Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Criminal N.S.A.

nytimes.com

Post reply on HN
Print view View original

81–90 of 116 posts

Re: The Criminal N.S.A.

#81

Post by sp332 »

mverwijs wrote: post #78
etherael wrote: post #74

Earlier quoted context omitted.

We don't know for certain that several governments have archived stored copies of all cloud based email in existence, it's hazy as to what they do and do not have access to, what isn't hazy is that they have the right to demand the content of any given gmail account with effectively zero recourse available. The very fact that they actually do make these demands indicates on balance of probability, they don't actually…

I was hoping someone far more talented than me would write a browser plugin that would encrypt everything I type in a TEXTAREA with GPG, and then prompt me for a list of friends I'd like to have read that text. Everything, from Facebook to Gmail, would be encrypted that way. And I would be in control of the list of people that could read that text.

Wouldn't you have to encrypt the text repeatedly, once for each recipient?

Re: The Criminal N.S.A.

#82

Post by tripzilch »

rlpb wrote: post #68
_s wrote: post #47

Earlier quoted context omitted.

I agree with this but why not take it a step further? We're hackers, working on tools/applications that facilitate the transfer of information - why don't we implement encryption from the get-go? There wouldn't be a need to 'popularize' something exists by default. GnuPG/PGP are fairly trivial to implement; here's some apps that are ripe for production: - Messaging application that exchanges public keys on first cont…

Governments can still gather the metadata of encrypted emails. Both PGP and S/MIME do not encrypt the subject line, sender or recipient addresses. To use encrypted email and hide the subject line, you need to not use it (just say "Encrypted email") or something. This cannot be made automatic without impacting UX. The To: header fundamentally cannot be removed. The sender can be inferred from the account within the em…

> Governments can still gather the metadata of encrypted emails.

True, but don't throw out the baby with the bathwater right away. I know metadata is at least as sensitive as the actual content, but you need to pick your battles. If we get people to widely use GPG to encrypt the content of their emails, that is already a huge win. Why? Because they're now using a public/private key infrastructure. And as you are probably well aware, as soon as everyone involved has secure private keys, implementing all sorts of nifty crypto strategies to hide pretty much whatever you want, is just a matter of adding protocols. And that can be done pretty transparently, if only the intended users would already be using keypairs for identity management. So, IMO, even if just encrypting the content is not quite complete privacy, it's a great step on the way to getting there.

The other way around, hiding the metadata first, or perhaps both at the same time, seem a lot harder to accomplish widely.

So even if you're technically right, getting the public in the habit of using GPG, is not a waste of time, it's just that for some crazy reason common usage of strong crypto is so far behind the times they are going to need several steps to catch up with technology.

> Is there a standard email header that advertises "you can reply back to me with a PGP encrypted email encrypted to key ID X and I'll be able to read it automatically"? If not, somebody should propose one. Public keyservers exist so I see no reason a simple header like this wouldn't suffice.

that's a great idea. anyone know if something like this does not already exist?

(and I'm not entirely sure if those key-ID's are sufficiently unique and/or secure, but you can put more then just the ID in such a header to fix that)

Re: The Criminal N.S.A.

#83

Post by DanBC »

tripzilch wrote: post #82
rlpb wrote: post #68

Earlier quoted context omitted.

Governments can still gather the metadata of encrypted emails. Both PGP and S/MIME do not encrypt the subject line, sender or recipient addresses. To use encrypted email and hide the subject line, you need to not use it (just say "Encrypted email") or something. This cannot be made automatic without impacting UX. The To: header fundamentally cannot be removed. The sender can be inferred from the account within the em…

> Governments can still gather the metadata of encrypted emails. True, but don't throw out the baby with the bathwater right away. I know metadata is at least as sensitive as the actual content, but you need to pick your battles. If we get people to widely use GPG to encrypt the content of their emails, that is already a huge win. Why? Because they're now using a public/private key infrastructure. And as you are prob…

> I know metadata is at least as sensitive as the actual content, but you need to pick your battles. If we get people to widely use GPG to encrypt the content of their emails, that is already a huge win. Why? Because they're now using a public/private key infrastructure. And as you are probably well aware, as soon as everyone involved has secure private keys, implementing all sorts of nifty crypto strategies to hide pretty much whatever you want, is just a matter of adding protocols. And that can be done pretty transparently, if only the intended users would already be using keypairs for identity management. So, IMO, even if just encrypting the content is not quite complete privacy, it's a great step on the way to getting there.

True, but key-pairs pretty much cryptographically ties a real person to an online identity, and so that makes meta-data more valuable, and makes "give us your keys or go to jail laws" more scary.

Re: The Criminal N.S.A.

#84

Post by aubergene »

mtgx wrote: post #37

Here's the thing. If file-sharers have the right to anonymous speech , what does that say about everyone being spied upon by the NSA? http://torrentfreak.com/file-sharers-have-right-to-anonymous... I'm starting to think more and more that beyond this being a US Constitution issue, it's a human rights issue, and we should fight to ban all such spying internationally. Yes, I realize how hard that that may be to achieve…

UNIVERSAL DECLARATION OF HUMAN RIGHTS - Article 12.

No one shall be subjected to arbitrary interference with his privacy, family, home or correspondence, nor to attacks upon his honour and reputation. Everyone has the right to the protection of the law against such interference or attacks.

http://www.un.org/en/documents/udhr/index.shtml#a12

Re: The Criminal N.S.A.

#85

Post by dllthomas »

anigbrowl wrote: post #34
andrewljohnson wrote: post #30

Earlier quoted context omitted.

