Slashdot Mirror
Schneier: The US Government Has Betrayed the Internet, We Need To Take It Back
wabrandsma writes "Quoting Bruce Schneier in the Guardian: 'The NSA has undermined a fundamental social contract. We engineers built the internet – and now we have to fix it. Government and industry have betrayed the internet, and us.
This is not the internet the world needs, or the internet its creators envisioned. We need to take it back.
And by we, I mean the engineering community. Yes, this is primarily a political problem, a policy matter that requires political intervention. But this is also an engineering problem, and there are several things engineers can – and should – do."
One solution at hand are darknets - awesome and uncensorable (but slow, though that is the price) Freenet,
and I2P for hidden services, and the orginal plain Tor.
Come join us, at #freenet at freenode.org we are supporting all users of freenetproject.org
Also, consider just started channel #mempo where new linux distribution is planned with the goal of being most secure one (combining best ideas from Hardened Gentoo, Debian, Tails, Whonix, Qubes-Os). Because security must be complete on all levels (e.g. darknet but also av, rootkit protection, programs compartmnet :)
That whole 'IP over Carrier Pigeon' thing doesn't look so crazy now does it? Until the NSA start training intercepting hawks.
Waiting for an amusing sig.
they've got flamethrowers, man
Thought I would use Bruce's Password safe http://passwordsafe.sourceforge.net/ and dowwnload http://sourceforge.net/projects/passwordsafe/files/ but no HTTPS, should I be worred?
But in all practicality, how do you seize back control from the likes of the three-letter agencies?
It's not like there is any party in the US which hasn't been complicit in granting them ever-greater powers. It's not like a Canadian like myself can vote against the bullshit. It's not like Canada is about to invade the US over the issues, nor anyone else, seeing as their three-letter agencies are doing the same god-damned thing.
I do not fail; I succeed at finding out what does not work.
(Sorry for bad englihs)
As I have stated my opinion multiple times in last two decade, commercial, designers and politics has ruined the Internet
WWW should have been mostly textual information with good clear layout without "Everything can be clickable" and fancy animations and pictures everywhere (CSS, you are terrible!).
People have forgot that Internet is not same thing as WWW but WWW is only a "top-layer" using Internet and commercial has burn that false believe to consumers foreheads.
Politics has ruined internet by trying to "own it", same manner as well commercial (ISP/Carriers, big corporations like Microsoft) by inventing own protocols or limiting access to API. How do I miss the times when Xerox Star was the thing with ethernet.
It is sad thing that Unix in one manner died but nice to see that Linux is carrying the torch (vision) of possibility to have clear file-based networking systems.
The sarcasm BURNS it's so powerful...
A bullet may have your name on it but splash damage is addressed "To whom it may concern."
Let me know how it turns out.
Get your free Dropbox account with 2 GB Free storage!
Actually, I think we need "unions" for programmers or engineers in general to sort out this kind of issue.
As another example, if we had unions back in the Windows95 era, then there would never have been an IE6. We would have had stronger web standards.
If Pandora's box is destined to be opened, *I* want to be the one to open it.
It's our only hope.
Also: mandatory encryption, support for non-RSA modes of key exchange, and (this is what Tor really lacks) extra latency on request.
Since I started working with Snowden's documents, I have been using GPG, Silent Circle, Tails, OTR, TrueCrypt, BleachBit, and a few other things I'm not going to write about.
He recommend Silent Circle right after saying "the NSA also works with security product vendors to ensure that commercial encryption products are broken in secret ways that only it knows about. "
Silent circle - a US and UK connected commercial company - propriety closed source, and in a sneaky "no we are open, really trust us" sort of way. W T F!???
let me reproduce this informative message posted to the comment section of the article:
I usually rate Bruce Schneier highly, except for his faux pas a few years ago when he initially endorsed showing passwords on screen, saying that shoulder surfing is not such a big deal.
But I am not sure about some of the security mobs he is advocating here.
GPG: OK, clever people can read the source code (though most average Joe programmers can't)
Silent Circle: It's USA based, and subject to the same backdoor 'requests' as anyone US-based company. It also employs ex-special forces 'security experts' - just the sort of people who might go and do wiretaps in foreign climes.
Tails: What I have just seen on their website, 'Numerous security holes in Tails 0.19 Posted Mon 05 Aug 2013 12:00:00 AM CEST'. Not exactly the best advert and hardly comforting if one wanted security.
OTR: Same as GPG as the source code is available.
Truecrypt: Well the soruce code is avaiable, so I would put it in the same basket as GPG. It has a choice of algorithms, including one (partly) designed by Schneier.
Bleachbit: Well that is client-side. Anything in the clear across the net (i.e. non encrypted traffic) can be read anywhere along the route.
But the big glaring thing is, at least in the UK, you can be sent to prison for refusing to hand over your encryption keys. And this has happened. People like to talk big, but the prospect of eating porridge with a lot of nasty looking and foul smelling prisoners, does not appeal to most people.
I would say that doing your own encryption, by this I mean using some of the open source tools and not closed source ones (and definitely not American ones) is a good thing.
"One, we should expose. If you do not have a security clearance, and if you have not received a National Security Letter, you are not bound by a federal confidentially requirements or a gag order"
Once again the UK trumps the US in the paranoia and anti-freedom game. The UK Official Secrets Act applies to all British subjects, OK they get you to sign it, but that us mostly a symbolic gesture to remind you of your obligations and the penalties. Under the act you don't even need to have clearance or be the recipient of a leak. Even if you have worked it out for yourself from publicly available information you can still be gagged, and breaking a gag can bring down the full force of the law against you.
Nobody messes with US government. If you try to change it, you are endangering your family and put yourself in jail at best.
