Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Privacy Behaviors After Snowden

cacm.acm.org

Post reply on HN
Print view View original

31–40 of 41 posts

Re: Privacy Behaviors After Snowden

#31

Post by dombili »

mpyne wrote: post #26
dombili wrote: post #23

Earlier quoted context omitted.

Google's alleged involvement with the PRISM program however, wasn't.

Which given that PRISM just automated warrant/NSL compliance once the company's legal department agreed that the warrant/NSL was valid, means what exactly? Does FastMail get to ignore their country's own warrants if they wish?

I don't disagree with you. I'm not siding with Google or Fastmail and I don't use their services but I can see why would someone leave Google and choose Fastmail just because they don't want to be tracked by Google. Of course that's not to say their email is safer than it was with Google because the vast majority of people use Gmail anyway and your plaintext emails find their way to Google's servers one way or another. NSL's are also a factor, but that depends on your threat model. Not a lot of people will be bothered by the threat of government agents seeing their emails by getting an NSL, so eliminating the company tracking will be enough for them to feel secure. Which is, of course, a false sense of security and is bad.

Re: Privacy Behaviors After Snowden

#32

Post by resonation »

God, that was the least informative research project I've ever encountered. The premise of the research is something akin to:

  Based on recent news reports, where a whistleblower
  revealed that tobacco farmers routinely fertilize 
  their crops with human brains, which then inadvertantly
  leads to contamination of tobacco products, leaving all
  smokers at risk of developing human prion related diseases, 
  we've conducted a study to see if this increased the 
  frequency of hits on the Phillip Morris website's 
  ingredients page. Our findings show that numbers only
  increased by 0.00001%.
Gee, thanks.

Nevermind questioning why anyone would look at the list of public ingredients, when the problem is contamination, which, by definition, means that unintended ingredients ruined the desired product.

Why would a company list an accidental poison as part of its normal product?

Why would Microsoft's privacy policy reveal any useful information about secret government programs?

At no point in time have I ever met anyone who would have imagined that Microsoft's privacy policy would protect them from the NSA.

It's almost like someone decided to study the things people DON'T do, after learning of some significant revelation.

Like, hey let's conduct a study of how many people prefer to watch Family Feud over Price Is Right after being in a car accident! Oh, interesting! The difference is barely measurable!

Re: Privacy Behaviors After Snowden

#33

Post by Zigurd »

schoen wrote: post #27
Zigurd wrote: post #13

It's not the user's fault. Unless mainstream services make privacy strong, simple, and pervasive all they are doing is marking the people who seek privacy for greater surveillance. Google, Yahoo, and Microsoft need to step up and make it so my mom can have secure email. They have all the tools, especially the ability to use social graphs as the basis for web-of-trust.

Yahoo and Google are both working on end-to-end e-mail options. https://github.com/google/end-to-end https://github.com/yahoo/end-to-end An even harder problem, maybe: how could we make it so communications intermediaries don't know your social graph? The most exciting idea in this direction I know of is AGL's Pond: https://pond.imperialviolet.org/ But it comes with some more severe tradeoffs than just end-to-end enc…

There are many ways to find one's social graph, and that train may have left the station in the 1970's or early 80's with Project Daytona, which was rumored to be built for analyzing all the call detail records that could be gathered and entered in to a database.

The social graph is also an opportunity for securing key exchange through key signing and combining key exchange with real time communication that's hard to falsify and hence hard to MITM.

Re: Privacy Behaviors After Snowden

#34

Post by lfam »

lisper wrote: post #25
rsync wrote: post #20

Earlier quoted context omitted.

I don't think most of those that you list are really substantive moves. Certainly moving from dropbox to spideroak or ... someone like spideroak ... would give you the ability to encrypt independent of the provider, perhaps with duplicity[1] or this other method I like[2]. But moving from gmail to fastmail doesn't seem like ti buys you much. I think the two biggest, substantial moves you can make are providing your o…

> providing your own dialtone Is that possible? How do you do it?

Yes, I'm very interested in this. Can someone point us to some good info on setting this up?

Re: Privacy Behaviors After Snowden

#35

Post by throwawayaway »

schoen wrote: post #27
Zigurd wrote: post #13

It's not the user's fault. Unless mainstream services make privacy strong, simple, and pervasive all they are doing is marking the people who seek privacy for greater surveillance. Google, Yahoo, and Microsoft need to step up and make it so my mom can have secure email. They have all the tools, especially the ability to use social graphs as the basis for web-of-trust.