How are you construing an unconstitutional surveillance program as a political question? I don't see how any of the Court Cases listed on the wikipedia article are relevant. These all seem to relate to truly political things, like which branch has what authority, or how districts are apportioned. The article only cites 5 areas the courts have clear precedent on - wars, treaties, gerrymandering, impeachment, as well a…

I'm not all that sure it is unconstitutional, for one thing - aren't you begging the question here? And on a more general level, shouldn't you be considering precedent on justiciability, rather than basing your whole argument on your personal opinion of the waht the constitution means? I might note in asssing that I favor a constitutional amendment that would create an explicit right to privacy; I'm not in favor of a…

Please explain to me how a "constitutional amendment creating an explicit right to privacy" would do fuck all if the only body that assesses constitutionality won't allow us to complain when that right is breached.

Re: The Criminal N.S.A.

#86

Post by popee »

marvin wrote: post #67
h0w412d wrote: post #39

Earlier quoted context omitted.

How about we popularize encryption, and take the choice out of the hands of corporations and governments?

That isn't a sufficient solution. These spying programs are the beginnings of totalitarism. They have to be repealed.

Beginning? You guys do really think you are free lol? Just because you can choose one of gazillion same bubble gums is not freedom! Try to change important things (like your government) and you will see that you already live in tyranny.

P.S. Intended to be brutal, think about it.

Re: The Criminal N.S.A.

#87

Post by awesomifier »

mtgx wrote: post #37

Here's the thing. If file-sharers have the right to anonymous speech , what does that say about everyone being spied upon by the NSA? http://torrentfreak.com/file-sharers-have-right-to-anonymous... I'm starting to think more and more that beyond this being a US Constitution issue, it's a human rights issue, and we should fight to ban all such spying internationally. Yes, I realize how hard that that may be to achieve…

A significant number of HN users will eschew privacy and even basic human rights (as you so rightly point out) for convenience and the next shiny object.

Take Google for example. We know they are selling out their users, and yet every time they introduce a service, the story gets voted up and readers ooh and ahh. These services harvest the user's personal communications and information for the NSA.

Google hasn't stopped selling out its users. They are doing it now, but there are people reading this comment who will ignore it until it becomes too late.

Re: The Criminal N.S.A.

#88

Post by rlpb »

tripzilch wrote: post #82
rlpb wrote: post #68

Earlier quoted context omitted.

Governments can still gather the metadata of encrypted emails. Both PGP and S/MIME do not encrypt the subject line, sender or recipient addresses. To use encrypted email and hide the subject line, you need to not use it (just say "Encrypted email") or something. This cannot be made automatic without impacting UX. The To: header fundamentally cannot be removed. The sender can be inferred from the account within the em…

> Governments can still gather the metadata of encrypted emails. True, but don't throw out the baby with the bathwater right away. I know metadata is at least as sensitive as the actual content, but you need to pick your battles. If we get people to widely use GPG to encrypt the content of their emails, that is already a huge win. Why? Because they're now using a public/private key infrastructure. And as you are prob…

> If we get people to widely use GPG to encrypt the content of their emails, that is already a huge win.

Sure. Completely agree.

> (and I'm not entirely sure if those key-ID's are sufficiently unique and/or secure, but you can put more then just the ID in such a header to fix that)

Note that a key ID is just the last characters of the fingerprint. If you want a more secure key ID, just use a longer piece of the fingerprint (which is a valid longer form of key ID that gpg will Just Work with).

Re: The Criminal N.S.A.

#89

Post by rlpb »

DanBC wrote: post #83
tripzilch wrote: post #82

Earlier quoted context omitted.

> Governments can still gather the metadata of encrypted emails. True, but don't throw out the baby with the bathwater right away. I know metadata is at least as sensitive as the actual content, but you need to pick your battles. If we get people to widely use GPG to encrypt the content of their emails, that is already a huge win. Why? Because they're now using a public/private key infrastructure. And as you are prob…

> I know metadata is at least as sensitive as the actual content, but you need to pick your battles. If we get people to widely use GPG to encrypt the content of their emails, that is already a huge win. Why? Because they're now using a public/private key infrastructure. And as you are probably well aware, as soon as everyone involved has secure private keys, implementing all sorts of nifty crypto strategies to hide…

A PGP key is generally tied to an email address. So autogenerating PGP keys per-email-address surely doesn't tie anything to a real identity any more than an email address already does?

Re: The Criminal N.S.A.

#90

Post by awesomifier »

awesomifier wrote: post #87
mtgx wrote: post #37

Here's the thing. If file-sharers have the right to anonymous speech , what does that say about everyone being spied upon by the NSA? http://torrentfreak.com/file-sharers-have-right-to-anonymous... I'm starting to think more and more that beyond this being a US Constitution issue, it's a human rights issue, and we should fight to ban all such spying internationally. Yes, I realize how hard that that may be to achieve…

A significant number of HN users will eschew privacy and even basic human rights (as you so rightly point out) for convenience and the next shiny object. Take Google for example. We know they are selling out their users , and yet every time they introduce a service, the story gets voted up and readers ooh and ahh. These services harvest the user's personal communications and information for the NSA. Google hasn't sto…

A significant number of HN users will eschew privacy and even basic human rights (as you so rightly point out) for convenience and the next shiny object.

Take Google for example. We know they are selling out their users, and yet every time they introduce a service, the story gets voted up and readers ooh and ahh. These services harvest the user's personal communications and information for the NSA.

Google hasn't stopped selling out its users. They are doing it now, but there are people reading this comment who will ignore it until it becomes too late.

The truth sucks, doesn't it.

Post reply on HN