Slashdot Mirror
Google Wants To Help You Tiptoe Around the NSA & the Great Firewall of China
Kyle Jacoby writes "The NSA was right when it postulated that the mere knowledge of the existence of their program could weaken its ability to function. Virtual Private Networks (VPNs), which serve to mask the source and destination of data by routing it through a third-party server, have been a popular method for maintaining internet anonymity for the paranoid and prudent. However, the all-but-silent fall of secure email server Lavabit, and VPN provider CryptoSeal, have shown us just how pervasive the government's eye on our communications is. These companies chose to fold rather than to divulge customer data entrusted to them, which raises the million-dollar question: how many have chosen to remain open and silently hand over the keys to your data? Google has decided to put the private back in VPN by supporting uProxy, a project developed at the University of Washington with help from Brave New Software. Still using a VPN schema, their aim is to keep the VPN amongst friends (literally). Of course, you'll need a friend who is willing to let you route your net through their tubes. Their simple integration into Firefox and Chrome will lower the barrier, creating a decentralized VPN architecture that would make sweeping pen register orders more difficult, and would also make blocking VPNs a rather difficult task for countries like China, who block citizens' access to numerous websites. On a related note, when will the public finally demand that communications which pass encrypted through a third party still retain an reasonable expectation of privacy (rendering them pen register order-resistant)?"
That actually would be pretty neat - force or opt-in everyone who uses the browser to be part of it.
The downside is the aggravation of being collateral damage in some investigation.
"... the mere knowledge of the existence of their program could weaken its ability to function."
Yeah, security by obscurity has the tendency to bite you in the ass.
We could have told you that years ago.
How is this easier to set up than Tor or more secure?
If anyone is going to collect data it is going to be us! After all we are the only ones who can properly monetize it.
"She's a scientist and a lesbian. She's not going to let it slide." Orphan Black
Google has decided to put the private back in VPN by supporting uProxy,
Even if they don't plan to install a backdoor, it is hard to believe in Google's interest in our privacy.
Who supported privacy measures before Snowden's revelations?
to allow ppl to avoid Google's eavesdropping....
uProxy has been compromised and should not be trusted.
I don't get what's so nice about it, the NSA already knows who I am friends with. So no matter how we route traffic in our min-TOR, all exits identify us. The whole point of VPNs, TOR etc. is to hide within massive noise.
No, if Google actually wanted that, they'd make their search engine work with Tor instead of saying "I'm sorry, but we're recieving a high volume of suspicious requests from your computer..." with a picture of a robot giving you the middle finger next to it. What Google wants is for you to use their service, and if that means pandering to the "NSA is evil" crowd, they'll make trivial gestures about privacy to attract them.
But Google is in bed with the NSA, CIA, DHS, etc., as is all other large corporations because if you don't play ball with them, you don't get to play. At all. No PR is going to convince me otherwise, and you would be wise to do the same.
#fuckbeta #iamslashdot #dicemustdie
Is it possible for routers to see the difference between VPN traffic and normal traffic? If so, it's rather trivial for the chinese firewall to prevent VPN traffic.
Slashdot social media options: AIM, ICQ, Yahoo, Jabber and Mobile Text. Why no MySpace?
"Trust me," said the fox to the hen, "You can keep your eggs in my basket and I'll make sure the other foxes don't eat them."
An enigma, wrapped in a riddle, shrouded in bacon and cheese
This resembles the project for circumventing parental controls, Psiphon
What brings this new thing to the table what the old and proven VPNs like openvpn or tinc don't? Is it only the hip google sponsorship? If so then it's a good slashvertisement and clickbait in one.
This is more BS from Google. They open their infrastructure up to the NSA and get caught (who are you going to believe? Google or Snowden?), and now they keep on dribbling pathetic treats to us.
Stop using Chrome. Stop using gmail. Move your data outside the u.s.
They will never be able to prove to me that they're NOT giving info the the NSA. And, as such, they will never be able to earn my trust.
