Slashdot Mirror
Google Wants To Help You Tiptoe Around the NSA & the Great Firewall of China
Kyle Jacoby writes "The NSA was right when it postulated that the mere knowledge of the existence of their program could weaken its ability to function. Virtual Private Networks (VPNs), which serve to mask the source and destination of data by routing it through a third-party server, have been a popular method for maintaining internet anonymity for the paranoid and prudent. However, the all-but-silent fall of secure email server Lavabit, and VPN provider CryptoSeal, have shown us just how pervasive the government's eye on our communications is. These companies chose to fold rather than to divulge customer data entrusted to them, which raises the million-dollar question: how many have chosen to remain open and silently hand over the keys to your data? Google has decided to put the private back in VPN by supporting uProxy, a project developed at the University of Washington with help from Brave New Software. Still using a VPN schema, their aim is to keep the VPN amongst friends (literally). Of course, you'll need a friend who is willing to let you route your net through their tubes. Their simple integration into Firefox and Chrome will lower the barrier, creating a decentralized VPN architecture that would make sweeping pen register orders more difficult, and would also make blocking VPNs a rather difficult task for countries like China, who block citizens' access to numerous websites. On a related note, when will the public finally demand that communications which pass encrypted through a third party still retain an reasonable expectation of privacy (rendering them pen register order-resistant)?"
That actually would be pretty neat - force or opt-in everyone who uses the browser to be part of it.
The downside is the aggravation of being collateral damage in some investigation.
"... the mere knowledge of the existence of their program could weaken its ability to function."
Yeah, security by obscurity has the tendency to bite you in the ass.
We could have told you that years ago.
How is this easier to set up than Tor or more secure?
If anyone is going to collect data it is going to be us! After all we are the only ones who can properly monetize it.
"She's a scientist and a lesbian. She's not going to let it slide." Orphan Black
Google has decided to put the private back in VPN by supporting uProxy,
Even if they don't plan to install a backdoor, it is hard to believe in Google's interest in our privacy.
Who supported privacy measures before Snowden's revelations?
to allow ppl to avoid Google's eavesdropping....
uProxy has been compromised and should not be trusted.
I don't get what's so nice about it, the NSA already knows who I am friends with. So no matter how we route traffic in our min-TOR, all exits identify us. The whole point of VPNs, TOR etc. is to hide within massive noise.
No, if Google actually wanted that, they'd make their search engine work with Tor instead of saying "I'm sorry, but we're recieving a high volume of suspicious requests from your computer..." with a picture of a robot giving you the middle finger next to it. What Google wants is for you to use their service, and if that means pandering to the "NSA is evil" crowd, they'll make trivial gestures about privacy to attract them.
But Google is in bed with the NSA, CIA, DHS, etc., as is all other large corporations because if you don't play ball with them, you don't get to play. At all. No PR is going to convince me otherwise, and you would be wise to do the same.
#fuckbeta #iamslashdot #dicemustdie
Is it possible for routers to see the difference between VPN traffic and normal traffic? If so, it's rather trivial for the chinese firewall to prevent VPN traffic.
Slashdot social media options: AIM, ICQ, Yahoo, Jabber and Mobile Text. Why no MySpace?
Secure VPNs.
Being independent might make things a bit harder for the NSA.
"Trust me," said the fox to the hen, "You can keep your eggs in my basket and I'll make sure the other foxes don't eat them."
An enigma, wrapped in a riddle, shrouded in bacon and cheese
There was just a story last week saying that Google Fiber does not allow incoming VPN on it. So you can use this swell google program only on non-google networks.
This resembles the project for circumventing parental controls, Psiphon
What brings this new thing to the table what the old and proven VPNs like openvpn or tinc don't? Is it only the hip google sponsorship? If so then it's a good slashvertisement and clickbait in one.
This is more BS from Google. They open their infrastructure up to the NSA and get caught (who are you going to believe? Google or Snowden?), and now they keep on dribbling pathetic treats to us.
Stop using Chrome. Stop using gmail. Move your data outside the u.s.
They will never be able to prove to me that they're NOT giving info the the NSA. And, as such, they will never be able to earn my trust.
The cow says "Moo." The dog says "Woof." The Timothy says "Thanks, valued customer. We appreciate your input."
Seems to me the limiting factor will be ISP datacaps.
The ISPs that tend to have them are the ones that also want to send content (e.g. U-Verse, Comcast, to name a few). Datacaps limit peer-to-peer networks.
A more sinister interpretation is that datacaps limit the amount of traffic that the NSA has to sift through. The ISPs that seem to have the greatest track record of caving to NSLs, etc. are also the ones with datacaps. Coincidence?
Thus, datacaps also apply when one's "friend" routes traffic through one's connection to support a distributed VPN scheme.
Like a good neighbor, fsck is there
"when will the public finally demand that communications which pass encrypted through a third party still retain an reasonable expectation of privacy (rendering them pen register order-resistant)?"
As soon as NSA spying prevents them from watching "Dancing With the Stars" and "Honey Boo Boo".
I want a new quote. One that won't spill. One that don't cost too much. Or come in a pill.