Bruce nailed it. We've sat on our collective asses and watched the politicians, spooks, and marketing clowns turn an engineering marvel into a sad parody of it's former intended self. I don't think anyone nowadays can question the need for some serious re-engineering. We can solve the technical problems and propose new standards and protocols.The real question is how do we implement the fix.
Will the standards committees support it? Will the Powers that Be allow it? Like Bill the Bard wrote, "Aye, there's the rub."
Scruting the inscrutable for over 50 years.
There is proof there are back doors in VPN routers / switches / firewalls, so expose, only then when business feel the pressure, will the US government see the error of their ways (when leaned on by big business), until then it is just something needed for fighting a bunch of guys in caves on the other side of the planet.
I think a necessary step is to make sure that there is a general understanding that this is a problem -- here we must not merely preach to the choir but reach a wider and maybe technically illiterate audience) Who are we dealing with
1. People who willingly forgo their right to privacy (and therefore understand the issue at hand)
2. People who are ignorant their privacy rights are not respected (and therefore do not understand the issue at hand)
3. People who are aware that their privacy rights are not respected but wish to interact with 1) and 2) and therefore give up some or all of their privacy rights (and therefore understand the issue at hand)
4. People who will protect their privacy rights at the cost of limiting their ability to interact with at least those in 1) and 2) (and therefore understand the issue at hand)
We cannot save those in category 1), they know the risks and accept the "terms and conditions" of using the internet with public and private data mining/surveillance in place. These people are lost to the Dark Side.
People in category 2) need education on what the consequences of their actions are, and may then resolve into one of the other groups.
People in category 3) should accept that their permissiveness strengthens the hand of the NSA et al. If a practical alternative solution is presented they will probably help to bring people in category 2 away from the Dark Side.
People in category 4) are probably a small population already using Tor, Freenet, PGP, etc. They can help by adopting new technologies that do not compromise (too much) their desire for privacy.
Please remain calm, there is no reason to pani... wait, where are you all going?
I would say more peer networks would work well, unfortunately in alot of cases it would take alot of resources on the host computers but it may be the price to pay to keep your data yours. Look at BitTorrent, Bitcoin or most other P2P systems... government has a very hard time stopping their use.
Just wait until the character assassination begins for Schneier too. He's been taking very strong positions, I'm waiting for a photoshopped picture of him fucking a sheep to be released on the Internet for the whole world to see. Pretty soon, he'll be living in a South American country's embassy.
Now why isn't this a story on /. almost a day after its publicatoin:
http://www.theguardian.com/world/2013/sep/05/nsa-gchq-encryption-codes-security
In brief, almost nothing is safe anymore, even if it's encrypted.
With the likes of Julian Assange, "character assassination" is hardly necessary. The guy is a walking PR disaster area.
Also join your local community wireless network, real networking directly with other people. CB Radio for computers.
I couldn't care less if Assange or Snowden are nice guys. That's completely irrelevant for the matter if they're sweet little cherubs or like to fuck sheep on their spare time. Nobody does what they did by being that nice guy everybody wants to have a beer with.
The hateful crimes they exposed are the true stars, here. If you focus on the messenger, you miss the message. That's what the governments, corporations and their global propaganda machine (a.k.a. mass media) badly, badly, badly want you to do. Quite successfully.
The worst part of the damage done by this isn't technical. It's human.
The reporting on this latest disclosure reveals that the NSA has systematically inserted itself into the standard-crafting process, in order to deliberately weaken those standards. It also reveals that the NSA has bypassed the management of communications providers and recruited technical staff directly. In both cases it's reasonable to assume that the people involved have been through a security clearance process and are thus barred for life from disclosing what they know.
I must now ask myself how many people I've worked with weren't doing so in good faith. When they argued that such-and-such a fine point of a network protocol standard didn't need improvement or that it should be changed in a certain way, were they doing so because it was their principled engineering opinion, or because it served some other purpose? Or when they were recommending that one of the many operations I've run move its colocation point or change its router hardware, was that good customer service, or was it to facilitate easier traffic capture?
Will anyone be asking themselves the same questions about me? (They probably should.)
The Internet was built on, and runs on, trust. Every postmaster, every network engineer, every webmaster, every system admin, every hostmaster, everyone crafting standards, everyone writing code, trusts that everyone else -- no matter how vehemently they disagree on a technical point -- is acting in good faith. The NSA, in its enormous arrogance, has single-handedly destroyed much of that trust overnight.
And you're just a chronic masturbating troll. Your point?
It is look like war ! I would say that doing your own encryption, by this I mean using some of the open source tools and not closed source ones (and definitely not American ones) is a good thing. Hamlet Devnozashvili Las Vegas 11 Ave Email - hutt1-petviashvili1@hotmail.com Website - Stick War
I'm not sure it's that easy to distinguish the message and the messenger.
These people have a radical and fairly crude ant-secrecy agenda, and the stuff they bring to light may be done in a highly selective and self-serving manner. And regardless of whether you think governments should be allowed to keep secrets or spy on people, I dispute that these vigilantes should decide what should be "declassified" or what isn't. It's only slightly better when the leaks are channelled through the media, given that journalism is a "soft option", and that journalists are only slight better qualified than the leakers themselves to decide what's safe to leak or not.
As for secrecy and spying, that debate needs to happen, and it's happening. That's a happy byproduct of what is going on. I just strongly object to the methods being used by the anti-secrecy crowd, and I don't trust their motivations at all.
Although in a very new stage it aims to bring encryption on IP-Level without the need of client-side configuration:
https://github.com/kechel/ip-autosec
The first thing that we need is a good audit of programs, protcols, algorithms. That won't be easy. Open Source stuff has a head's start, but someone needs to read it all. We knew that Skype was broken, but what else: SSL ?
As for encryption algorithms, there are only a handful of people in the world who are really qualified to check them; what if their opinions can be bought/blackmailed ... ?
This will take a lot of effort, but what good is GPG if the encryption algorithms that it uses have been weakened ?
