Mozilla Persona and Surveillance
identity.mozilla.com
Mozilla Persona and Surveillance
1–10 of 59 posts
Re: Mozilla Persona and Surveillance
#2Any plans to pin the login.persona.org SSL certificate in browsers? It seems like a pretty tasty MITM attack target, especially while most identity providers don't have native persona support.
login.persona.org is listed in the key pinning list in Chrome[1], but marked as kNoPins, DOMAIN_NOT_PINNED - whatever that means.
[1] http://src.chromium.org/viewvc/chrome/trunk/src/net/http/tra...
Re: Mozilla Persona and Surveillance
#3"First, it’s not clear to us that other governments have any less intrusive surveillance activities."
Well, it is clear the US has it. That should be enough. There are some unknowns unknowns, but this is a known unknown. There are other governments with the same willingness and capabilities of spying on everyone (do not move to China), but most of the countries in the world do not have a Government with both willingness and the technical abilities to do it. And most of the countries do not have a huge and highly sophisticated shadow-government, with multiple agencies working out of the public oversight. Most countries have secret services, but they are a joke compared to what the US is able to deliver.
"Second, as a US company, Mozilla is subject to US Laws, wherever we host our servers."
Move the company out of the US. I undertsand that it won't be easy, but is the only way to be 100% sure that the US Government will not come requesting data (not that they will not take it anyway, if they are able to)
"Third, we’d rather not engage in an arms-race with US government agencies."
Read: we are afraid to lead here, because backlash from the government (and the public?) could be too damaging for Mozilla.
"We’d rather focus on efforts to change the Law to respect user data wherever it lives."
We know so much: the privacy situation in the US is bad, and getting worse very fast. No amount of public discussion or legislation is going to change that. If PRISM is outlawed, even if those responsible are put into prison, they will start the PROSM program, more secretive, more broad. We will know about it on 2037 (maybe not, since by then we will be already living in a fully accomplished Orwell world). By then Mozilla will issue a statement similar to this one, explaining why they are not really taking the necessary steps.
Fazit: if even a company committed to freedom and openness like Mozilla is not willing and/or able to take the necessary steps, it shows how unavoidable 1984 is.
Re: Mozilla Persona and Surveillance
#4"First, it’s not clear to us that other governments have any less intrusive surveillance activities." Well, it is clear the US has it. That should be enough. There are some unknowns unknowns, but this is a known unknown. There are other governments with the same willingness and capabilities of spying on everyone (do not move to China), but most of the countries in the world do not have a Government with both willingn…
> Move the company out of the US.
> Read: we are afraid to lead here...
Both the non-profit and for-profit arms of Mozilla are funded almost entirely by Google. It's a pretty safe bet that they'll follow Google's overall lead in dealing with the government.
https://en.wikipedia.org/wiki/Mozilla_Foundation - "funded almost exclusively by Google Inc."
https://en.wikipedia.org/wiki/Mozilla_Corporation - "Google pays Mozilla a substantial sum – in 2006 the total amounted to around $57 million, or 85% of the company’s total revenue. [The deal was extended multiple times and currently expires in November 2014.]"
Re: Mozilla Persona and Surveillance
#5"First, it’s not clear to us that other governments have any less intrusive surveillance activities." Well, it is clear the US has it. That should be enough. There are some unknowns unknowns, but this is a known unknown. There are other governments with the same willingness and capabilities of spying on everyone (do not move to China), but most of the countries in the world do not have a Government with both willingn…
> Move the company out of the US.
But that's not enough. If they really want to be free from the US's reach they'd have to:
- not do business with any companies under US jurisdiction (oops - Google and Microsoft)
- not employ and US citizens or permanent residents
- warn employees that they could get arrested if they visit the US
- ...
And given that Firefox is a very visible browser with significant market share, the US government would probably be very motivated to squash outright defiance.
Re: Mozilla Persona and Surveillance
#6"First, it’s not clear to us that other governments have any less intrusive surveillance activities." Well, it is clear the US has it. That should be enough. There are some unknowns unknowns, but this is a known unknown. There are other governments with the same willingness and capabilities of spying on everyone (do not move to China), but most of the countries in the world do not have a Government with both willingn…
> Move the company out of the US. But that's not enough. If they really want to be free from the US's reach they'd have to: - not do business with any companies under US jurisdiction (oops - Google and Microsoft) - not employ and US citizens or permanent residents - warn employees that they could get arrested if they visit the US - ... And given that Firefox is a very visible browser with significant market share, th…
You are probably right, but Mozilla should go down putting up a fight. And this is a fight worth losing.
