Slashdot Mirror
Time For X-No-Wiretap HTTP Header?
Freshly Exhumed writes "A security blogger, acknowledging that the NSA methodically ranks communications on the basis of their 'foreignness' factor to determine candidacy for prolonged retention proposes, is proposing '...an opportunity for us on the civilian front to aid the NSA by voluntarily indicating citizenship on all our networked communications. Here, we define the syntax and semantics of X-No-Wiretap, a HTTP header-based mechanism for indicating and proving citizenship to well-intentioned man-in-the-middle parties. It is inspired by the enormously successful RFC 3514 IPv4 Security Flag and HTTP DNT header.'"
The only way we are going to solve this NSA mess is to clean house...and the senate...
Someone can't set their date properly? :P
Yes, of course!
This is guaranteed to work almost as good as the Evil Bit, an extra field in IPv4 headers where senders of packets indicate malicious intent, so that people administering firewalls can discard such packets if desired.
(The problem in the first place was that the people wiretapping didn't give a shit about rules, etiquette, and being decent. More rules and etiquette aren't the solution to that problem.)
Rick
It'll certainly flag the packets to NSA as deserving of extra long retention!
You secure it by force.
Will be a header code that says "do wiretap me, I have something interesting to hide!"
No seriously... WTF?
How could this be anything other than a flamebait article Tim?
XML is a known as a key material required to create SMD: Software of Mass Destruction
It is always so irritating to see that this discussion turns into "I am USA citizen, do not spy on me, dear NSA!" What about rest of the world?? How come that in your US centric viewpoint it's all ok to spy on anyone else, just not on US citizens?? What about Europe? Other NATO allies? All ok to spy on everyone else, on your viewpoint!! Love that fat bellybutton of yours!
the ones that need spying on come from foreign sources? Seriously.
Few American commentators seem to be questioning the unstated assumption that spying on non-Americans is perfectly OK, even if there is no reasonable cause for suspicion. By that logic, it's perfectly OK for other countries to spy on all Americans.
Aren't we all entitled to a little privacy?
We are expecting people who bend the rules to play nice.. Slick.. real slick..
They are already deliberately violating the law, with impunity. They compromise your security at every step. Adding un-encrypted metadata to your traffic will only:
1 - ID you for possible actions by later custodians of this information
2 - Acknowledge your silent submission to the fact of universal collection as a normative state
3 - Divert efforts from real crypto-countermeasures
People need not to give NSA their complicity and assent, but to resist, and applaud every time somebody manages to FUCK UP their mission.
"Flyin' in just a sweet place,
Never been known to fail..."
When confronted with a government entity that believes itself to be above the law and is routinely breaking the law, yeah, asking them not to hold on to your data. That will work. Right?
Seven puppies were harmed during the making of this post.
Because no one would lie and terrorists are always foreign?
If we're going to solve this problem, let's state it clearly.
Small groups of people, with a limit now tending towards one, are acquiring the ability to inflict damage, now tending towards death, on larger and larger numbers of people, now tending towards everyone.
How can we stop them before they do that ? How do we need to arrange or change the things ion the world so that that never happens?
All of this Snvowden, NSA, War on Terror, WMD al Queda stuff flows directly from that basic fact.
We're never going to be in agreement on what to do until we're all on the same page as to what the problem really is. That's the problem.
Really, I don't see a solution outside of genetically engineering people so they don't want to do that. Religion doesn't work (fundamentalism of all kinds , Islamic and Christian) . Providing people with stuff and money doesn't work (bin Laden), education doesn't work (Pol Pot) democratic institutions don't work (Timothy McVeigh) . Maybe those things reduce the probability, the sheer availability of accomplices to a Pol Pot or a bin Laden. At best that buys us time.
I am not saying genetic engineering is what we should do. I can't even say that it will work, but that and making the creation of an equitable and fair world a top priority (as opposed to our current one- making small numbers of people very rich) are our best bet as far as we know.
Using an X-no-wiretap header is like putting your emergency flashers on when illegally parking. http://www.youtube.com/watch?v=CIcHXgY0KKo
Don't stop where the ink does.
"Duhhhh, umm, OK."
Somebody check-mark the "Crazed Bomber" box just to see what they do.
Table-ized A.I.
The number of commenters failing to understand that the article is satire is staggering. Hell, look at the "department" the article is from.
If you're concerned about privacy and NSA can see your HTTP headers, then you're holding it wrong.
My God, it's Full of Source!
OUTSIDE_IP=$(dig +short my.ip @outsideip.net)
If you're not tracked by the NSA, you're tracked by some other nation's spy agency.
Headers are only voluntary.
So what, precisely, does this "new header" gain anyone except a circle-jerk of self-congralatory "we did something"?
I do not fail; I succeed at finding out what does not work.
Remind me again where in the fourth amendment it says we only have protection against unreasonable search and seizures for information not crossing international borders?
And what on earth makes you think they'd honor these flags regardless? They've already proven they don't give a shit what the laws are, they're just going to keep doing whatever they want. Notice after a bunch of noise early on, the media and congress quickly moved on to Syria without so much as even publicly addressing the issue beyond saying "we expect them to follow the rules" - and by that they mean we expect they'll keep right on doing what they're doing.
It's difficult to understand your rant.
... LOL!
So, you hate socialists. Fine. That's your opinion.
But then you go on about Obama and "leftist cabal" and "the socialist lot are pissing on the Constitution".
To me, this means that you are talking about USA politics and name-calling the USA Democrat party as "socialist".