You make a really excellent point. Sadly, we can only react at this point. It seems to me that there are three useful reactions:
- Keep up the political and media pressure. Don't let this issue die in the news cycle. Americans can apply internal pressure; those of us elsewhere can do our bits to keep up international pressure. For example: I will be integrating the NSA as part of a larger Internet security discussion in at least two of my university lectures in the coming semester.
- Promote open-source software for all security purposes. While not everyone can audit the software, there are enough people out there who can and will. The NSA cannot predict who will do so, and hence cannot have them all in its pay.
- Refuse to use any American IT services where security is important. This is not only sensible, it also applies economic pressure to companies that can lobby in Washington.
Enjoy life! This is not a dress rehearsal.
It takes very little memory / diskspace to store every single thing you ever type with your keyboard. Sending this data will provide access no matter how fancy encryption mechanisms and programs you use.
So if you are using an operating system that has been made in the US I would not count on it having no built-in keylogger to simply bypass every single encryption mechanism out there.
Superficial utopianism, ahoy!
"The government" broke it, and "we" have to fix it, eh?
Remember, WE are the ones that elected this government, and all the previous ones. (And don't give me the crap about "all they give us is fake choices - this system is an evolution of what we've asked for...)
Remember, WE are the ones who vote in such elections at a what, sub-50% rate?
Remember, WE are the ones who, through our commercial choices have made Hollywood and television the engine of derivative, repetitive, simplistic, stupid entertainments.
I don't know about you, but just about everything "we" do is pretty fucked up. The odds that something positive is accomplished by a herd of humans is approximately 1/(2^(# of people involved)).
Personally, I'm finding Mr Schneier less practically relevant and more of an attention-whore every year.
-Styopa
This article needs to be pinned to the front-page of Slashdot for the next year.
Defense Security Administration - not a peep so far about them. And you think they've been sitting on their asses this whole time?
There are software developers that can be considered engineers.
They are rare however.
I am very small, utmostly microscopic.
Has it been cracked? This question is of utmost importance.
I suspect that is has.
I am very small, utmostly microscopic.
Is it just me, or does the one guy in the photo look like he's saluting another guy who is throwing out a Heil???
... is make it more difficult for the government to spy on us, right? How may more people have to start routinely encrypting email before it gets so computationally expensive that bulk searches are no longer worth the effort?
"We receive as friendly that which agrees with, we resist with dislike that which opposes us" - Faraday
Available at https://github.com/SilentCircle, but now we have the problem of validating the binaries are built from the code. This is subtle: see, for example, https://lwn.net/Articles/565113/
davecb@spamcop.net
All the open source crypto is for naught... if you can't trust your compiler.
Schneier and his disciples want to do this, fine. They *must* start with a complete audit of GCC and any other compilers they plan on basing their work on.
We need to make dirt-simple to encrypt messages and files, then start spreading the word to your personal support circle (you know, the people who rely on you to keep things running for them) that "everybody encrypts these days". If you see an unencrypted message or file, say, "ugh, don't touch that, that's like spam". We engineers have a lot of influence on the ground, where it is hardest for any government to interfere.
It will be an order of magnitude easier to overrun government's spying capabilities than it will be to thwart them.
"We receive as friendly that which agrees with, we resist with dislike that which opposes us" - Faraday
I dispute that these vigilantes should decide what should be "declassified" or what isn't.... I just strongly object to the methods being used by the anti-secrecy crowd, and I don't trust their motivations at all.
That is a fair enough opinion and nobody can argue with it, it is good to have a healthy dose of skepticism about any information that is presented to us via any channel. However what is more difficult to dispute is when a leaked document reveals heinous war crimes - should focusing on the messenger still be more important than a message of that significance? Also remember that Washington leaks information all the time (for example the Bin Laden operation) - why are leaks that expose crimes be worse than leaks that make the president look good? To most people that just reeks of hypocrisy.
The usual reply to this logic is "what war crimes, there were no war crimes exposed - but look over there - Assange is a narcicist and Manning is a traitor!!". However even a basic search and read of the documents they destroyed their lives to bring to us show that this claim is absolutely false:
Revelations from the Afghanistan and Iraq war logs detailed the use of paramilitary death squads, complicity in the torture of Iraqi citizens, the indiscriminate killing of civilians by private military contractors and many other abuses. Meanwhile, the leaked State Department cables brought to light scores of secret drone strikes in countries we are not even at war with, and uncovered the collusion between the U.S. and Yemini governments to lie about American responsibility for the massacre of 41 people in the Al-Majalah region. They also revealed U.S. interference with judicial efforts in Spain to investigate the Bush administration's torture practices. In Tunisia, leaks exposing the opulence and corruption of Ben Ali's government were a catalyst for the revolution that brought down the repressive regime and ignited other pro-democracy movements throughout the Arab world. The list could go on but the point is simple: it would have been a disservice to democracy to withhold this important information.
US gov has betrayed its people, its constitution, the Internet and most of the world. Thanks a lot Obama.
I would argue that trust is what got us into the current mess of pervasive vulnerability. There's been too much trust, for too long. It is easier to program in a world where you can ignore the risk that someone is going to inject SQL commands into a Web form, or believe that once you've stored data on a server inside your firewall, that data is safe. That world is gone and it's not coming back. We, the tech community, have left too many back doors unlocked and unguarded for too long, and now there is a whole economy of data crime. The fact that the NSA has made sure there is no such thing as real encryption is just a piece - a significant piece, I'll admit - of an industry-wide failure.
What I'm saying is that designing systems based on trust is naive, and looking back, was a bad idea to begin with. Trust is for suckers. It doesn't scale: the larger the system, the greater the chance for a malefactor to infiltrate it. What we need today, I believe, is to approach re-engineering the Internet with a healthy does of *mistrust*.
