitted.

The problem: "Nothing to hide" depends on the context. Maybe you don't have anything to hide under the current laws, but what about laws in 20 years from now? Maybe times change and suddenly, you've got a lot to hide.

I'm having trouble finding it but the perfect example of this is a census that collected religious affiliation (for innocent statistics) that some brave citizens went to great lengths to destroy when they came under Nazi occupation in order to try and protect Jewish residents.

The Netherlands. Directly affected Anne Frank's family, among others.

Re: Going dark: online privacy and anonymity for normal people

#112
post #53

Earlier quoted context omitted.

I do a lecture at local hackerspaces about basic security for the common person and anonymity is far down on the list. Much higher on the list are basic protection from dangers on the internet, like browser based exploits. So Noscript is one major selling point for Firefox due to most browser based exploits using Javascript. Even if you whitelist all the sites you're still more secure with noscript than without simpl…

I wonder if there's any demand for a pre-built whitelist for NoScript that includes stuff like Amazon, Google, Apple, banks, and most other popular sites. The admin would err on the side of allowing scripts to run, while the default-block rule would still block unknown and ad/tracker domains. It would obviously be less secure than an intelligent user making all their own decisions, but it would make the barrier to us…

I used to wonder this as well, but the problem is then you have to trust whoever submitted it set the rules up properly.

Re: Going dark: online privacy and anonymity for normal people

#113
post #56

Earlier quoted context omitted.

I do a lecture at local hackerspaces about basic security for the common person and anonymity is far down on the list. Much higher on the list are basic protection from dangers on the internet, like browser based exploits. So Noscript is one major selling point for Firefox due to most browser based exploits using Javascript. Even if you whitelist all the sites you're still more secure with noscript than without simpl…

Until my aging mother can use NoScript and still understand why many websites just don't seem to work, it isn't covering the majority use cases.

This comment alludes to a UI/UX goal commonly voiced as an obstacle, that of some 'ware not being market-ready until it's "Grandmother operable". This thread, however, is a discussion of matters of digital defense. Just as with physical defense, it is the pietous responsibility of the more savvy and agile offspring to shield their elders from harm (presuming no malice by the senior party emancipates one from such duty).

Re: Going dark: online privacy and anonymity for normal people

#114
post #33
post #32

Great article. The only real omission I noticed is the lack of mention of advanced browser fingerprinting techniques that can be used against browsers, even if caches are emptied, 'porn modes' activated, VPNs opnened. As demonstrated here by the EFF's Panopticlick initiative. https://panopticlick.eff.org/ One of the most important points about the anonymity provied by the Tor project to remember is that the Tor Brows…

What do you mean with "VPNs opnened"? The article is wrong about Tor being an alternative option to a VPN. If anonymity is your concern, you should use TOR to connect to a VPN (paid with Bitcoins).

"VPNs opened" was poor wording. Clarifications provided by the guys below seem to match what I remember from listening to talks on Tor by the project's developers.

Operational security and Tor is such an interesting and frankly, quite scary subject. I've mainly used and instructed people on Tor for read-only uses of the web.

For my own needs, masking the origin of an actively participating persona is out of scope. I generally warn people about doing anything that requires sign-on/nicknames etc without very careful research.

I recognize that my lack of a need for serious anonymity for basic political activism etc is a huge privilege. So I try to give back by running a bunch of Tor middle relay myself.

For serious anonymity, I'd really be strict about using a forensically clean Tails USB boot environment, on varying public Wi-FI hotspots with a dedicated laptop that never has touched my regular network. The laptop must not ever be powered on near my house. Lots of systems, like Cisco Meraki business Wi-Fi APs take note of all nearby Wi-Fi and Bluetooth devices for 'location analytics'.

Javascript and stuff must be disabled of course. Carrying any cell phone, burner or otherwise is out of the question.

The reasons are many, but for starters, you don't want to be identifiable as the only person at your location making Tor connections, if you're doing something important.

Here are some good points on the subject. https://www.youtube.com/watch?v=eQ2OZKitRwc

My approach for promoting Tor to regular people around me is through describing it as a way to do random googling on subjects people don't necessarily want linked back to them, through analytics and ad companies.

I'm personally pretty convinced that insurance companies around the globe are looking pretty seriously at how far they could push their use of intelligence from data brokers. For purposes like identifying people with potential inherited diseases, recreational drug use habits, mental health problems etc.