Funny how Google is trying to come up with ways around the Great Firewall of China when, contrary to their 'do no evil', awhile ago was tailoring their search engine for China to accomidate their government rather than defeat the Firewall. I'm sure you can find at least one /. article about this in the archives...
Laughter is the Spackle of the Soul.
Subject says it all.
Oh come on. They can never be trusted again. They rolled over for the NSA and was a part of PRISM.
Just use a VPN company not located in the U.S
Making it open source would be a good start building trust... we'll see. Seeing as the VPN is only between friends, data doesn't ever have to see a google server, so there's not a whole lot of trusting that NEEDS to happen.
"At a presentation in New York, the company unveiled uProxy, which it says will allow citizens under some regimes to bypass government censorship or surveillance software to surf the Web and use its properties like YouTube and Blogger. "
So is the U.S. considered a "regime" by Google?
We play the game with the bravery of being out of range
Legally, any company is required, by the unconstitutional law the NSA uses, to NOT disclose they are giving your information away.
Like Microsoft, Adobe, Apple, Google, and all your communications providers.
All of them.
Every. Single. One.
Did I mention the backdoors in the chips in your computer and your comm gear?
-- Tigger warning: This post may contain tiggers! --
I'd like to see Google make an effort to build GPG into their product and make it easy for people to use.
If anyone can do it, it's Google, but they won't. It's hard to deliver targeted advertising when you can't read your users' email.
I don't get what's so nice about it, the NSA already knows who I am friends with. So no matter how we route traffic in our min-TOR, all exits identify us. The whole point of VPNs, TOR etc. is to hide within massive noise.
I want no part of "Google freedom". Their self driving cars? If these are the norm, they'll know where you are - all the time - and be queriable for your violations of speed limits and other "indiscretions".
If you trust them for VPN? How are keys generated? Who is the root of trust? This is your real question.
This idiom reflects the ever closer union between the State Department and Silicon Valley, as personified by Mr. Schmidt, the executive chairman of Google, and Mr. Cohen, a former adviser to Condoleezza Rice and Hillary Clinton who is now director of Google Ideas.
-- Julian Assange, The Banality of 'Don't Be Evil"
I'm with Admiral Ackbar, on this one:
"IT'S A TRAP!"
"Flyin' in just a sweet place,
Never been known to fail..."
"Virtual Private Networks (VPNs), which serve to mask the source and destination of data by routing it through a third-party server"
This is a false and very dangerous line of thinking. A VPN and a proxy are two different things. And they don't necessarily do what you're saying they do.
Some employers who let you use firefox/chrome plugins at will might have a problem keeping their sheep in the pen with this one. Of course, they probably already do, but this would just make it easy for you to connect through your "friend" (ie home) and circumnavigate the firewall.
to implement VPN between friends
someone do it
http://retroshare.sf.net
youproxy.org looks like shit. is this story real?
Blame ==
The two founders.
The current CEO and board members
Everyone who is still working for them after being exposed as a privately-run surveillance company.
Not so much google, but related to not being anonymous on the net - Vint Cerf. (who removed crypto from ipv6 at the behest of the US government.)
Don't tell me these people didn't know the consequences of what they were doing, and it's all the fault of advertisers.
"The NSA was right when it postulated that the mere knowledge of the existence of their program could weaken its ability to function."
They make it sound like a bad thing.
Efficiency is good. Up to a point. That applies to a lot of things, not just intelligence gathering. Then you get into a situation where the costs of efficiency outweigh the benefits.
While there certainly are enough people in the USA who are such utter craven cowards that they'd prefer to live in a composite Fourth Reich/ Stasi 2.0/ USSA if the butcher promised the little piggies they'd be safe, there are also some of us who are willing to forgo such amenities and trust that the civilians who tackle the guy fiddling with his shoe, the folks inspecting the laser printers, and other diverse less organized ways that we take responsibility for our own lives. And realize that despite everything, an occasional pressure cooker will get through and we'll pay for our freedom with the lives and body parts of ourselves and our relatives. Because freedom isn't the same thing as safety.
Let's face it. The public in general is rertarded.
Panem et circenses -- bread and play in today's colloquial.
As long as they have that -- who gives a fuck about rights
and abstracta like 'society'.
Forget them. Look to your peers. You see like minded?
Organize! And Inform as much as you can. The retarted-
ness often is not inate. Name names of trespaassers like
Mister Keith up there in the US. Be persistent. Pay
tribute to Snowden, and remember to treasure your
whistlblower. They are an asset to your society, contrary
to what Obama (himself the murdering terorist incarnate)
says.
Good luck!
I want no part of "Google freedom". Their self driving cars? If these are the norm, they'll know where you are - all the time - and be queriable for your violations of speed limits...
but if they're self driving cars, wouldn't it be the software that is guilty of going over the speed limit?
Their self driving cars? If these are the norm, they'll know where you are - all the time - and be queriable for your violations of speed limits
Why would a self-driving car be speeding? If it were, why would you be liable?