[Sir Garlon] is the marvellest knight that is now living, for he destroyeth many good knights, for he goeth invisible.
I couldn't care less if Assange or Snowden are nice guys. That's completely irrelevant for the matter if they're sweet little cherubs or like to fuck sheep on their spare time. Nobody does what they did by being that nice guy everybody wants to have a beer with.
The hateful crimes they exposed are the true stars, here. If you focus on the messenger, you miss the message. That's what the governments, corporations and their global propaganda machine (a.k.a. mass media) badly, badly, badly want you to do. Quite successfully.
Same as the porn industrie fighting for freedom of speech. If I remember correctly, I once read that you can measure the freedom of speech in a country by looking at the pornography made and consumed there. To be honest, this comparison seems to be losing value, in my eyes at least.
We can't take back the Internet, we have to completely replace it. Privately owned wireless cells are the only way. Multi-route protocols, forward error correction, default encryption, etc. We need a strong technical solution such that rogue cells all over the place intercepting packets will still not get enough data to do anything. By using randomly mutating multi-route (instead of just finding a route and sticking with it), encrypted packets and FEC, you can broadcast packets all over the place and only the intended recipient is able to reconstruct the payload. We'd need more bandwidth, the net would be stuffed full of chaff, but if literally every house in the country had a wifi cell on the roof there would be tons of routes. The protocol has to be adjusted so that the true source addresses aren't known by intermediaries, and only immediate destinations are revealed. Embracing openness means you should be able to broadcast your communications and still be secure. The recipient has to take an active role, going out and finding some of the packets. Private ownership is key. They can't strong-arm/rubber hose all of us.
Though it is well worthy of investigation, I don't see that it's a prerequisite.
If your source code has all been compiled with a malicious compiler, but otherwise represents the bulk of your work, it doesn't take much to recompile it with another compiler later on. The problem can be fixed retroactively, and only prior binaries suffer the problems.
Additionally, auditing GCC would take years (and is, and has, been done by quite a few people), and the "double-compiler" trick pretty much rules out rogue interpretations that weren't in the source sneaking their way into the binary.
So, although important, the problem is fixable, and we can plough on with everything else first, rather than wait for the results of some lengthy GCC audit.
To be honest, more useful would be to implement double-compilation checking into the build system and then build with EVERY compiler and spot any differences. I think you'll find quite a lot of distros already do that, just to be sure (more from clever malware than some state-sponsored effort). Rather than relying on one compiler, get ALL the compilers involved, rogue or not, and spot the ones that do something different to all the rest.
So, no, they must NOT start with that. They should do that alongside everything else. And shout the second they see something suspicious. Unless you are compiling from source yourself, you're already trusting the person who builds the binaries and those distributing them not to play with SHA1 hashes, etc. that they confirm to the source they say they do.
Finding out later down the road that GCC is compromised isn't such a big deal in the scope of such a project (but obviously very serious elsewhere) - just recompile with something else, mark all previous binaries as untrusted and off you go. And in the meantime, the double-compile trick will let you know if any one particular compiler is doing ANYTHING it shouldn't anyway.
Waiting 10+ years for an audit of GCC is not unrealistic, but completely impractical to be something that acts as a prerequisite to anything else.
A more robust version of rsync.net's "warrant canary" (http://www.rsync.net/resources/notices/canary.txt) might help, if it were to become more commonplace, people would start to assume any provider not providing one to already be under gag order.
IANAL, but the legal theory is that while a gag order can make it illegal to speak out, it can't force someone to make falsified or fraudulent statements - any entity that has not already received a secret order is free to testify to that fact, and simply stop making that assertion at such time that they are compromised.
If this were made more robust, for example, key employees being videotaped undergoing a polygraph regularly where they are asked questions about the integrity of their service, it might just work. (I realize a polygraph isn't secure. For this purpose, however, it doesn't matter, because it provides a means to deliberately fail a test while having deniability of your intent to do so.
I'm sure similar creative ideas could be used :)
Are the binaries stripped? If they ship with debugging symbols (and why shouldn't they?) I don't envy the job of the NSA guy who's supposed to sneak a back door into it.
I don't think this should be much of a concern. Corrupting stuff at that level, in an area with so much scrutiny, costs more than it's worth for NSA. It's hard, and detectable.
xkcd is not in the sudoers file. This incident will be reported.
... we'll have complete, anonymous free speech next, then how will our political masters survive?
They don't need to break the encryption when they literally own the wires. They already have back-doors in the certificate infrastructure, so they can do man-in-the-middle attacks and brute force your passwords (your password is your dog's name, right?)
We don't need to "fix" the internet, we need to replace it completely with something privately owned. Private WIFI cells in every house with something like randomly mutating multi-route UDP and shared-secret N-K FEC (you need to receive, say, 3 packets to be able to reconstruct the content. If you only have 2 packets you have nothing). We need to assume and expect that there will be many rogue stations intercepting all traffic and work around that.
The government thinks it "owns" radio-waves but it is wrong, that's like owning the light coming from the sun. They have outlawed encrypted radio since before the internet existed, because they fear it, they know they won't be able to stop it.
You cannot compile the Silent Circle product from that source code sample (and that is all it is, a sample). Silent Circle tells all journalists that the sample is all the source code (or they incorrectly get that opinion and write about the product as if it is fully open source) - which is not true and creates distrust.
You cannot fix this technologically, politically, or socially. This is not a "problem". Its a global coup-d'etat.
Once upon a time, we had a thing called Opportunistic Encryption, and it was bad, because the implementations were flawed. But it's been some years since then, where is my OE? It should be a mere apt-get away.
"You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
Does anyone know why he says "Prefer conventional discrete-log-based systems over elliptic-curve systems; the latter have constants that the NSA influences when they can". We've been looking at moving to elliptic curve because of the smaller keysize, but I'm concerned people will start to move away from it because of this.
