Security for the people • Hacker News Board

Re: Security for the people

#41

Post by fidotron » Thu, Sep 18, 2014, 8:08 PM UTC

I wonder what the high level thinking at Google is these days around user privacy. They must be aware that the growing noise about it means it is going to be the stick they are going to be attacked with, and yet their business relies on people willingly giving some of it up.

While this particular announcement seems fluffy, I do somewhat applaud the intent. The question of how we expect to run the internet economy and preserve user privacy is becoming more pressing for everyone though.

Re: Security for the people

#42

Post by schoen » Thu, Sep 18, 2014, 9:41 PM UTC

anon1385 wrote: post #6

stevekl wrote: post #2

And don't forget the end-to-end project[1], which is the javascript crypto library by google. The significance of these types of project extend beyond browser privacy. As crypto-currency become more prominent, we NEED better, carefully auditted javascript crypto-libraries. Right now, all the crypto-code are home baked. e.g.: https://github.com/bitcoinjs/bitcoinjs-lib/blob/master/src/e... While, I think they are all d…

Holy crap, people are actually using javascript crypto for bitcoin‽

An excellent use of an interrobang!

Re: Security for the people

#43

Post by simonebrunozzi » Thu, Sep 18, 2014, 9:45 PM UTC

Mandatum wrote: post #40

tombrossman wrote: post #18

The simplysecure.org domain uses Google Analytics which isn't disclosed on their privacy page (as required by Google Analytics' TOS). There is also a mixed-content warning because someone hard-coded an http:// link to the balloons image in the blog post on their https site. I went to email them and first looked for PGP keys (us pro-privacy & security people all use PGP, right?) and found none for the domain on any ke…

I've offered to help and recommended they switch to Piwik (and fix the http link). HN does tech satire so much better than the rest of the internet..

What do you exactly mean?

Re: Security for the people

#44

Post by scintill76 » Thu, Sep 18, 2014, 10:36 PM UTC

anon1385 wrote: post #6

stevekl wrote: post #2

And don't forget the end-to-end project[1], which is the javascript crypto library by google. The significance of these types of project extend beyond browser privacy. As crypto-currency become more prominent, we NEED better, carefully auditted javascript crypto-libraries. Right now, all the crypto-code are home baked. e.g.: https://github.com/bitcoinjs/bitcoinjs-lib/blob/master/src/e... While, I think they are all d…

Holy crap, people are actually using javascript crypto for bitcoin‽

They also pretty commonly use in-browser JS SHA256 to derive private keys from human-generated passphrases: https://brainwallet.github.io/ There have been reports of pretty obscure, but still guessable, keys being cracked this way.

Bitcoin is fascinating just because it makes these sorts of things worth untraceable money, sometimes a lot of money, and puts it in the hands of people who have never had that sort of responsibility. Whatever else cryptocurrency does, maybe it will teach laypeople about these things, devise new ways to teach them and new technological measures to increase their safety.

Re: Security for the people

#45

Post by tmzt » Thu, Sep 18, 2014, 10:48 PM UTC

mindslight wrote: post #31

It's very odd that they lead off by focusing on unrelated FUD. > However, if people are indeed working to protect themselves, why are we still seeing incidents, breaches, and confusion? That references a completely different security area, and as much as it's a juicy source of scare stories for mass media, it's unrelated to end user security with respect to government and corporate mass surveillance. The former is ba…

But the former now leads to further erosion in the latter as well as reinforcing the misconceptions and fear tacticts that lead to greater and greater incursions on the privste sphere. Those "annoying" mass media articles have led Congres to enact laws, a court to seize the operations of a private company and hand it to a competitor, as well as forming tighter public-private partnerships that provide end-runs around due process.

These things can happen because the public is uninformed, disinterested, and subjected to carefully coordinated messaging by security companies selling solutions, "credit monitoring" companies that package insurance, and the mass media that doesn't have a deep commitment to getting the facys right when it comes to this topic.

Re: Security for the people

#46

Post by Mandatum » Thu, Sep 18, 2014, 11:35 PM UTC

simonebrunozzi wrote: post #43

Mandatum wrote: post #40

Earlier quoted context omitted.

I've offered to help and recommended they switch to Piwik (and fix the http link). HN does tech satire so much better than the rest of the internet..

What do you exactly mean?

Not sure exactly, I was copying this comment: https://news.ycombinator.com/item?id=35143

Re: Security for the people

#47

Post by lazaroclapp » Fri, Sep 19, 2014, 1:18 AM UTC

fidotron wrote: post #41

I wonder what the high level thinking at Google is these days around user privacy. They must be aware that the growing noise about it means it is going to be the stick they are going to be attacked with, and yet their business relies on people willingly giving some of it up. While this particular announcement seems fluffy, I do somewhat applaud the intent. The question of how we expect to run the internet economy and…

I feel "willingly giving some [privacy] up" and "being incapable of even assessing one's level of privacy" are two very different conditions to be in.

Re: Security for the people

#48

Post by girvo » Fri, Sep 19, 2014, 1:25 AM UTC

simonebrunozzi wrote: post #43

Mandatum wrote: post #40

Earlier quoted context omitted.

I've offered to help and recommended they switch to Piwik (and fix the http link). HN does tech satire so much better than the rest of the internet..

What do you exactly mean?

Telling the Google Open Source people to use Piwik instead of Google Analytics seems like satire.

Re: Security for the people

#49

Post by eevilspock » Fri, Sep 19, 2014, 1:32 AM UTC

fidotron wrote: post #41

I wonder what the high level thinking at Google is these days around user privacy. They must be aware that the growing noise about it means it is going to be the stick they are going to be attacked with, and yet their business relies on people willingly giving some of it up. While this particular announcement seems fluffy, I do somewhat applaud the intent. The question of how we expect to run the internet economy and…

> "The question of how we expect to run the internet economy and preserve user privacy is becoming more pressing for everyone though."

It should be run like the economy should be run, with consumers paying for the things they consume directly, rather than via an advertiser proxy at significant additional costs to us all[1]. Then there would be zero need to violate user privacy except where it strictly required for end-user desired functionality, and users can vote with their wallets.

The invisible hand only works correctly with such a direct buyer-producer relationship.

This notion of "free" websites and web services is a lie and needs to be exposed[1].

[1] https://news.ycombinator.com/item?id=7485773

Re: Security for the people

#50

Post by MacsHeadroom » Fri, Sep 19, 2014, 2:20 AM UTC

englishm wrote: post #32

tptacek wrote: post #12

Researching and developing usability and security auditing practices. How do we measure the two in a single assessment? You don't. They're wildly different disciplines. Security auditing is fundamentally a systems programming problem. The least effective security "auditors" approach security as something different than software engineering. The most significant security issues arise from correctness issues; finding a…

I agree that these are separate disciplines, but I think that one reason we're not seeing anyone who does security usability work well right now is that that the best practitioners in each field tend to be silo'd by their specialization. A single assessment is not necessarily a single metric, and an assessment comprised of audits in each domain seems like a good first step toward building understanding of a common go…

>Talent on both sides is in high demand, but there are few organizations that are able to get both working together effectively on these hard problems.

Somehow Duo Security[1] has managed to do this phenomenally well. Their product is both a UX wonder and a security marvel. My first thought was "This doesn't feel like a security product. This feels like a solid UX design demo." But looking at their open source code, it's some of the more beautifully designed security software I've seen. I wonder what their secret is-- and if they'd be willing to share.

[1] https://www.duosecurity.com/