Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Jimmy Wales threatens to encrypt Wikipedia if UK passes snooping bill

arstechnica.com

Post reply on HN
Print view View original

11–20 of 40 posts

Re: Jimmy Wales threatens to encrypt Wikipedia if UK passes snooping bill

#11

Post by chris_mahan »

Ironlink wrote: post #8
nullc wrote: post #5

They should do this anyways. It's well known to the technical elite that dragnet surveillance is going on— but it's not known to the general public. It's arguably immoral that the site doesn't switch to https by default and give the public the privacy they think they already have.

What makes you think that those with the resources to implement dragnet surveillance do not have access to properly signed certificates, which let them Man-In-The-Middle the connection without triggering a browser warning?

If you're worried, just download a dump of wikipedia and browse local (http://dumps.wikimedia.org/)

Re: Jimmy Wales threatens to encrypt Wikipedia if UK passes snooping bill

#12

Post by MikeCapone »

mtgx wrote: post #6
nullc wrote: post #5

They should do this anyways. It's well known to the technical elite that dragnet surveillance is going on— but it's not known to the general public. It's arguably immoral that the site doesn't switch to https by default and give the public the privacy they think they already have.

That's a very good point. The majority of people have no idea that many Governments are already monitoring and data mining everything they say or do online. Websites should already start switching to HTTPS (or SPDY) to protect their users against this stealth monitoring, of which they know nothing about. But if they don't and if this law passes (I hope it doesn't) maybe some good will come out of it, and it will jump…

So what do you guys do to counter this? Do you use encrypted VPNs? Any specific ones you'd recommend?

Re: Jimmy Wales threatens to encrypt Wikipedia if UK passes snooping bill

#13

Post by adorton »

MikeCapone wrote: post #12
mtgx wrote: post #6

Earlier quoted context omitted.

That's a very good point. The majority of people have no idea that many Governments are already monitoring and data mining everything they say or do online. Websites should already start switching to HTTPS (or SPDY) to protect their users against this stealth monitoring, of which they know nothing about. But if they don't and if this law passes (I hope it doesn't) maybe some good will come out of it, and it will jump…

So what do you guys do to counter this? Do you use encrypted VPNs? Any specific ones you'd recommend?

http://lifehacker.com/5940565/why-you-should-start-using-a-v...

Re: Jimmy Wales threatens to encrypt Wikipedia if UK passes snooping bill

#14

Post by [deleted] »

mtgx wrote: post #6
nullc wrote: post #5

They should do this anyways. It's well known to the technical elite that dragnet surveillance is going on— but it's not known to the general public. It's arguably immoral that the site doesn't switch to https by default and give the public the privacy they think they already have.

That's a very good point. The majority of people have no idea that many Governments are already monitoring and data mining everything they say or do online. Websites should already start switching to HTTPS (or SPDY) to protect their users against this stealth monitoring, of which they know nothing about. But if they don't and if this law passes (I hope it doesn't) maybe some good will come out of it, and it will jump…

[deleted]

Re: Jimmy Wales threatens to encrypt Wikipedia if UK passes snooping bill

#15

Post by frequently10 »

Ironlink wrote: post #8
nullc wrote: post #5

They should do this anyways. It's well known to the technical elite that dragnet surveillance is going on— but it's not known to the general public. It's arguably immoral that the site doesn't switch to https by default and give the public the privacy they think they already have.

What makes you think that those with the resources to implement dragnet surveillance do not have access to properly signed certificates, which let them Man-In-The-Middle the connection without triggering a browser warning?

To expand on what aidenn0 said:

It's possible to do client-side known-public-key verification, which would detect a MITM attack. The idea is basically maintaining a local trusted cert list (other than the broad ones in the OS), but using known site public keys instead of root signing certificates (which I will admit are a security nightmare for SSL).

Chrome does this for Google-controlled domains; they call it "public key pinning." I'm not sure if any of the other major browsers do it, but it would be pretty simple to implement.

Even if the government had a root CA-signed cert for "mail.google.com", Chrome would throw an error because the government's signed cert public key would not match the public key pinned inside the Chrome browser source code. Chrome would barf with a certificate error.

Re: Jimmy Wales threatens to encrypt Wikipedia if UK passes snooping bill

#16

Post by propercoil »

MikeCapone wrote: post #12
mtgx wrote: post #6

Earlier quoted context omitted.

That's a very good point. The majority of people have no idea that many Governments are already monitoring and data mining everything they say or do online. Websites should already start switching to HTTPS (or SPDY) to protect their users against this stealth monitoring, of which they know nothing about. But if they don't and if this law passes (I hope it doesn't) maybe some good will come out of it, and it will jump…

So what do you guys do to counter this? Do you use encrypted VPNs? Any specific ones you'd recommend?

check mullvad. you can pay with cash over mail, bitcoin or whatever. no logs, two external ip's for thousands of customers. google it

Re: Jimmy Wales threatens to encrypt Wikipedia if UK passes snooping bill

#17

Post by jiggy2011 »

mtgx wrote: post #6
nullc wrote: post #5

They should do this anyways. It's well known to the technical elite that dragnet surveillance is going on— but it's not known to the general public. It's arguably immoral that the site doesn't switch to https by default and give the public the privacy they think they already have.

That's a very good point. The majority of people have no idea that many Governments are already monitoring and data mining everything they say or do online. Websites should already start switching to HTTPS (or SPDY) to protect their users against this stealth monitoring, of which they know nothing about. But if they don't and if this law passes (I hope it doesn't) maybe some good will come out of it, and it will jump…

What makes you believe that?

Not that I necessarily think you are wrong.

Re: Jimmy Wales threatens to encrypt Wikipedia if UK passes snooping bill

#19

Post by andrewcooke »

Ironlink wrote: post #8
nullc wrote: post #5

They should do this anyways. It's well known to the technical elite that dragnet surveillance is going on— but it's not known to the general public. It's arguably immoral that the site doesn't switch to https by default and give the public the privacy they think they already have.

What makes you think that those with the resources to implement dragnet surveillance do not have access to properly signed certificates, which let them Man-In-The-Middle the connection without triggering a browser warning?

http://perspectives-project.org/ - it checks the certificate fingerprint against other users, so a targetted attack is detectable.

(there is also a beta for chrome)

Re: Jimmy Wales threatens to encrypt Wikipedia if UK passes snooping bill

#20

Post by zmmmmm »

This is one reason why enacting this kind of legislation is such a terrible idea for the very people advocating it. Right now most of the web is ridiculously open and unencrypted. If authorities get the appropriate warrants it's almost guaranteed they will be able to spy on almost anybody doing almost anything because the default mode is unencrypted and nobody really thinks about it. But that default mode is only the default because people think their communications are reasonably private anyway, precisely because this kind of logging is pretty expensive and impractical. Laws to enforce it will motivate everyone to move to encrypted connections, greatly increase use of VPNs for all non-trivial communications, and ensure that criminals become educated about how to encrypt their activities.

If governments around the world seriously pursue this, far from reaping the windfall they are hoping for they will actually kill the golden goose that could be helping them solve more crimes than ever.

Post reply on HN