The internet was originally setup by DARPA as a government network and then evolved out of that into what we have now. It could be considered that everybody else are squatters and the government is just taking it back from us.
Maybe we should be electing people who will actually respect our rights an the constitution. As soon as someone like that actually runs...
I'm trying to teach myself to set people on fire with my mind... Is it hot in here?
[quote]These people have a radical and fairly crude ant-secrecy agenda, and the stuff they bring to light may be done in a highly selective and self-serving manner. And regardless of whether you think governments should be allowed to keep secrets or spy on people, I dispute that these vigilantes should decide what should be "declassified" or what isn't. It's only slightly better when the leaks are channelled through the media, given that journalism is a "soft option", and that journalists are only slight better qualified than the leakers themselves to decide what's safe to leak or not. [/fullstop]
You're still missing the message to focus on messengers. Tyranny is what is the problem. Doesn't matter if it's Judy Gardland, Edward Snowden or Ariel Castro delivering the message. If the statements are true, focusing on the flaws/brokenness/evils of the messenger is ensures tyranny continues to succeed.
I'm pissed and I don't know what to do. The NSA is stealing both the ideals of what our democracy is based on, as well our increasingly modern era implementation of it. I don't think anything short of bloodshed in the streets has a chance of changing anything, and even then it likely won't. The Government in the name of security can lie, cheat, steal and kill and not be held accountable.
Who thought Sneakernet was dead ?
No back doors
No NSA spy shit looking for porn to worry about
No more FB to get upset about when befriended
No more bull-shit chats with the boss on Skype
Cut that network cable, life is better without it.
Sneakernet - maybe slow but an old friend indeed
People want to be spied on—look at how they vote. No engineering our way out of this problem.
Great. Start building your secure internet 2.0 on a compromised foundation. Have fun with that.
I am very small, utmostly microscopic.
I don't think you comprehend the size of the world. Have fun with your little 100 meter radius wireless islands.
The internet has always been open. There have been fools that think adding "security" to it will change this. It doesn't. Get real, people. There are only two rules to security on the internet: 1. Never put anything on the net that you can't afford to be viewed by the public. 2. Never put anything solely on the internet that you can afford to lose. Corollary: Never put anything in a cloud that you can't afford to be viewed by the public.
Don't stop where the ink does.
I think the totalitarian sickness Schneier describes goes well beyond the NSA. Computers and especially mobile devices are becoming creepy, for lack of a better word, even without government intervention. They are the prying eyes in your house Harriton High School Used Laptop Webcams To SPY On Students At Home, they are following your every move Government Location Tracking: Cell Phones, GPS Devices, and License Plate Readers, they are keeping tabs on what you like and don't like Mapping, and Sharing, the Consumer Genome (featured on slashdot yesterday, itself a thinly veiled phishing scam IMHO). Although subject to government abuse, none of the "services" highlighted in those links were instigated by the government. Just yesterday I was innocuously checking for prices for various professional training seminars on Google, and on cue my Email inbox started overflowing with unsolicited offers. On some days, I want to throw my smartphone in the trash and unplug my computer from the internet and only plug it back in when I need to access the SVN repository.
So Kudos to Bruce Schneier for addressing his call to the engineering community, but now it begs a question: aren't engineers, including those outside the NSA/DEA/FBI, somewhat responsible for creating this creepy user experience? I don't think they're suddenly going to wake up one day and fix it; a significant subset has embraced the creepiness and fundamentally doesn't understand why it might be a problem for others.
1) we need solid encryption, with decently secure keys, BY DEFAULT, on EVERY box, BEFORE it leaves the box. If it hits a network, it's encrypted first. Period. Even if you're running Windows. Even on your Grandmother's Windows computer. Email, IMs, and Web browsing, file sharing, voice, the works. If I choose to encrypt my transmitted data, I don't want to accrue suspicion because I stand out, because EVERYTHING is encrypted. If the government wants to know what I'm sending or receiving, they can ask for my encryption keys. Depending on the law, maybe they'll get them. But then a) I'll KNOW they're watching me, and b) watching me doesn't automatically let them watch my neighbors. Decrypting one computer at a time doesn't scale well.
This is really, really, hard, and won't happen overnight. But we've learned a lot since the Internet was young, I think it's workable from a technical standpoint. It's the social part that will be hardest, convincing companies that the additional expense is justified and convincing people that a little extra complexity (hopefully none at all -- except maybe when you set up your computer for the first time) is worth it.
2) we need REALLY secure interfaces. Part of this is accomplished by part 1) but not all. We need to work towards fewer viruses, fewer zero-day exploits, and we need them fixed faster and with less manual intervention. Why are botnets STILL possible? This is also really hard. But the government should want this, too. Every time we hear about how vulnerable our power grids, or automobiles, or pacemakers, or telecom might be to cyber warfare, we should be shouting about this. Instead the government wants to exploit the zero-days for themselves, because they are dependent on them for their own cyberwar offensives. Yes, Microsoft might own some of the heat for this, (but not all, by any stretch of the imagination) but by their omnipresence they are in the best position to make a serious dent in the problem, too. IF it was worthwhile for them to do so. I might be interested in Windows 9 or 10 if security -- REAL security, designed in from the ground up, not marketecture -- was the goal. But again, motivating software companies is a social problem, not a technical one.
I'm sure there are other things we need, but these are the ones that seem most important to me.
It's supposed to be completely automatic, but actually you have to press this button.
What compromised foundation? A compiler that you can suck out and replace in a second with any of the alternatives?
Your *CODE* doesn't corrupt when you compile with a rogue compiler (that's what source management is for), only the base binary built from it.
The point is not to assume that your compiler is safe, but to work in a way that - WITH A SAFE COMPILER - your code is fine. Other people will be working with different compilers and - AGAIN - by comparing outputs of different compilers you can work on the assumption that they are not ALL compromised and so anything you use to code is fine. The step of later finding that GCC is malicious is a matter of replacing compiler and recompiling, not corrupting every line of code you've written in the meantime.
