Slashdot Mirror
A Year After Snowden's Disclosures, EFF, FSF Want You To Fight Surveillance
Today, as the EFF notes, marks one year from Edward Snowden's first document leaks, and the group is using that as a good spur to install free software intended to make it harder for anyone (the NSA is certainly not the first, and arguably far from the worst) to spy on your electronic communications. Nowadays, that means nearly everything besides face-to-face communication, or paper shipped through the world's postal systems. Reader gnujoshua (540710) highlights one of the options: 'The FSF has published a (rather beautiful) infographic and guide to encrypting your email using GnuPG. In their blog post announcing the guide they write: "One year ago today, an NSA contractor named Edward Snowden went public with his history-changing revelations about the NSA's massive system of indiscriminate surveillance. Today the FSF is releasing Email Self-Defense, a guide to personal email encryption to help everyone, including beginners, make the NSA's job a little harder.'" Serendipitous timing: a year and a day ago, we mentioned a UN report that made explicit the seemingly obvious truth that undue government surveillance, besides being an affront in itself, chills free speech. (Edward Snowden agrees.)
Some decent tools on their site.
So, it's not just the US spying on Americans in America, it's apparently Canadians spying on Canadians in Canada.
-- Tigger warning: This post may contain tiggers! --
There's no point in encrypting your email with something like GPG if you're the only one using it, and most people aren't going to use it until it's easy.
I know, you'll tell me it's easy. Just download this software, install it, and it'll work for your email client assume you're still using an email client and there's a plugin available for it, which there might not be. Otherwise you need to copy and paste and stuff, and... oh right, then there's also the whole issue of managing keys and keeping a backup copy safe. Most people don't back anything up.
You have to make it easy. Someone will get angry because I appear to be praising Apple, but take iMessage's encryption for example. Do people using it know that their messages are encrypted? Probably not. Are they given a choice? No. Do they know that they're generating encryption keys? Probably not. Are they asked to manage their own encryption keys? No.
That's easy. GPG isn't. Email encryption needs to be that easy, or people won't use it.
> the seemingly obvious truth that undue
> government surveillance, besides being
> an affront in itself, chills free speech.
When I first read this, I was completely shocked that, because the NSA monitors this, anyone would ever think they are anything but a bunch of swell guys.
(-1: Post disagrees with my already-settled worldview) is not a valid mod option.
Basically, we're making it WAY too easy for the NSA to spy on us. But, even if we all switched to encrypted mail, that's not enough: with their metadata collection, they can still infer a lot of things from our communications patterns. So technically, we need I2P, Freenet or similar anonymizing technology to hide in the crowd. However, to REALLY fix the problem once and for all, we need to take it to the political arena, and fight for majorities to get Congress to reign in NSA in earnest, no matter what "Yes We Scan" Obama wants. If we don't, Orwell's 1984 will remain in effect, no matter how much we use OSS, encryption and so on.
cpghost at Cordula's Web.
Encryption misses the point. Encryption isn't privacy. The major threat to privacy from the US government is not from the content of your communications being read without a warrant it is that your communications are going to be monitored without a warrant so they will be able to monitor all your associations, purchases, communications and movement and locations. Basically it is like having a tail on 24x7 with someone looking over your shoulder... they don't need to know what you are saying until they want to and if they want to then you are past the point where encryption will mean much since they can put a keylogger on your system or maybe even break your 256 bit encryption.
The only protection from the surveillance state is either to eliminate communications technology altogether or to return to the rule of law.
This is pointless. The 5 people that do this will be protected when they communicate with one another. That's it.
Lets be clear. I don't care if Google or Facebook are spying on me (well, I do, but that's an entirely different topic.) The NSA is definitely the "worst" despite what this says. I'm even less concerned about foreign governments or criminals spying on me. The real danger is to our entire way of life. What the NSA is doing could be used to turn us into a true totalitarian state... very easily. What China, or some script kiddy, or even what Google can do with this information pales in comparison to the atrocities the federal government could commit with this power. The only thing restraining them at this time is their own will not to do so. That is NOT acceptable in my opinion. How long before we elect the next Nixon? or Stalin? It will happen, it always does. What will they do with this power?
The essence of this demand is "You have a responsibility to smarten-up."
That has never, and will never, work. Humans simply do not work that way.
My optimistic side says the major players will make it easy, like your example from Apple, and then all will be good.
My cynical side says the government will simply slap some gag orders on the industry players, and impose backdoors, and roll merrily along with the surveillance.
The *only* people who can be protected from this are those smart enough, and motivated enough, to do something that is not easy.
No - check out the "UKUSA Agreement"...
The Canadians are spying on the Americans, New Zealanders, Australians and Brits.
The Americans are spying on the Canadians, New Zealanders, Australians and Brits.
The New Zealanders are spying on the Americans, Canadians, Australians and Brits.
The Australians are spying on the Americans, Canadians, New Zealanders, and Brits.
The Brits are spying on the Australians, Americans, Canadians, and New Zealanders.
All perfectly technically legal.
All rather unstoppable as long as the NSA shills can keep the sheeple thinking that gnupg is too difficult.
If you have the time and money you use transistors and cables to build your own macro-sized AES encrypting typewriter. You can check all parts yourself. You can send the result per mail, or even scan it and send it to the recipient with E-Mail.
The large corporations could employ secretaries that all day do nothing else than handle these machines. Their communications would be perfectly secure! This will kill unemployment!
A lot of sites encrypt their traffic with SSL.