The cow says "Moo." The dog says "Woof." The Timothy says "Thanks, valued customer. We appreciate your input."
Seems to me the limiting factor will be ISP datacaps.
The ISPs that tend to have them are the ones that also want to send content (e.g. U-Verse, Comcast, to name a few). Datacaps limit peer-to-peer networks.
A more sinister interpretation is that datacaps limit the amount of traffic that the NSA has to sift through. The ISPs that seem to have the greatest track record of caving to NSLs, etc. are also the ones with datacaps. Coincidence?
Thus, datacaps also apply when one's "friend" routes traffic through one's connection to support a distributed VPN scheme.
Like a good neighbor, fsck is there
"when will the public finally demand that communications which pass encrypted through a third party still retain an reasonable expectation of privacy (rendering them pen register order-resistant)?"
As soon as NSA spying prevents them from watching "Dancing With the Stars" and "Honey Boo Boo".
I want a new quote. One that won't spill. One that don't cost too much. Or come in a pill.
Funny how Google is trying to come up with ways around the Great Firewall of China when, contrary to their 'do no evil', awhile ago was tailoring their search engine for China to accomidate their government rather than defeat the Firewall. I'm sure you can find at least one /. article about this in the archives...
Laughter is the Spackle of the Soul.
Subject says it all.
Making it open source would be a good start building trust... we'll see. Seeing as the VPN is only between friends, data doesn't ever have to see a google server, so there's not a whole lot of trusting that NEEDS to happen.
"At a presentation in New York, the company unveiled uProxy, which it says will allow citizens under some regimes to bypass government censorship or surveillance software to surf the Web and use its properties like YouTube and Blogger. "
So is the U.S. considered a "regime" by Google?
We play the game with the bravery of being out of range
And immediately afterwards Google updated their policies to clarify that personal servers were allowed. Non-commercial VPN is explicitly allowed.
Legally, any company is required, by the unconstitutional law the NSA uses, to NOT disclose they are giving your information away.
Like Microsoft, Adobe, Apple, Google, and all your communications providers.
All of them.
Every. Single. One.
Did I mention the backdoors in the chips in your computer and your comm gear?
-- Tigger warning: This post may contain tiggers! --
I'd like to see Google make an effort to build GPG into their product and make it easy for people to use.
If anyone can do it, it's Google, but they won't. It's hard to deliver targeted advertising when you can't read your users' email.
I don't get what's so nice about it, the NSA already knows who I am friends with. So no matter how we route traffic in our min-TOR, all exits identify us. The whole point of VPNs, TOR etc. is to hide within massive noise.
I want no part of "Google freedom". Their self driving cars? If these are the norm, they'll know where you are - all the time - and be queriable for your violations of speed limits and other "indiscretions".
If you trust them for VPN? How are keys generated? Who is the root of trust? This is your real question.
This idiom reflects the ever closer union between the State Department and Silicon Valley, as personified by Mr. Schmidt, the executive chairman of Google, and Mr. Cohen, a former adviser to Condoleezza Rice and Hillary Clinton who is now director of Google Ideas.
-- Julian Assange, The Banality of 'Don't Be Evil"
I'm with Admiral Ackbar, on this one:
"IT'S A TRAP!"
"Flyin' in just a sweet place,
Never been known to fail..."
"Virtual Private Networks (VPNs), which serve to mask the source and destination of data by routing it through a third-party server"
This is a false and very dangerous line of thinking. A VPN and a proxy are two different things. And they don't necessarily do what you're saying they do.
Some employers who let you use firefox/chrome plugins at will might have a problem keeping their sheep in the pen with this one. Of course, they probably already do, but this would just make it easy for you to connect through your "friend" (ie home) and circumnavigate the firewall.
I want no part of "Google freedom". Their self driving cars? If these are the norm, they'll know where you are - all the time - and be queriable for your violations of speed limits...
but if they're self driving cars, wouldn't it be the software that is guilty of going over the speed limit?