But losing YEARS of effort because you can't write a single line of code until you've audited GCC is insanity.
One issue that darknets don't solve is operating system security. After all, the NSA has been contributing "security code" to Linux, and one would have to be very naive to think that they've been working to reduce their own snooping capability.
From Security-Enhanced_Linux,
Post-Snowden, all these contributions now need to be reviewed for backdoors and weaknesses. Giving NSA the benefit of the doubt is NOT appropriate.
I can understand the government wanting to go after these people if they are in league with the ants. However, I, for one, will welcome our new insect overlords when their plans come to fruition.
Modern copyright is theft of culture from everyone and it retards the progress of the useful arts and sciences.
Nobody does what they did by being that nice guy everybody wants to have a beer with.
That's why they need to be hunted down and killed like the dogs they are.
This article ensures it, it makes Aaron Swartz' manifesto look like a hippy drum circle in comparison. If he slips up the legal system will hit him with everything. Watch out Bruce.
"When information is power, privacy is freedom" - Jah-Wren Ryel
Don't forget your Sandy-bridge or newer intel CPU has a BUILT IN 3G connectivity.
They've pwned your CPU.
Supposedly to shut down stolen laptops remotely even if not internet connected, but I've never ONCE heard of this being used.
I'd rather believe it's a way to constantly update the CPU to do things like steal passwords right out of memory and allow them to scan your computer should they decide to send the right 3G pulse in your neighborhood.
They could even do things to detect if it's compiling and introduce a trusting trust compiler attack as well. As new tools/compilers come out, they update your chip over 3G to learn how to detect when those run and compromise them as well.
But didn't the whole "internet" thing start with a DARPA-funded project? Kind of makes it theirs from the get go I think.
Also, the demise of "internet freedom" is inevitable for many reasons. First, it takes a huge amount of effort to setup and maintain the internet - that costs someone a lot of money. The people spending the money to operate the internet own it.
Secondly, the dream of letting anyone communicate with anyone else is bound to fail. The reason is that people start to feel that they can engage in behavior on the internet without consequence - either due to a perceived anonymity or the simple lack of physical presence. As we have seen, this seems to bring out the worst sort of behavior in people which leads to abuses that then require oversight to control.
Thirdly, since it crosses international boundaries, it becomes an obvious attack vector both for political and criminal pursuits. Even the internet's short history has shown this. Once something becomes an attack vector (particularily when it crosses international boundaries), there will be government intervention.
This is *not* an engineering problem. No amount of engineering is going to impact the fundamental socio-economic-political issues that naturally lead us to where we are now. Until we find some way to change the basic nature of mankind (which has not changed for as long as there have been people) there is no way that an internet-like construct can be anything different than what it is becoming.
Julian Assange... is a walking PR disaster area.
Did you read that in the news?
There is no reason that secure can't also be user friendly, the illusion that secure must also be difficult is part of the problem.
People don't send just send lolcats through my email they get order confirmations when they purchase something and other sensitive data. A low pay NSA Analyst could become and identity thief just as easily as any other low pay employee that can gain access to your information. So keep it secured.
If I were a guest in your house, well you wouldn't be charging me, so I'm not a guest and as a paid service I have expectations.
What stupid terrorist is using the Internet to coordinate these days?
I mean the NSA and most governments are trying to monitor all internet traffic, and this is widely known, so I mean are their ANY terrorists out their dumb enough to be using the internet still to coordinate their attacks?
This ain't exactly a secret. I guess people are trying to use clever ways of encoding their transmissions through the Internet, but since the Internet is fundamentally corrupted then its no longer a viable resource for communication IMHO.
So all the NSA is doing is wasting billions of dollars monitoring the benign traffic of innocents using FUD to continue to fund program.
I haven't thought of anything clever to put here, but then again most of you haven't either.
Yet, Chinese people seem to get the best use out of it, hacking it and taking it over with their hardware.
Normally, I don't bother feeding the partisan trolls, but it's a funny day, so might as well break with tradition for a bit.
You do realize that the reason that Chinese hardware gets to "take over" the internet is because they manufacture it cheaper? Good, old-fashioned, conservative-friendly capitalism.
Yes: they need to publish more, and provide ways for end-users or their nerds to validate the work. In a previous life I ran stuff through a disassembler/decompiler and read the diffs. I think that's likely too hard for a program this big (;-))
davecb@spamcop.net
I'll add a bit more to what people have written above with another reason why these things have to be open.
Let's see an example of closed source encryption - Adobe Acrobat from a few years ago. Their code was the same one used by Julius Caesar, a very simple letter substitution code which could be cracked with a cardboard code wheel that used to be printed on the back of corn flakes packets to entertain children. Commercial "security" software needs to be open to prevent such laziness being used to defraud people that think they have paid for something that will stop third parties being able to read their PDF files or whatever.
Any readers that think I am making that ridiculous situation up should google Dmitry Sklyarov. The only thing more ridiculous than Adobe's code was that they hit Sklyarov with a DMCA notice for it which somehow resulted in him being imprisoned for months - a DMCA notice for something Julius Caesar wrote about so should be in the public domain by now! No penalty for a false DMCA notice was levied on Adobe (or anyone else - it's one sided with no consequence for crying wolf).
...then they track our internet purchases. Can't they just stick with our landlines and our 1040 EZ's like they used to?
WARNING: Smartphones have side effects--most of them undocumented.
NSA as Batman, wanting to use the cellphone technology to locate the Joker. Lucius Fox as the engineers who created the internet.
Bruce Schneier will no doubt be played by Morgan Freeman in the inevitable movie version of this whole saga.