Yet, SSL handle only the encryption between a server, and the client application. (and can be made totally transparent to the user).
Whereas the anti-surveillance discussed here are end-to-end (from one user to the other) and will always require some minimal end-user intervention (key handling, although the interaction can be minimized and user interface efforts can make the experient as easy as possible).
(Facebook/Apple Messengers, Google Hangouts, etc.).
Note that OTR (Off-the-Record) is standard, and is capable to be used above any of those, just like OpenPGP works over email.
But again, this requires either using full blown clients (pidgin, adium, jitsi, messagebird, or any other OTR compliant client) or using extensions (like cryptocat) to be able to use it from within a webapp.
Also, for obvious reason, OTR disturbs the "search" fonction on chat web-apps (as the webserver only sees encrypted text and can't search).
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]
Yeah, basically we're paying foreigners to spy on us. Raisin our taxes 'n Outsourcing 'merican jobs. Great!
Use 4k keys folks - the spooks really hate that! Takes at least twice as long to break our codes.
Hey it's only $10,000,000,000 a year!
Which if we spent on building wind and solar we would solve the Global Warming crisis with.
-- Tigger warning: This post may contain tiggers! --
The problem with public key encrypted email is that your keys only work for encrypting email you receive, not the email you send. In order for an email to be private, the receiver has to set up encryption.
While I'm sure I could set up encryption for my email quite easily, I can assure you most of my friends and family have no interest in going to the effort.
In addition to that, encryption only encrypts the body of the message. The to/from addresses, header line, and other tags are sent in plain text, regardless of whether you "encrypt" your email. And the NSA, et. al. claim they're only interested in that header information in the first place to identify who your contacts are, not what you're saying to them.
So encrypt away -- they're still getting the info they want from your email headers.
I do not fail; I succeed at finding out what does not work.
Great article but this part isn't correct:
"Nowadays, that means nearly everything besides face-to-face communication, or paper shipped through the world's postal systems."
As shown here - every single piece of 1st class mail in the U.S. is photographed (and probably handed over to the FBI or NSA or whomever started this stupid program up in the first place to get the Post Office to do that):
http://www.nytimes.com/2013/07...
Short of radical political reform, which seems a long shot in the U.S. in the near term - technical solutions coming from open software will be the few ways we can restore some privacy to communications.
twitter - no link for you - they changed the title twice - last title was "Government orders federal departments to keep tabs on all demonstrations" and also coverage of bill S-4 in Globe and Mail.
-- Tigger warning: This post may contain tiggers! --
the NSA is certainly not the first, and arguably far from the worst
What's this argument? First of all, prove that you're not from the NSA.
What other country is ACTUALLY KILLING THOUSANDS OF FOREIGN PEOPLE based on oil interests and using it's spying network to determine the targets???? What other country is fighting against democracy in Latin America and Europe (by making coups like the recent one in Paraguay and subverting justice like in Sweden)? What evil could Chinese spying do to an American citizen? I'm not talking about stealing trade secrets, I'm talking about real harm. Will an American be detained indefinitely without accusation due to Chinese spying? No. Just American spying do real harm to both Americans and foreigners.
That is exactly right. The push to encourage encryption does not solve the issue. De-funding and dismantling the NSA and taking back our freedoms through clear legislation is the only way to get what we deserve as a nation. Encrypting ordinary communication beyond simply using SSL/TLS is like bowing down and saying you don't expect the first amendment to protect you. When the teeth are gone from the fourth amendment the first amendment losses it strength as well. The moment we start editing our communications to keep our privacy, real freedom is lost. That said if you want to say anything private and keep it private strong encryption and a low profile are the only means to assure such privacy.
It boils down to different trust models.
Trusting every involved government to stop indiscriminately spying on all its citizens require quite a leap of faith.
Encrypting between your correspondent and you doesn't require trust in 3rd parties like government or secret agencies.
Under this situation, having encryption anyway is always good in case that the gov decides to deceive you.
But yeah, I agree with you that achieving *proper* encryption isn't easy.
Now there's another effect: increasing usage of encryption increases (as I've said above) the cost of spying.
So use TOR even if it's just for pr0n !
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]
OTR basically works this way above any chat stream.
It's made entirely transparent, user won't notice that encryption is happening (I mean, unless they log into GMail and notice that the GTalk/Hangout chat logs only contain encrypted garbage).
The only required action from the user is running through a "socialist millionaire" identity confirmation.
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]
Yet, SSL handle only the encryption between a server, and the client application.
You can use the same encryption scheme for encrypting anything.
TLS/SSL is not an encryption scheme. It's protocol which defines how a client application and a server negociate an encryption. You can't use it for mush else.
AES is an encryption scheme, you could encrypt anything with it (an SSL connection, a ZRTP media transmission, password-protect an archive, encrypt a file with OpenPGP)
of course libraries like openssl will implement both (because what purpose would be SSL without actually being able to encrypt ?!) and other functionnality (S/MIME, similar to openPGP in that it use PKI for encryption, but instead use the same central authority model as SSL, instead of the web-of-trust model like openPGP).
Note that several Linux distribution also feature the same level of use simplification.
You just need to make key management easy. I know people are going to get angry every time I bring up Apple, but OSX can store certificates/keys in the keyring, which can then be backed up to iCloud {...} it's not impossible to make the whole thing much more automatic, safe, and easy for normal users.
I've never said it's impossible to make it better. But the user will always need some level of intervention (like at least caring that encryption happens, and checking that correct keys are used).
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]