On Confirmed Assumptions or, Not Trusting Google is a Good Idea • Hacker News Board

Re: On Confirmed Assumptions or, Not Trusting Google is a Good Idea

#191

Post by contingencies » Sat, Jun 22, 2013, 2:36 PM UTC

Andrew_Quentin wrote: post #188

mpyne wrote: post #152

Earlier quoted context omitted.

Given that spying drastically shortened the war against Japan and appreciably shortened the war against Nazi Germany (both of which are definitely not on the Christmas list of UN human rights proponents), I'd be careful about how emotionally attached one gets to the issue of spying. Like many other things, it is a tool... it can be used for good or for bad, but in the end it's a tool nonetheless.

Spying on an enemy government is way different from spying on civilians.

Sure. Just like making a relevant point is way different to supporting the broken end of a dead tangent (NSA/GCHQ/etc. don't just spy on governments, they spy on anyone they feel like, and everyone by default, and this is very much confirmed now)... without presenting any evidence.

Re: On Confirmed Assumptions or, Not Trusting Google is a Good Idea

#192

Post by dmix » Sat, Jun 22, 2013, 2:39 PM UTC

coolhandluke wrote: post #86

signed0 wrote: post #3

If Google has records of all emails that have been sent and deleted, presumably even if you don't have a Gmail account the government could ask Google for all emails that had ever been sent to your account. Just as the Syrian government is unlikely to be able to get Google to give them information on particular dissidents, it would be wise for American activists to choose a email provider that is not located in the U…

Indeed. Once I manage to anonymously acquire some Bitcoins, I will be looking for a reputable VPS host based in Europe (that I can pay with Bitcoins) where I can run my own mail system.

I recommend https://countermail.com/

Re: On Confirmed Assumptions or, Not Trusting Google is a Good Idea

#193

Post by dmix » Sat, Jun 22, 2013, 2:42 PM UTC

sneak wrote: post #180

coolhandluke wrote: post #86

Earlier quoted context omitted.

Indeed. Once I manage to anonymously acquire some Bitcoins, I will be looking for a reputable VPS host based in Europe (that I can pay with Bitcoins) where I can run my own mail system.

Why, so that all the emails you send and receive can go right back to american PRISM partners? There's little point to that when everyone you email uses gmail.

The only option is for the creation of a user-friendly and encrypted alternative that people can transition to.

Right now that doesn't exist.

Re: On Confirmed Assumptions or, Not Trusting Google is a Good Idea

#194

Post by mpyne » Sat, Jun 22, 2013, 3:01 PM UTC

sneak wrote: post #177

mpyne wrote: post #161

Earlier quoted context omitted.

We have encryption. We need to use it.

My using encryption doesn't suddenly make all of the hundred people I regularly communicate with on gmail suddenly have PGP keys or smartphones that support encrypted messages.

Hence why I said, "we". Every encryption scheme you propose will actually need to be used by other people to make the system work overall.

Re: On Confirmed Assumptions or, Not Trusting Google is a Good Idea

#195

Post by mpyne » Sat, Jun 22, 2013, 3:02 PM UTC

sneak wrote: post #174

mpyne wrote: post #165

Earlier quoted context omitted.

Well, how about this one? I would argue that controlling what substances are injected into your own body is pretty fundamental human right. So why do we allow societies to impose a vaccination regimen on people, by even minor coercion?

Oh, I thought you were going heroin, instead you went antivax.

Figured it was worth a shot. I would actually imagine there's a lot of people who actually are antivax for the reason I mention, but you never know 'til you try, right? ;)

Re: On Confirmed Assumptions or, Not Trusting Google is a Good Idea

#196

Post by jmillikin » Sat, Jun 22, 2013, 3:23 PM UTC

embolism wrote: post #141

jmillikin wrote: post #127

Earlier quoted context omitted.

> It could create the exact private service that you are looking for, but it intentionally does not. Most of Google's products are "webapp" equivalents to traditional desktop software. It is not possible to create webapps which are private against the webapp's host. What you are essentially arguing is that Google ought to shut down its current business in favor of writing security-conscious desktop apps. The result w…

Google was perfectly capable of creating a secure browser and propagating it through all manner of mechanisms. There is no reason they couldn't do the same with a secure mail system, for that matter they could just deliver it as a chrome update and smoothly redirect people into it if they wanted to. There is absolutely no reason why users would 'all jump ship' to another provider. All you are really saying is that Go…

  > Google was perfectly capable of creating a secure
  > browser and propagating it through all manner of
  > mechanisms.

