Slashdot Mirror
NZ Professor Advocates Civil Disobedience Against Mass Surveillance
nut writes "We're all aware of how much surveillance we are under on the internet thanks to Edward Snowden. Gehan Gunasekara, an associate commercial law professor at Auckland University in New Zealand, wants us all to start sending suspicious looking but meaningless data across the internet to overload automated surveillance systems. Essentially he is advocating a mass distributed Bayesian poisoning attack against our watchers."
Just sending a bunch of keywords in email isn't enough - emacs has had a spook function since the 80s so they are kind of used to that stuff by now./ You'll have to act like a crazy-pants terrorist.
To make it really work we need to bring the eternal september to the islamic extremist websites. Everybody go post on those arabic jihadi websites. Uh, does anyone know of any arabic jihadi websites? Or how to read and write arabic?
Oh, almost forgot: FIRST!
There are a few small issues with retroshare still (No forward secrecy, key length should be longer, hell to compile), but those are just refinement issues. More users means more incentive and developer attention to perfect it.
Fifteen years ago, I'd have been all for causing a disruption. Exercising my self-evident liberties and thwarting The Man, when he came down on me for it.
Now, I have a fucked up back from a car crash, a fucked up knee from wrestling, a mortgage, people depending on me, a professional career, and neighbors. The amount of ways they could absolutely obliterate my life at their slightest whim are uncountable. As much as I'm all about people doing something and not just playing "Reddit-pretend-rebel/protestor", we are beyond the time of, say, the 90s -- where civil disobedience and voicing your dissent or even just being a vocal weirdo just got you either a knock on the door or a two hour trip into and out of your local lockup. We're in a time where you become an instant "child molester" or you just disappear or your finances go all permanently wonky, or you get "investigated" and now your neighbors and employer and coworkers all wonder what you've been up to that has raised the interest of The Man.
Very true, for now. The short-term solution is scale: sheer volume can create enough noise and wasted effort to at least slow the bastards down a bit, albeit temporarily. Overflows still happen.
In the longer term, we just need to develop and host purpose-built junk generator applications whose sole mission is to flood the sniffer's nostrils with the digital aroma of a cattle feed lot.
Scruting the inscrutable for over 50 years.
Tools are not the problem. The problem is that at a certain scale you need some infrastructure to distribute and authenticate encryption keys and at that point you'll run into the same problem we're at now: You have third parties you'll have to trust. Doesn't matter then if you have to trust them not to hand over your data (like Google and ISPs do) or your encryption keys.
It's not a technical problem, it's a political problem.
I do not agree, or at least not see it as so black and white. Tools *are* a big problem, almost a complete failure even being designed by engineers for engineers. Hard to use and setup for people with no 5kill2, not up and running by default with zero configuration on programs first install. Tools today put the egg before the chicken requiring that you pay/setup/configure yourself into the "infrastructure to distribute and authenticate encryption keys" before you can encrypt anything by default, therefore the overwhelming default is that nothing is encrypted - a big fail. In this light OTR does it right - 100% everything encrypted by default after first install of chat clients supporting it, by default. If you are one of the few that wants to raise the bar on the security from there, then you can easily check signatures out of band or use a third party authenticator - but that is secondary and and very easy to do given everyone is using it already by default. PGP/SSL does it the hard/wrong way (IMO): Forces everyone into "too complicated for the average person"/$$$ solutions even before you can start encrypting (without scary browser warnings etc). End result: Nobody encrypts, an especially glaring failure in the case of email. SSL is mostly for commercial orientated websites - check stats for vast majority of websites vs those that support SSL. Self signed certs are a dirst word
Security experts will be growling "MITM", "we neeeed third party authentication", "good security is hard to do", "MITM, again", but again it is egg before the chicken missing the forest for the trees. Top priority Job #1 is get everything encrypted all the time. Job #2 you can start worrying about how to check signatures on your certs out of band, raise the visual cues that your session is both encrypted and you have taken the extra time or used a third party to authenticate the certs signatires. If the whistleblower Snowden has taught us nothing else, it is that if you do bother to encrypt whilst nobody else is doing it then your communications are automatically being targeted for extra monitoring. Oh, and if you do happen to visit some website over https that one agency or other happens to have a grudge against or wishes to perform some industrial espionage on, then your also MITM'ed.
Security tools are still in the dark ages and do not cater to humans. No amount of political hot air is going to fix that...