Yahoo and Google are both working on end-to-end e-mail options. https://github.com/google/end-to-end https://github.com/yahoo/end-to-end An even harder problem, maybe: how could we make it so communications intermediaries don't know your social graph? The most exciting idea in this direction I know of is AGL's Pond: https://pond.imperialviolet.org/ But it comes with some more severe tradeoffs than just end-to-end enc…

well imagine a decentralized facebook with absolute privacy. you don't need delays. traffic to and from "the server" is maintained at a flat rate of encrypted white noise type signal. whoever talks to whoever else through this black box is a mystery.

Re: Privacy Behaviors After Snowden

#36

Post by schoen »

throwawayaway wrote: post #35
schoen wrote: post #27

Earlier quoted context omitted.

Yahoo and Google are both working on end-to-end e-mail options. https://github.com/google/end-to-end https://github.com/yahoo/end-to-end An even harder problem, maybe: how could we make it so communications intermediaries don't know your social graph? The most exciting idea in this direction I know of is AGL's Pond: https://pond.imperialviolet.org/ But it comes with some more severe tradeoffs than just end-to-end enc…

well imagine a decentralized facebook with absolute privacy. you don't need delays. traffic to and from "the server" is maintained at a flat rate of encrypted white noise type signal. whoever talks to whoever else through this black box is a mystery.

There's a tension between referring to it as decentralized and saying that it has a server.

This approach is great in general, but there are some known challenges about padding and latency.

One is that you have to use padding up to the maximum rate at which you want to send data, so if you want to have some service that can use 500 kB/s, you have to send and receive that much data all the time.

Another is that you may have to make server transmissions nearly synchronous; you can't send extra data in a window even if you have a backlog. If you break this rule, then an attacker who can delay one user's traffic can use that power to confirm a hypothesis that two users are talking to one another. This probably means that you can use it for e-mail and IM, but probably not voice. There may also be a problem if a user is momentarily or permanently disproportionately popular and hence wants to receive more data than the standard padding rate allows.

You may also have to overcome users' inclination to only use the service when they're talking to each other. If not, the time windows when particular pairs of people were active may eventually show a strong correlation, especially the times when both of them disconnected.

Re: Privacy Behaviors After Snowden

#37

Post by throwawayaway »

schoen wrote: post #36
throwawayaway wrote: post #35

Earlier quoted context omitted.

well imagine a decentralized facebook with absolute privacy. you don't need delays. traffic to and from "the server" is maintained at a flat rate of encrypted white noise type signal. whoever talks to whoever else through this black box is a mystery.

There's a tension between referring to it as decentralized and saying that it has a server. This approach is great in general, but there are some known challenges about padding and latency. One is that you have to use padding up to the maximum rate at which you want to send data, so if you want to have some service that can use 500 kB/s, you have to send and receive that much data all the time. Another is that you ma…

one: that limitation is obvious, technologies such as the following can assist

https://en.wikipedia.org/wiki/Multicast

two: i don't understand how encrypted traffic that maintains a noise level and hides encrypted data in the noise can be subject to traffic analysis.

third: popularity, that is a solved problem for the majority of limited bandwidth systmes, you get lag.

fourth users inclination: both endpoints being comprimised to that extent is beyond the scope of most counter surveillance technology that i have ever heard of.

of the criticisms only the one i labelled two seems really interesting to me, could you please elaborate?

i was able to run voice comms and play computer games simultaneously on isdn and modem lines and therefore the voice bandwidth concerns i don't think are realistic

Re: Privacy Behaviors After Snowden

#38

Post by schoen »

throwawayaway wrote: post #37
schoen wrote: post #36

Earlier quoted context omitted.