Switzerland is a more realistic choice. They have very strong data protection laws and don't have the shenanigans you see happening in the EU.
And would never get involved in money laundering either.
Their self driving cars? If these are the norm, they'll know where you are - all the time - and be queriable for your violations of speed limits
Why would a self-driving car be speeding? If it were, why would you be liable?
When you can do whatever you want while riding in your self-driving car, you will stop caring about the difference between 65mph and 75mph. You'll be more likely to remain in your car at the destination for an extra minute finishing whatever task you are doing than you are likely to care about the seconds that speeding shaves off the average commute.
Making it open source would be a good start building trust... we'll see
Making it open source doesn't matter. Law always trumps technology.
The only solution is an open justice system. There's a good reason any member of the general public can stroll into any Judicial Branch court...from your local county court to the Supreme Court...and sit down and watch what is going on. That is the most important check on government authority.
The problem is the Executive Branch courts, which work in secret. Sealed court orders are tyranny.
"If you have something that you don’t want anyone to know, maybe you shouldn’t be doing it in the first place."
vi? Who's that?
I don't suppose anyone remembers this? http://www.politico.com/news/stories/1112/83818.html .
Why would a self-driving car be speeding?
The car's idea of the speed limit on the road no longer matches the recently introduced, lower limit. The car did not "see" a temporary reduced speed limit for road works, high wind or ice conditions. The limit is vague, like a 40 km/h school zone that only operates a between 7-9AM and 2-4 PM on school days (whatever they are) or the unsigned 50 km/h limit in "residential" streets. (Australian examples but I am sure you can find USian ones)
If it were, why would you be liable?
If the car has a mechanism for you to manually lower the speed and you did not then I am sure liability will be asserted. Minimises the attractiveness of a "self-driving" car if you constantly have to monitor it.
Patent litigation: A doctrine of Mutually Assured Destruction... in which everyone seems willing to push the button
I would only trust foreign services with no physical ties to the U.S, whether Google say they support them or not.
Signature intentionally left blank.
Fuck that! We should demand that all of our communications remain private! Why limit our demands only to those communications that are encrypted and routed through a proxy? Why should we put up with any of this nonsense for an instant?
The fourth amendment states: "Every subject has a right to be secure from all unreasonable searches, and seizures of his person, his houses, his papers, and all his possessions." So our papers are electronic today, but it's plain to see that the spirit of this basic right translates directly to electronic papers.
The NSA's actions are egregious and ri-goddamn-diculous! The bastards should be made to stand at the pillory until they rot! What the fuck is wrong with everybody?
... they'd spend the money on lobbying instead.
When it is released to the public it will be released under the Apache2 license.
It will never be possible to "win" the privacy war until individuals are held responsible for violations of privacy. The Milgram Experiment shows that morality is engaged by a feeling of personal responsibility, and that morality is suppressed when personal responsibility is taken away. My (crackpot) theory is that unless we start holding lawmakers, government officials, lobbyists, politicians, and even technologists personally accountable for creating and participating in illegal programs, nothing about this fight will ever change. A software engineer who writes code for the NSA will feel pretty safe because they can always blame their participation on "orders", on "the government", or any number of other abstract ideas. Nobody at any level of government ever feels personally responsible, and as a result, will never make the proper, moral decision to stop spying. Call me crazy, but maybe it's time to establish a new set of laws?
Doesn't encryption by itself indicate that the user has an expectation of privacy? What with that being the purpose of encryption in the first place.
What do you do about googleapis.com, google.com, gstatic.com, etc? Many parts of the web are practically unusable without allowing them to load scripts from these. I wish it wasn't so, but it's gotten to the point where I'm allowing them. In theory those shouldn't be mining the shit out of you like google-analytics, but obviously you can't see what they do, and even if you did, it's not running in your machine so they could be showing you the source code for notepad for all that's worth.