"Ahh! I see you're in that indeterminate Schrodinger state where - oh, uh
Do you trust your exit node or proxy? Defcon had a recent talk on setting up proxy servers as a very quick way to find people who have something to hide. Now you have their IP address and their destination. Tor works only as long as exit nodes are not in the bad guy's control.
The phrase Tor works only as long as exit nodes are not in the bad guy's hands applies to NSA searcing for bad guys, and good guys hiding from the NSA.
Who has your exit node.
It is worth looking up and watching the following on Youtube.
DEF CON 20: Owning Bad Guys And Mafia With Javascript Botnets
The truth shall set you free!
Something I have been meaning to do for months now, I will do this weekend.
1. I am adding an email sig with a link to the Schneier article saying Take Back the Internet.
2. In said email sig, I am going to provide a link to my public key (which heretofore only 3 people in the world actually had),
3. Under said link to public key, and a link to a HOWTO for PGP for noobs.
I haven't looked for the noobs howto yet, any suggestions?
The internet is just a thing; the US government has betrayed the American people.
The hateful crimes they exposed are the true stars, here. If you focus on the messenger, you miss the message. That's what the governments, corporations and their global propaganda machine (a.k.a. mass media) badly, badly, badly want you to do. Quite successfully.
Same as the porn industrie fighting for freedom of speech. If I remember correctly, I once read that you can measure the freedom of speech in a country by looking at the pornography made and consumed there. To be honest, this comparison seems to be losing value, in my eyes at least.
So, are you disgusted by the *volume* of USA porn, or by the *quality* of the porn?
https://app.box.com/WitthoftResume Code: https://github.com/cellocgw
You can only tell users a limited number of times that they don't really want what they say they want before they turn to someone else to get what they think they want. I've explained over and over again why Facebook is not a good idea, why Gmail is not a good idea. Do people abstain? We all know that they would never give up the shiny. It's like smoking: They know it's bad for them, but they're hooked. Is it really the engineers fault for eventually giving in and doing what needs to be done to get paid?
Major western newspapers publish the stuff he reveled. Give him a legal immunity, so that he could return back home on his own will.
Uncle Sam is very angry with Russian Federation. It is getting out of control. I guess the RF did not realize how serious is all this. It seemed at the beginning that he was sort of an American Solzhenitzyn, but it turns out the the US government has lost a lot of money because of this event.
But it was not Eurasia's fault. It is an American story.
Maybe the criminals' techniques can be used to foil the NSA types? You can buy their packages "on the side" supposedly.
Just a thought...
Presumably, the NSA is searching emails for keywords indicative of "people of interest". Would we devalue their snooping by inserting random false positives into every message that is sent? Imagine the killer app that makes all emails look like they came from.... killers. I could see this turning into a perpetual arms race with privacy advocates rebuilding a keyword generator to get more false positives to flow through the filters that the NSA woul have to keep revamping.
it, but common sense tells me there is not and can never be any such thing as secure internet/network communication. An individual with limited resources can't possibly compete with the comparably unlimited resources of any government.
If you want any hope of secure communications, you have to communicate in person. Yes, it is expensive. Encrypting stuff to send it "securely" over the internet is simply an attempt to reduce the cost of such communications by compromising on the security.
In My opinion is that most of the world has gone to hell in a handbag. There's more corruption then ever before. We are losing liberty's for temporary safety and security. We need to heed the words and warning of one of our founding Fathers "Those who would give up Essential Liberty to purchase a little Temporary Safety, deserve neither Liberty nor Safety." Or another variant "Any society that would give up a little liberty to gain a little security will deserve neither and lose both." We're all moving like a high speed train headed at a slow bend and doing nothing about it. All the time holding hope that our Democratic train stays on the tracks and In doing so we're heading straight at becoming a police state all while talking on a cell phone. if something isn't done then its going to be bad news for everyone. Unfortunately the longer it takes the worse it will be for everybody.
FYI, AT&T DSL does IPv6 via "6rd" : http://www.att.com/esupport/article.jsp?sid=KB414401 . OpenWRT supports it (via the "6rd" package).
Take it back? The U.S. Government developed the Internet, and it was paid for by U.S. taxpayers. Schneier may be a computer security expert, but he is no historian.
http://xkcd.com/538/
#OBLIGATORYXKCD
and saw a translation of Cory Doctorow's Little Brother, which I read in the original some time ago. And I thought, reality is actually worse. I could tell from the tone that the author was angry when he wrote that book - how does he feel now?
The U.S. Government is the GUI 'Home Page' of the Internet's abusers. The U.S. NSA is a set of pages. There are more, and worse, abusers behind and in with the NSA, using the NSA for a stalking horse. If you could "Fix" the NSA and stop its abuses, you would do no more than close an 'echo' window, a window you can see in through. Abuse would go on, you would sinply havve to get into the code to see.
The Internet is gone. It had potential, but the potential is not worth the price. So the Internet is going to be abandoned.
Unfortunately, as long as the Feds have unhindered authority to force companies to do what they command, there will be no real way to stop their snooping. Think about an extreme example: the NSA gets a "court order" to force Symantec to open up a back door to allow them to put keylogger trojans on any machine they choose. At that point, no matter how secure a tunnel is through the internet, the NSA will always be able to gain access. So, you say: "Well Franken, your full of it! I have a SecureID fob, so my last password is irrelevant!" Then the NSA goes after the fob manufacturer to build in a mirrored fob to your own. They can literally do anything NOT LIMITED TO the crowbar approach to password extraction. We should all be very afraid. This is way beyond overreach at this point.
Maybe we need to bring back a modernized, encrypted UUCP?
There is no reason that secure can't also be user friendly, the illusion that secure must also be difficult is part of the problem.
People don't send just send lolcats through my email they get order confirmations when they purchase something and other sensitive data. A low pay NSA Analyst could become and identity thief just as easily as any other low pay employee that can gain access to your information. So keep it secured.