Google could easily create a secure email client. There's no need to, since Thunderbird already exists, but they could if they wanted to. That wouldn't help at all with the problem of email security.

  > There is no reason they couldn't do the same with a
  > secure mail system, for that matter they could just
  > deliver it as a chrome update and smoothly redirect
  > people into it if they wanted to.

What you're asking for is for Google to create its own proprietary communication protocol, then force all Chrome users to have it, then force Gmail users to use it. Can you imagine the reaction? Apart from flagrantly violating "don't be evil", it would lock out every alternative browser and prevent Gmail users from communicating with non-Gmail users. It would be XMPP->Hangouts all over again, except even worse because people actually use email.

And consider how the implementation would have to work. First, it would be available for only a handful of browsers, possibly even only Chrome. Obviously it would need to be equivalent-ish to POP3, so that no data remains on Google's servers, which means that users would only be able to check their mail from a single device. If they bought a smartphone, they'd have to choose which device to read mail on. If they bought a new computer, they'd lose access to their previously received mail.

There is no technical reason why Google could not create a secure messaging system. There are many many many social reasons.

  > All you are really saying is that Google exposes data
  > to the government because its business model dictates
  > that it put privacy below behavioral profiling it its
  > list of priorities. That is not in dispute.

Google exposes data to the government because it is headquartered in a country where laws require compliance with search warrants. In theory Google could choose to relocate all of its employees to Somalia to avoid warrants, but that seems impractical.

If a user wants their data to be truly private, then the implementation of that requires much more stringent privacy measures than most users are willing to put up with.

Your position appears to be that companies should not provide communication products for people who don't mind giving up a bit of privacy in exchange for a lot of convenience. That's not a reasonable position.

  > whereas I think that a group of people as talented and
  > resourceful as Google could solve it if they wanted to

This problem is not a technical problem, so no amount of technical expertise could solve it. You could set every single programmer in the world at solving this, but if their solution involves a user having to understand encryption keys then it would never be adopted.

Re: On Confirmed Assumptions or, Not Trusting Google is a Good Idea

#197

Post by jmillikin » Sat, Jun 22, 2013, 4:05 PM UTC

embolism wrote: post #122

jkrems wrote: post #117

Earlier quoted context omitted.

This has nothing to do with privacy and free services. Yes, that is a problem, but it has no connection at all to this case. It's about emails and private chats being given to the government without any limitations. It's about non-US citizens having zero protection or due process when they use US-based cloud services. That's a couple of degrees more severe than "Google is storing personal details about you and may gi…

You can't separate the two. The reason why foreigners are uploading their data to the NSA when they use Google is because of the way Google makes its money and engineers its services. Compare this to Apple's iMessage or FaceTime - Apple cannot decrypt the contents of the messages, and therefore cannot give the contents to the government. They designed the service this way because their users pay for the service as pa…

  > Compare this to Apple's iMessage or FaceTime - Apple
  > cannot decrypt the contents of the messages, and
  > therefore cannot give the contents to the government.

This is not correct.

First, when you buy a new iPhone, the way you authenticate yourself is by entering your Apple ID and password. Once entered, your new device will begin receiving iMessage data. This means that Apple is capable of provisioning a virtual device with your credentials, which will receive your messages. From there, they can be either stored or forwarded to third parties.

Second, your iPhone runs binaries distributed by Apple. There is no technical reason why these binaries could not contain code to forward historical messages to Apple or to a third party. Even if they don't now, a future update to iOS (which you won't be able to audit) could introduce such code.

The only way to have private communication is for all parties to run open-source clients. Each party must have the technical skill to audit the source code, or there must be at least one (preferably multiple) trusted third-party auditor. They must distribute encryption keys through a separate channel which does not depend on the communication host.

In other words, the standard Thunderbird+GPG+keyparty system that is popular among nerds but has seen no uptake among the general population.