When you can do whatever you want while riding in your self-driving car, you will stop caring about the difference between 65mph and 75mph. You'll be more likely to remain in your car at the destination for an extra minute finishing whatever task you are doing than you are likely to care about the seconds that speeding shaves off the average commute.
Making it open source would be a good start building trust... we'll see
Making it open source doesn't matter. Law always trumps technology.
The only solution is an open justice system. There's a good reason any member of the general public can stroll into any Judicial Branch court...from your local county court to the Supreme Court...and sit down and watch what is going on. That is the most important check on government authority.
The problem is the Executive Branch courts, which work in secret. Sealed court orders are tyranny.
"If you have something that you don’t want anyone to know, maybe you shouldn’t be doing it in the first place."
vi? Who's that?
I don't suppose anyone remembers this? http://www.politico.com/news/stories/1112/83818.html .
Why would a self-driving car be speeding?
The car's idea of the speed limit on the road no longer matches the recently introduced, lower limit. The car did not "see" a temporary reduced speed limit for road works, high wind or ice conditions. The limit is vague, like a 40 km/h school zone that only operates a between 7-9AM and 2-4 PM on school days (whatever they are) or the unsigned 50 km/h limit in "residential" streets. (Australian examples but I am sure you can find USian ones)
If it were, why would you be liable?
If the car has a mechanism for you to manually lower the speed and you did not then I am sure liability will be asserted. Minimises the attractiveness of a "self-driving" car if you constantly have to monitor it.
Patent litigation: A doctrine of Mutually Assured Destruction... in which everyone seems willing to push the button
I would only trust foreign services with no physical ties to the U.S, whether Google say they support them or not.
Signature intentionally left blank.
Google will fold quicker than anything once the NSA makes a request of them. They're not like Lavabit - they're not going to close up shop and put their entire business and employees out to pasture. It's also wrong to expect them to do so - I mean seriously, if the NSA demands something from a company, why would they say no? The Government isn't going to do anything but back up the NSA with their legal wranglings so Google either does what they ask, or suffer immense pain.
ANY company would have the same issue if the NSA came knocking, and it's not fair to single out Google (or Microsoft for that matter) for complying with the NSA. Lavabit was an anomaly.
Fuck that! We should demand that all of our communications remain private! Why limit our demands only to those communications that are encrypted and routed through a proxy? Why should we put up with any of this nonsense for an instant?
The fourth amendment states: "Every subject has a right to be secure from all unreasonable searches, and seizures of his person, his houses, his papers, and all his possessions." So our papers are electronic today, but it's plain to see that the spirit of this basic right translates directly to electronic papers.
The NSA's actions are egregious and ri-goddamn-diculous! The bastards should be made to stand at the pillory until they rot! What the fuck is wrong with everybody?
... they'd spend the money on lobbying instead.
When it is released to the public it will be released under the Apache2 license.
base usage, it means the same thing.
It just has some emotional baggage with it as it was always referred to the political/country opponent as a "bad thing".
Seems to me they could use a std protocol like PGP, secure xmit to their servers, and resend it from there with a source address of GoogleSecureEmail and a completely encrypted body.
Google would handle the encryption from my browser to their server, then decrypt and send.
One reason, of course, is that they want to see the contents of my email in order to target advertising. OK, I will pay them for such a service : if I move, I have the hassle of changing my email address, a significant consideration.
It will never be possible to "win" the privacy war until individuals are held responsible for violations of privacy. The Milgram Experiment shows that morality is engaged by a feeling of personal responsibility, and that morality is suppressed when personal responsibility is taken away. My (crackpot) theory is that unless we start holding lawmakers, government officials, lobbyists, politicians, and even technologists personally accountable for creating and participating in illegal programs, nothing about this fight will ever change. A software engineer who writes code for the NSA will feel pretty safe because they can always blame their participation on "orders", on "the government", or any number of other abstract ideas. Nobody at any level of government ever feels personally responsible, and as a result, will never make the proper, moral decision to stop spying. Call me crazy, but maybe it's time to establish a new set of laws?
Careful with that straw - it's tinder-dry.
Doesn't encryption by itself indicate that the user has an expectation of privacy? What with that being the purpose of encryption in the first place.
What do you do about googleapis.com, google.com, gstatic.com, etc? Many parts of the web are practically unusable without allowing them to load scripts from these. I wish it wasn't so, but it's gotten to the point where I'm allowing them. In theory those shouldn't be mining the shit out of you like google-analytics, but obviously you can't see what they do, and even if you did, it's not running in your machine so they could be showing you the source code for notepad for all that's worth.
Considering that in the United States at least Google can tell me when there is heavy interstate traffic on my route and route me around it I expect they can keep up with changes to speed limits, probably better than a human. For example if its 4:01 when I go through the school zone since Google will be using network time rather than the dashboard clock the self -driving car will absolutely know its okay to go 45 (mph) rather than25 (mph), and that at 3:59:16 its not.
In the U.S. I can easily see a court penalizing a jurisdiction that tries to generate excess revenue by playing fast and loose with speed limits. Legislatures are even likely to require local jurisdictions to notify manufacturers/application companies when speed limits are changed.