Edward Snowden’s Privacy Tips: “Get Rid of Dropbox,” Avoid Facebook and Google

A friend who worked for an analytics agency once told me that insurance companies are very interested in having access to the purchasing histories of their subscribers.

We speculated why, and among several possibilities, we figured the most likely and obvious is this: what happens when you get cancer or have a heart attack at 72 and your insurance company denies all your medical claims citing the entire volume of ice cream, pork, beer, coffee and diet coke you've consumed in your life? Or cite all your family and friends that smoke, even though you don't?

I make what I think are quite responsible choices with my health, but that conversation has stuck with me as an example of how information about me, information I'm not trying to 'hide', information that I didn't consider especially 'private', might be used against me at some point in the future.

"Don't mind me, just putting important & sensitive personal information on the internet backed by the power of an easily guessible password and hints.

Pre-Encrypt -> [OwnCloud || SpiderOak || AWS S3 || etc.]

And re leaked docs ... I still don't understand the mindset that some people have (maybe someone can help me). When people say, "oh, but the US Gov isn't worried about you" all I can do is roll my eyes.

* How can you verifiably prove that? (they can't)

* How can you verifiably prove other governments aren't?

* How can you verifiably prove chaos agents aren't?

* How can you verifiably prove someone isn't silently watching you?

* etc.

Just because it was or wasn't in a leaked document does not mean that the ability does not exist nor does it mean that such capability is only in the hands of 1 government.

In my eyes, the leaked docs showed "this is the current level" re: security/privacy/surveillance. We have to assume all other governments, corps, & individuals have equally or more powerful systems in place. Why? Because it's the only safe assumption.

That assumption has no bearing on the merits of legality with how the NSA conducts its mission, nor bearing on how others act. The documents merely give evidence and a base-level run down of additional attack vectors. This has absolutely zero to do with a "legal vs. illegal"-action debate and everything to do with technological security and infrastructure.

I encourage everyone to consider RFC 7258 [1] in their future projects. Do it for your users, whomever they may be. Consider RFC 7258 your USSINT 18 (if you're American) ... that is, fucking read it, understand it, and internalize it. Maybe the gov is good, maybe they're bad - that is irrelevant when there is more than just 1 gov in the world.

[1] http://tools.ietf.org/html/rfc7258

...until the USgov/NSA chooses for them. Also, while it's all great the Syncthing tool is open source I see that they have precompiled binaries. Now I ask you, what percentage of people will compile themselves instead of downloading the readily available binary? Especially Windows users? In short, syncthing isn't immune to the USgov/NSA. We're talking about the general public; not just hardcore techies who can download & compile source code. I can just get GPG & rsync if I wanted... but that's not the point. Me and the person I replied were talking about "services"(tech companies), not stand-alone tools.

Anyways, Syncthing doesn't even replace Dropbox. Syncing files is just one of Dropbox's several features. And without a 3rd-party central server, Syncthing won't be able to deal with the person who wants their work computer to sync with their home computer. That central server is how you get around corporate firewalls, NAT and port-forwarding. If there's another way to deal with this, I'd love to hear it.

What I wanted to convey is that user data was not used (at that time) in an untoward fashion by Dropbox. Everyone that I worked with took privacy and security very seriously, and we knew that user trust is tough to earn and easy to lose. Handing data to the government automatically, without a warrant or confirmation of authority, would not have been something that anyone was interested in doing. But the government does have ways of making you do things that you don't want to do (see: Yahoo).

The biggest problem that I have with all of the Snowden revelation stuff is this: people seem quick to blame the companies who are complicit rather than the government who is the root of the problem. The government's efforts against security and privacy are the biggest threat the technology industry has ever faced, and if left unaddressed I believe it will inevitably lead to the US losing it's leadership position.

One last point, regarding Dropbox's CFO. Sujay had been at Dropbox for over three years (since 2010) and was involved in the CFO search for a long time. That they picked him for the role says a few things, but I don't see it as Condoleezza stacking the deck.