Re: On Confirmed Assumptions or, Not Trusting Google is a Good Idea

#198

Post by spankalee » Sat, Jun 22, 2013, 4:35 PM UTC

gnosis wrote: post #109

spankalee wrote: post #103

Earlier quoted context omitted.

Free has nothing to do with it. Go ahead and pay for the same services, but it'll do nothing to protect your data from a search warrant.

Actually, it does have something to do with it. When you don't pay for a service in money, the company providing that service has to find some other way of generating money. Often they do this by collecting and selling data about you. Now, that doesn't mean that just because you paid for a service they won't do the same thing. But they'll will have more incentive to protect their paying customers than some service wh…

Sorry, paid or not still doesn't have anything to do with whether or not a company will comply with a lawful order, or how much that company will push back. The incentive and willingness to push back isn't related to how much a single user pays, but considerations like the principles of the company, and the estimated aggregate losses from the perception that a company doesn't protect their user's data. Google, for instance, has a much higher potential loss from this perception than a smaller company that charges.

Also, Google does not sell information about their users. They target ads. The difference is huge.

Re: On Confirmed Assumptions or, Not Trusting Google is a Good Idea

#199

Post by B0Z » Sat, Jun 22, 2013, 4:59 PM UTC

icebraining wrote: post #125

B0Z wrote: post #80

Earlier quoted context omitted.

> I don't understand how this argument that the constitution of a country (which represents its highest thoughts and ideals) can be applied selectively (i.e., only to citizens). If the thoughts contained therein regarding the rights of human beings are indeed 'True', then surely they should apply to all human beings? You'll get little argument from most 'Mericans for your statement that these rights are human rights.…

But that's why you have to fight whatever government collects your taxes for those very rights on your own. Why? It's not the government collecting my taxes that is reading my emails and generally spying on my communications, it's the US'. How does fighting it help me?

I hear the point. Seriously I do. But the Constitution the US is bound by is not an agreement between the US government and citizens of the world. It's an agreement between the US government and the citizens for whom it claims jurisdiction. It's scope and application is not only limited, but intentionally and wisely limited. Were it not, we would be imperial Britain and we all know how that worked out.

Re: On Confirmed Assumptions or, Not Trusting Google is a Good Idea

#200

Post by B0Z » Sat, Jun 22, 2013, 5:14 PM UTC

jkrems wrote: post #132

B0Z wrote: post #80

Earlier quoted context omitted.

> I don't understand how this argument that the constitution of a country (which represents its highest thoughts and ideals) can be applied selectively (i.e., only to citizens). If the thoughts contained therein regarding the rights of human beings are indeed 'True', then surely they should apply to all human beings? You'll get little argument from most 'Mericans for your statement that these rights are human rights.…

I think you are missing the point here: My government (Germany) already grants those rights, maybe even more rights than the US. But this doesn't mean anything when I'm using a service provided by an US company over which my government doesn't have any jurisdiction. What the US government says by its position and in the age of internet and cloud computing is the following: The moment any non-US citizen is using a ser…

> The moment any non-US citizen is using a service provided by an US company, he is giving up any right to due process, privacy and data security (as far as this service is concerned). Which is risky and short-sighted to say the least.

I realize this is a crappy response, but the only solution is to not use the services of countries whose laws do not explicitly protect you. As a US citizen, I refuse to use any services that can avoid that are provided by China for this very reason. (aside from the fact that I can't read Chinese.)

But... it's really, really important you understand something else here... The rights and protections you are correctly suggesting are NOT granted to you because of the limited scope and application of our Constitution, are the exact same rights and protections of mine, as a US citizen, that are currently being violated. Were I a citizen of another country, I would be just as, if not more, incensed about what has been claimed about the privacy rights of my data recently. But imagine what it's like to have grown up in a country where the guarantee of these rights is so ingrained in our minds that they are barely (almost NEVER) questioned, to find out that they are being violated at will and without the legal right to challenge or even the right to know what those violations are.

I can not even begin to articulate to you the degree of uncontainable rage I and many, many people I know have regarding what is going on right now. I can't recall a single time in my entire life, which is not an insignificant number, that I have been more angry or concerned about anything. NOT F!*&%$ ONCE!