That doesn't make sense in the normal way the word "socialist" is used. The USA Democrat party is very right-wing. The USA Republican party is "bat-shit crazy" extreme right-wing. We outside the USA almost never hear about the left-wing or socialist parties and politics of the USA.
I have heard that you have a Green Party, used to be chaired by the famous Ralph "Seat Belt" Nader, now run by a lady named Cynthia McKinney. She's probably left-wing.
But if you want to see real socialist parties in action (4.5 % of the parliament), read here:
http://www.guengl.eu/group/delegations (I was going to send a link to SYRIZA.gr but my Greek is so poor I couldn't even find an english language link)
Oh yeah, and "Slashdot the echo chamber of socialism"
To be, or not to be: isn't that quite logical, Slashdot Beta?
When I saw that this proposal "deprecates all the SSL/TLS ciphers in favor of Double CAESAR’13" (a.k.a. ROT-13) I knew it was going to be great. BTW, a big shoutout to my friends over in the Caesarian section! Okay, so I needed to run some sandboxed tests first. After using Double ROT-13 everything was going perfectly, according to the spec, but I decided to gamble on TRIPLE ROT-13. Big mistake. Don't do it! All I ended up with was a bunch of gobbledegook that I couldn't work with anymore, so I had to just delete everything and start all over again. Don't use TRIPLE ROT-13!!!!!!!1
I wish I could have been FP to warn everyone. I'm glad this proposal sticks with Double!
I deny that I have not avoided attaining the opposite of that which I do not want.
Which is right up there with "think of the children!" as a strong symptom of frontal lobe disengagement.
Those people who think they know everything are a great annoyance to those of us who do. (Isaac Asimov)
Oah yes, I am completely American, absolutely, you betcha! Mom and apple pie, verry good. Uncle Sam, hooray! I will be doing this for you every time, so you will be verry satisfied with this service.
Yup, but if you only skim the article, it's a blatant application of Poe's law.
Therefore, by the (faulty) logic you're using, you're just a cow with a keyboard - osu-neko (2604)
Liberties going down the drain, secret laws, secret courts, secret prisons, killing people without any trial, but at least we still have stupid nerd jokes in the form of funny HTTP headers.
Haha, I'm so not laughing.
Of course it runs NetBSD. BTC: 1NT7QvbetmANwaMzhpVL6
Header is read by smart switch/routers and they ensure that the associated packets do not get routed to any US-addressed (or US-puppet-addressed) host or router.
To do this one properly, an AVOID_US bit in the IPV6 packets should be used instead.
Where are we going and why are we in a handbasket?
Hint: no-one wants to be wiretapped.
At the risk of continuing your flamebait session, I think we can summarize your post by quoting the first two words of its last line:
"I hate"
Where are we going and why are we in a handbasket?
It's easier to insert an X-Copyright-2013 header; if the NSA decides to infringe on any of our literary works, it'll be $150,000 a pop. Not that they can't afford it...
When the copyright term is "forever minus a day", live every day like it's the last.
I presume this is a joke.
Well, then, I suggest we invoke the other Poe's law: Nevermore!
http://www.rootstrikers.org/
We should also ad an X-do not oppress field to everyone on Earth's birth certificate or equivalent? That way if they don't want to be oppressed, they can just say so, and surely oppressive governments will abide by the rational, peaceful and nicely expressed desire of their citizens to be, or not be oppressed. Right?
You are marking your traffic that you are an American Citizen and don't want to be monitored. What do you have to hide? That sounds like something a terrorist would say. Time to monitor every piece of traffic with this header, thanks for flagging when you have something to hide.
You and your friends don't have enough guns to outgun the NSA (who are typically not armed), much less the FBI, Pentagon, and Copyright police. If you want your data not to get wiretapped, you need to use crypto, end-to-end, and use various traffic analysis obfuscation services in the middle, and get enough people doing it to have some actual cover traffic (because being the one person using an anonymity service doesn't do the job.)
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
Look, you right-wing trolls like to talk about how liberals and progressives want big government, but we're dealing with Bush's Homeland Security Mafia here, and the right-wing Drug War, and the right-wing Big Military-Industrial-Complex which goes conquering other countries on behalf of Big Oil and Hating Foreigners. And you guys talk about "Intellectual Property" like it's as sacred a thing as owning real dirt property that we stole from the Indians, so the Copyright Police are as much your fault as they are the liberals' fault. And if Obama were actually a liberal, we'd have some Hopey Changey Stuff and the warrantless wiretappers and Gitmo torturers would be in jail, instead of him telling his Justice Department to defend the Bush Administration policies.
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
Yeah, that'll work.
Protecting your messages with crypto is a start, and using traffic mixers like Tor and Mixmaster to resist traffic analysis, but it's a hard job when the Bad Guys have Moore's Law on their side and unlimited unaccountable budgets and politicians who want to keep it that way.
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
Is there such a thing (this is a rhetorical question) as a "well intentioned man in the middle party?
Just added this to my client's AJAX function for fun :)
How do we know they're violating the law? We have no dea what the secret security courts may have given them permission to do.
If I were running NSA the first people I'd look at would be the ones including the header.
Secret security courts are themselves, illegal.
Fact on the ground? Yes. But? You cannot vote simple laws to violate Constitutional violation. That requires the Amendment process. Yes. This extends to Congress delegating their powers of coinage and exercise of war. Not legally possible without Amendment.
"Flyin' in just a sweet place,
Never been known to fail..."