So, I think Tor is important for all of us.

Re: Going dark: online privacy and anonymity for normal people

#115

Earlier quoted context omitted.

I just bought an entire TLD for signups/spam and made it a catchall. One positive is I know when companies are breached often before they announce it as my pagerduty@domain.com told me a little while ago. http://www.theregister.co.uk/2015/07/31/incident_managers_pa...

This is a great idea! What's it like viewing email? Which client do you use? Is it easy to see which email address the email was sent to?

Viewing email is as you would expect, the email they sent to is in the header so it's just a single click away in Thunderbird.

Re: Going dark: online privacy and anonymity for normal people

#116

Skimmed the article, saw that he reccomended using Googlemail. Looked at the title of the post again. Looked at Googlemail reccomendation. Laughed and made a mental note not to trust "Troy Hunt".

Hi, I'm Troy McLure. You may remember me from such articles as "Beans: The Forgotten Fruit" and "Making your Millions on Mt. Gox".

Re: Going dark: online privacy and anonymity for normal people

#117

Earlier quoted context omitted.

If you primarily use honeywords, then you can filter out anything going to craigds@host.tld as spam. The hard part would be transitioning people you want to communicate with to craigds+{family,friends,correspondence}@host.tld. Optionally, retain craigds@host.tld for personal and professional communication/correspondence, and move everything else to craigds1+{something}@host.tld (or a different host).

I just bought an entire TLD for signups/spam and made it a catchall. One positive is I know when companies are breached often before they announce it as my pagerduty@domain.com told me a little while ago. http://www.theregister.co.uk/2015/07/31/incident_managers_pa...

I've used the same strategy for the past few years with great results. Like you said it's really nice to see early on which companies are leaking your info.

It's also nice to be able to kill specific email addresses once a breach has been disclosed and the spam becomes plentiful.

Re: Going dark: online privacy and anonymity for normal people

#118
post #114
post #33

Earlier quoted context omitted.

What do you mean with "VPNs opnened"? The article is wrong about Tor being an alternative option to a VPN. If anonymity is your concern, you should use TOR to connect to a VPN (paid with Bitcoins).

"VPNs opened" was poor wording. Clarifications provided by the guys below seem to match what I remember from listening to talks on Tor by the project's developers. Operational security and Tor is such an interesting and frankly, quite scary subject. I've mainly used and instructed people on Tor for read-only uses of the web. For my own needs, masking the origin of an actively participating persona is out of scope. I…

I love the tor browser, however much of the internet without javascript is not useable, at all. Very unfortunate for a tor fan like myself. To be quite honest, if most people weren't like 'grandma' and actually took more interest in the underpinnings of the computer itself, they would automatically be more self-aware of said security. However, it can be said that our 'security', and most importantly, our identity, has been compromised by the very govts and colluding corporations who regulate the devices with which we network. The "land of the free" is anything, but not that. I can't stress enough that societies need to preach good computing habits with encryption first and foremost. Instead all I ever hear is how wonderful the latest device is because: it's newer, faster, you can piss on it, etc. Where in the hell is the spiel on how secure it is and how wonderfully it encrypts everything? The worst part of it is that most don't take enough interest and the powers that be are similar to snakes in the grass. The balance of anything, even information as well as communication is what we all need to strive for.

Re: Going dark: online privacy and anonymity for normal people

#119
post #9

Earlier quoted context omitted.

The problem: "Nothing to hide" depends on the context. Maybe you don't have anything to hide under the current laws, but what about laws in 20 years from now? Maybe times change and suddenly, you've got a lot to hide.

I'm having trouble finding it but the perfect example of this is a census that collected religious affiliation (for innocent statistics) that some brave citizens went to great lengths to destroy when they came under Nazi occupation in order to try and protect Jewish residents.

Suspect this is the link you have in mind:

http://jacquesmattheij.com/if-you-have-nothing-to-hide

It's cropped up on HN before.

Re: Going dark: online privacy and anonymity for normal people

#120
post #105
post #19

Earlier quoted context omitted.

With the phrase "nothing to _hide_" you are starting from a bias: that if you have something that is not public knowledge then it must be wrong or evil and must therefore be hidden.

This is an excellent observation. Perhaps the phrase should be "If you have nothing private you have nothing to fear".

Exactly :)

And that better sentence busts open the assumption :)

Post reply on HN