There's a tension between referring to it as decentralized and saying that it has a server. This approach is great in general, but there are some known challenges about padding and latency. One is that you have to use padding up to the maximum rate at which you want to send data, so if you want to have some service that can use 500 kB/s, you have to send and receive that much data all the time. Another is that you ma…

one: that limitation is obvious, technologies such as the following can assist https://en.wikipedia.org/wiki/Multicast two: i don't understand how encrypted traffic that maintains a noise level and hides encrypted data in the noise can be subject to traffic analysis. third: popularity, that is a solved problem for the majority of limited bandwidth systmes, you get lag. fourth users inclination: both endpoints being c…

It's possible that it might turn out to be voice-capable, I'd like to see how the Guardian Project's work with voice over Tor has gone. But there is a notion that more latency is better for anonymity, and clearly worse for voice, and we don't even necessarily know where the sweet spot is for anonymity. And the anonymity that you get from something like Tor is already of questionable value against either a global adversary or one who's already monitoring you. To make the anonymity stronger there, we have to make the latency worse.

The traffic analysis comes in where you notice correlations between increased or decreased activity on one link and a corresponding change in activity on another link. Just having noise isn't necessarily enough to spoil those correlations; after all, so much of modern statistics is about detecting very weak signals given many noisy observations.

There is also research about active attackers shaping traffic flows (like delaying or blocking packets injecting additional packets). Then the notion is that the changed shape of a flow will be visible elsewhere on the network, and that's the destination. Unfortunately, this seems to work really well!

Re: Privacy Behaviors After Snowden

#39

Post by throwawayaway »

schoen wrote: post #38
throwawayaway wrote: post #37

Earlier quoted context omitted.

one: that limitation is obvious, technologies such as the following can assist https://en.wikipedia.org/wiki/Multicast two: i don't understand how encrypted traffic that maintains a noise level and hides encrypted data in the noise can be subject to traffic analysis. third: popularity, that is a solved problem for the majority of limited bandwidth systmes, you get lag. fourth users inclination: both endpoints being c…

It's possible that it might turn out to be voice-capable, I'd like to see how the Guardian Project's work with voice over Tor has gone. But there is a notion that more latency is better for anonymity, and clearly worse for voice, and we don't even necessarily know where the sweet spot is for anonymity. And the anonymity that you get from something like Tor is already of questionable value against either a global adve…

I don't think you have followed me at all. The intention is to send a noisy level of encrypted 'constant' bandwidth. The activity has the same random level of increased and decreased activity the whole time, active or inactive.

How are you not getting this?

endpoint0-n ---> 'server' ---> endpoint0-n

where ---> is a random level of encrypted noisy signal. the endpoint does not open a connection to the other endpoint, it opens it to the 'server'.

no amount of traffic analysis or packet injection is going to mess with that.

the absolute best traffic analysis can do is provide a 1/n probability based on active connections to the 'server' that endpointA was talking to endpointB.

> we have to make the latency worse.

> there's a notion that latency is good for anonymity

we have to do something because of a notion?

i give up.

Re: Privacy Behaviors After Snowden

#40

Post by schoen »

throwawayaway wrote: post #39
schoen wrote: post #38

Earlier quoted context omitted.

It's possible that it might turn out to be voice-capable, I'd like to see how the Guardian Project's work with voice over Tor has gone. But there is a notion that more latency is better for anonymity, and clearly worse for voice, and we don't even necessarily know where the sweet spot is for anonymity. And the anonymity that you get from something like Tor is already of questionable value against either a global adve…

I don't think you have followed me at all. The intention is to send a noisy level of encrypted 'constant' bandwidth. The activity has the same random level of increased and decreased activity the whole time, active or inactive. How are you not getting this? endpoint0-n ---> 'server' ---> endpoint0-n where ---> is a random level of encrypted noisy signal. the endpoint does not open a connection to the other endpoint,…

So if you can guarantee that the probability distributions of the number of bytes sent between the endpoints and server in a time window are unaffected by whether or not communication was happening in that time window, your approach is totally valid.

Pond does have that property, if you use the defaults. I don't think a lot of other systems do. The tradeoffs are pretty steep in terms of delaying interactions until the next time window, sending and receiving cover traffic in every time window, and accepting hard limits on your data rate that are bounded by the cover traffic.

What I think you can't do safely, for example, is say "I have a cover traffic pattern that is a Gaussian distribution of amount of data transmitted and received, and now I have to send a bunch of data, so I'll just pick the high of the distribution and send a whole bunch of data at once". One reason this is unsafe is that you'll simultaneously skew the recipient's distribution, creating a statistical signal that you and the recipient were communicating.

Post reply on HN