21–30 of 40 posts
Earlier quoted context omitted.
So what do you guys do to counter this? Do you use encrypted VPNs? Any specific ones you'd recommend?
check mullvad. you can pay with cash over mail, bitcoin or whatever. no logs, two external ip's for thousands of customers. google it
A VPN on VPS provider, whom accepts similar payment options is an alternative option.
They should do this anyways. It's well known to the technical elite that dragnet surveillance is going on— but it's not known to the general public. It's arguably immoral that the site doesn't switch to https by default and give the public the privacy they think they already have.
What makes you think that those with the resources to implement dragnet surveillance do not have access to properly signed certificates, which let them Man-In-The-Middle the connection without triggering a browser warning?
A man in the middle attack is _highly_ detectable and will leave irrefutable evidence when detected. So it can only be used secretly if it's used very sparingly. And highly overt interception, if its even tolerated by the public, at least solves the problem of people having no idea (being in denial) they're being watched.
Moreover, because MITM can be defeated by de-trusting the rogue CA or via key pinning using it for "mere" surveillance would destroy a valuable and potent weapon, so they won't do it. It simply isn't suitable for dragnet use.
Its also practically much more costly to scale. (E.g. instead of passive optical taps and cheap packet sampling for targeting they must fully intercept all the traffic and decrypt/reencrypt before they even know if its "interesting") Simply making the watchers have to spend a lot more money per unit of traffic monitored is a win for civil rights because it should result in more conservative use of the capability. Without the crypto the surveillance is maximally cheap and undetectable... anything is an improvement even if it can still be compromised.
Is that not encryption? Or maybe he means make that the default?
http://www.itnews.com.au/News/313178,public-opposes-federal-...
They should do this anyways. It's well known to the technical elite that dragnet surveillance is going on— but it's not known to the general public. It's arguably immoral that the site doesn't switch to https by default and give the public the privacy they think they already have.
What makes you think that those with the resources to implement dragnet surveillance do not have access to properly signed certificates, which let them Man-In-The-Middle the connection without triggering a browser warning?
This is one reason why enacting this kind of legislation is such a terrible idea for the very people advocating it. Right now most of the web is ridiculously open and unencrypted. If authorities get the appropriate warrants it's almost guaranteed they will be able to spy on almost anybody doing almost anything because the default mode is unencrypted and nobody really thinks about it. But that default mode is only the…
Maybe a little bit of a sensationalist title, websites switching to HTTPS only isn't that much of a threat, yes the bill is bad and yes he should be opposing it but Ars seem to frame it as though it's drastic or has a negative effect on anyone. While I disagree with the bill and the concept of monitoring peoples internet, I don't think they're doing it so they can find out what you're reading on Wikipedia or who you'…
> I don't think they're doing it so they can find out what you're reading on Wikipedia or who you're messaging on Facebook. What makes you think that sort of information isn't exactly what they're interested in? Even if they don't care about it right now, once it starts being collected, if any future government decides they do care about it, it'd be very easy for them to get their hands on it.
Basically, the government may not care who you're messaging on facebook now, but if someone discovers a correlation to some other problem in the future they'll be damn pleased that they have that data.
Earlier quoted context omitted.
check mullvad. you can pay with cash over mail, bitcoin or whatever. no logs, two external ip's for thousands of customers. google it
Looks interesting, but who is to say they don't keep logs? A VPN on VPS provider, whom accepts similar payment options is an alternative option.
Jimmy, if you think you have enough technology competance enough, try China's GFW.