Re: Mozilla Persona and Surveillance
#7"First, it’s not clear to us that other governments have any less intrusive surveillance activities." Well, it is clear the US has it. That should be enough. There are some unknowns unknowns, but this is a known unknown. There are other governments with the same willingness and capabilities of spying on everyone (do not move to China), but most of the countries in the world do not have a Government with both willingn…
NSA and GCHQ are very good at math and very good at surveillance.
Not engaging in an arms race with well funded, very smart, government agencies is probably a good idea.
If they think you're a criminal (doesn't apply to Mozilla) they will coerce foreign governments to cooperate - see for example the illegal attacks on Mega or the domain seizures for gambling or torrent sites.
But we know, from ECHELON, that they're happy to spy on anyone, and use weird loopholes in the law to do so.
Mozilla would need to find a country that had great Internet infrastructure; good strong laws and privacy culture[1]; lack of links to US; comfortable living for staff; etc etc.
That's not easy.
[1] The US has a strong culture of privacy, which is what makes PRISM so surprising for their citizens. (Not for many other people who were saying it's happening, and have been doing so for a while.)
Re: Mozilla Persona and Surveillance
#8"First, it’s not clear to us that other governments have any less intrusive surveillance activities." Well, it is clear the US has it. That should be enough. There are some unknowns unknowns, but this is a known unknown. There are other governments with the same willingness and capabilities of spying on everyone (do not move to China), but most of the countries in the world do not have a Government with both willingn…
> "Third, we’d rather not engage in an arms-race with US government agencies."
> Read: we are afraid to lead here, because backlash from the government (and the public?) could be too damaging for Mozilla.
I read "This is a race we'll probably not win and even if we do, we'd have a lot of power tied up there. But we can win by just changing the rules, so let's do that."
Re: Mozilla Persona and Surveillance
#9"First, it’s not clear to us that other governments have any less intrusive surveillance activities." Well, it is clear the US has it. That should be enough. There are some unknowns unknowns, but this is a known unknown. There are other governments with the same willingness and capabilities of spying on everyone (do not move to China), but most of the countries in the world do not have a Government with both willingn…
NSA and GCHQ are very good at math and very good at surveillance . Not engaging in an arms race with well funded, very smart, government agencies is probably a good idea. If they think you're a criminal (doesn't apply to Mozilla) they will coerce foreign governments to cooperate - see for example the illegal attacks on Mega or the domain seizures for gambling or torrent sites. But we know, from ECHELON, that they're…
"good strong laws and privacy culture[1]"
"[1] The US has a strong culture of privacy, which is what makes PRISM so surprising for their citizens. (Not for many other people who were saying it's happening, and have been doing so for a while.)"
When will the public accept that "good strong laws and privacy culture" is not in the least a characteristic of the US, and hasn't been for the last 30 years?
The US is probably not a democracy anymore, and hasn't been for over 20 years, since Governments are elected by corporate interests (via campaign funding)
Re: Mozilla Persona and Surveillance
#10"First, it’s not clear to us that other governments have any less intrusive surveillance activities." Well, it is clear the US has it. That should be enough. There are some unknowns unknowns, but this is a known unknown. There are other governments with the same willingness and capabilities of spying on everyone (do not move to China), but most of the countries in the world do not have a Government with both willingn…
> "Third, we’d rather not engage in an arms-race with US government agencies." > Read: we are afraid to lead here, because backlash from the government (and the public?) could be too damaging for Mozilla. I read "This is a race we'll probably not win and even if we do, we'd have a lot of power tied up there. But we can win by just changing the rules, so let's do that."
The US has been changing the rules since decades. The shadow government has adapted to those changes, becoming more and more powerful with each change. The US will pass a couple of "government openness" laws in the coming months (years?). The shadow government will laugh at that, move operation proceedings to the new release, and increase the broadness of surveillance, thanks to improvements in technology.
The only way to stop this, until privacy technology is widespread (which I hope will become a huge topic soon), is to stop doing business in the US right now.