If I were a guest in your house, well you wouldn't be charging me, so I'm not a guest and as a paid service I have expectations.
I appreciate and admire your intentions here, but the sad fact is: you cannot reason with this kind of narrow-mindedness.
Although, I would be glad to be proven wrong on this one.
It is a miracle that curiosity survives formal education. - Einstein
I don't have time for leakers, traitors and narcissistic wreckers like Snowdon and Assange. And it has been easy for me to dismiss their statements, and those of their camp followers out of hand.
For me, having somebody as credible as Bruce Schneier take such a stand, changes everything. He's not just some criminally insane lunatic like Julian Assange, or some spotty kid out to make a name for himself -- he's an erudite, wise man with a proven track record of good judgement. If credentials matter -- then I think that having Schneier weigh in on this side of the political debate will have a major impact on people who are formerly undecided about the issue, including myself.
Really? Because I make these decisions based on the facts of the matter, not the popularity of those involved. I suppose during the early 1500s you'd have sided with Tolosani against Copernicus because the latter was not considered credible (and by some, heretical - our version of a "crackpot") during his time.
I scrutinize the message, not the messenger. I doubt you appreciate just how easy it is to demagogue and character-assassinate, not to mention that both of those are carried out with emotional arguments/manipulation and other propaganda techniques. Reason is much more difficult to twist; facts are even more difficult still.
I'm not trying to be rude, but the mentality you demonstrate (which was instilled in you) is the major reason why society has as many faults as it does today.
It is a miracle that curiosity survives formal education. - Einstein
Simply add that statement to your website. Dare them to force you to keep that statement up after they serve you. We need a good privacy seal that you promise to take down your devices if you are serviced.
It's not just about exit nodes anymore. The NSA can, and regularly does, de-anonymize users within the Tor network, with or without compromised or 'baddie-controlled' exit nodes.
Correction: Tor only works (in its current implementation) when there isn't a single bad node in the entire network. IOW, not going to happen.
Let's also keep in mind that 60+% of the funding for Tor, comes directly from the Department of Defense (DoD).
Concerned yet? You should be.
The hateful crimes they exposed are the true stars, here. If you focus on the messenger, you miss the message. That's what the governments, corporations and their global propaganda machine (a.k.a. mass media) badly, badly, badly want you to do. Quite successfully.
Same as the porn industrie fighting for freedom of speech. If I remember correctly, I once read that you can measure the freedom of speech in a country by looking at the pornography made and consumed there. To be honest, this comparison seems to be losing value, in my eyes at least.
So, are you disgusted by the *volume* of USA porn, or by the *quality* of the porn?
I'm not disgusted. For me, quality and fun have an inverse relationship in porn, and the fun (but not funny) porn is not easily found in a porn-world that is dominated by money.
The US Government has betrayed the whole humanity.
about "helter skelter"
The fear of a Balkenized Internet has greatly increased by the revelations about how much spying is done by security agencies on it. If the fear was about a Great Firewall of ..., it should be now about whole nations snipping fibre at their borders, and thanks to the duplicity of the U.S. and others about free speech and freedom.
And it should be addressed locally by meshes using encrypted low-power radio to send packets between local store and forward nodes. We may yet see the reappearence of something like UUCP.
The reason the spying has happened is that it is easy to snoop on the main pipe. That can be made a whole lot harder by distributing the traffic and making the network typology go ad hoc and dynamic.
If everyone created bogus messages with keywords such as would be written by someone doing espionage, terrorism, etc. etc. And by flooding, I mean a few million emails per day, from random or even non existent IP addresses, we would soon see that the NSA with limited manpower and even with supercomputers to break encrypted messages would run out of resources. They want to snoop, give them all that they want en masse.
That is very true. There are so few people operating trains to start with and only a tiny percentage of those people are also software developers.
NSA is working evil but its Apple, Amazon, Google and Microsoft that have captured the use of the WWW by compelling the use of the software app store gulags denying us the rights to write software that can be deployed to what may be presumed to be our own devices as private property given that the device is in fact paid for in full and not under contract by some other 3rd party which is in collusion with the technocrat CELO(ligarchy) that Apple, Amazon, Google and Microsoft are now operating as the censors of the WWW. Back in the day it was books that were banned and now its software.
The real problem is the fact that, at least as far as intelligence or exercising genuine self-responsibility is concerned, 95%+ of human beings are literally not worth the oxygen they breathe.
Almost every single brainless, technophobic fucking moron out there uses Facebook, and various other forms of centralised social networking. Even Eric Raymond, not long ago, started advocating Google+, and dared to actually become *indignant* about people warning him of what a corporate abomination it was.
Stop using Facebook. Start re-using public key encrypted Usenet, and p2p DCC chat nets with IRC as an entry point, which is what used to be done in the old days.
The feds literally were not able to touch that, which is the entire reason why all three IRC nets were DDoSed in January 2001. It wasn't a technology which they could easily control or monitor, so they simply wanted to destroy it. Then we got Twitter. Do you really consider that a fucking coincidence?
You might have noticed the degree of rage in this post. I've been getting banned more recently from virtually every forum other than 4chan, and there is a reason for that.
I. CANNOT. STAND. the continual, brainless fucking stupidity and myopia of the rest of my species, at this point. I can't stand the fact that you are all craven, gutless, stupid Good Germans, who don't want anything other than a giant nanny state to change your nappies and microwave your bottle.
This situation is NOT because of Google. It is not because of the NSA. It is not because of Verizon. It is because of YOU. If you are someone who uses ANY form of social media, YOU are to blame. YOU are part of the problem. No one else. YOU.
The Off-the-Record (by cypherpunks) plug-in uses DH-1536 and they plan to switch to ECC and use NIST curves..not good. Should use their own curves. And meanwhile update from DH-1536 to at least DH-2048...