5 ms·

It is time for software companies to unite. Feds can't just continue roaming around, asking companies for their users' password hashes and other things. In th

by noloqy 13y ago

It is time for software companies to unite. Feds can't just continue roaming around, asking companies for their users' password hashes and other things. In the current state, some big companies have the means to fight such requests, some big companies are very willing to cooperate, and small companies rarely have the means to go into a legal battle. Because of the current fragmentation and secrecy surrounding feds' requests with software companies, users do not have the possibility of knowing what they're in for with which company. Also, the divide and conquer tactics used by the Feds really allow them to extract much more information than what would otherwise be the case. Ideally there should be a union for software companies, which makes agreements with the feds concerning their access rights; agreements which then apply to all members of the union. Currently I have two rules of thumb: 1) for critical services, avoid companies located or significantly involved in the US or UK and 2) at all costs, stay away from Microsoft.

kybernetyk 13y ago
1) For critical services run them locally where possible. Avoid 'cloud' or 'remote' at all costs - no matter where the hosting company is located.
- toble 13y ago
  This is more apt advice. At Hacker News we are swimming in a sea of start-ups, who are constantly evangelising the 'cloud' (it's often their bread and butter). But if you genuinely want privacy then keep it local and locked down. Stick to mainstream open source products and keep things as simple as possible.
  - hariis 13y ago
    And what will you do when Feds knock on your door?
    - kybernetyk 13y ago
      At least they need a warrant in that case and you know that there's something going on. Also: You can encrypt the server hard drives.
      - noloqy 13y ago
        Fun fact: in Holland the department of justice has recently obtained the right to force you to decrypt your hard drive.
        krasin 13y ago
        This is why deniable encryption exists. http://en.wikipedia.org/wiki/Deniable_encryption http://en.wikipedia.org/wiki/Deniable_encryption
        deleted 13y ago
        [deleted]
        killerpopiller 13y ago
        use hidden truecrypt-container in a truecrypt container.
    - drivingmenuts 13y ago
      Keep your server in a hardened concrete closet and a strong magnetic coil in the only doorframe. Hey, it sounded good on paper.
  - SilasX 13y ago
    Well ... What if I launched a cloud based startup that used homomorphic encryption on your data? I mean, it'll be another 10 years before we get the encryption overhead below a factor of a million, but at least we won't be able to give away your data in any useful form...
mtgx 13y ago
I've been saying the same thing for a while. Many companies need to form some sort of alliance against government censorship and surveillance, not just in US, but globally. One company alone, even one as big as Google, can't stand up to a government like the Chinese one. 100 big American companies that are vital for their economy, might be able to do it.
- john_b 13y ago
  Yes, but they won't do it until it hurts their bottom line. If I owned a European cloud business of any kind I would be heavily advertising to the US market right now. When customers start leaving major US internet companies because they no longer feel that they adequately protect their data and privacy, things will change.
  - moens 13y ago
    IMO the very nature of the centralization of power works against individual rights, one of which is (arguably) privacy. As corporations grow they tend to lose a sense of the customer as a means, and instead choose which type of customer they need in order to maximize profits (or other goals). Corporations (or any large centralized power base) will optimize for the most exploitable customer or user base, culturing this base if possible. To help broaden a target user base corporations need strong centralized governments more than they need even sizable (but less "culturable") segments of their market base. Upshot: mature corporations (political parties / religions / etc) will not typically stand up to a centralized government on behalf of a rights-demanding fraction of their market... indeed, typically, they will do the opposite.
    - rayiner 13y ago
      And let's face it, it's not like corporate America needs the government's help to abuse you based on your private information. Not in a day and age where you can be denied a job because of your credit history or kicked off your insurance because of your health records. People throw off tons of data, and companies have been working for decades to figure out how to use it to screw you.
rlvesco7 13y ago
Do we think that services like Mint are handing over all our financial data to the government (making it easy for them to have a picture of your entire finances)? If so, are there any viable, offline alternatives?
- a3n 13y ago
  text files, paper statements and your file cabinet. There are various open source check register and book keeping packages. GnuCash is complete but possibly overkill for some people. http://en.wikipedia.org/wiki/Comparison_of_accounting_software http://en.wikipedia.org/wiki/Comparison_of_accounting_softwa...
- uptown 13y ago
  Probably. They also scoop up all your credit card transactions, so for in-person purchases, they've got your location logged there as well. http://www.motherjones.com/kevin-drum/2013/06/wsj-nsa-program-also-tracking-credit-card-transactions http://www.motherjones.com/kevin-drum/2013/06/wsj-nsa-progra...
- coldarchon 13y ago
  http://sourceforge.net/directory/os:windows/freshness:recently-updated/?q=finance http://sourceforge.net/directory/os:windows/freshness:recent... GNU cash seems fine, personally I use YNAB which gets saved in the clouds of Steam. http://store.steampowered.com/app/227320/ http://store.steampowered.com/app/227320/
- scrabble 13y ago
  I could never sign up for Mint. I see the value in it, but providing a private business with a view into all my financial accounts just seems like a huge mistake.
  - sgrove 13y ago
    Other than banks, creditors, and credit-score companies? I imagine there are far more businesses with access to view our financial accounts than we realize day-to-day.
nwzpaperman 13y ago
What part of "privacy is dead" do people not understand? You think multi-core processors in your iPhone or android is to make the calls more clear? How many people here can say they haven't integrated a "smart" Apple or Google phone into their lifestyle? Someone with more HN love should post that poll. Everyone needs to reconsider their worldview and a few important definitions they hold. One of those is privacy. My definition of privacy: anything I relay to ANY one person is no longer private. What's the old saying about three people keeping a secret? Information wants to be free and privacy is not its natural state. It's always been this way, but the physical barriers to diffusion have been completely decimated in the past two decades. This is not a mere blip in a long term trend, it is fundamental, IMO. That being said, I believe there are new values we can all embrace to make the most of the state of the human experience today. Perhaps someone should can a thread on Internet values for the 21st century and beyond. PS - Anyone ever wonder how MSFT got an anti-trust pass in the US, but not in the EU? "In the interest of national security..."

by noloqy 13y ago

kybernetyk 13y ago

1) For critical services run them locally where possible. Avoid 'cloud' or 'remote' at all costs - no matter where the hosting company is located.

toble 13y ago
This is more apt advice. At Hacker News we are swimming in a sea of start-ups, who are constantly evangelising the 'cloud' (it's often their bread and butter). But if you genuinely want privacy then keep it local and locked down. Stick to mainstream open source products and keep things as simple as possible.
- hariis 13y ago
  And what will you do when Feds knock on your door?
  - kybernetyk 13y ago
    At least they need a warrant in that case and you know that there's something going on. Also: You can encrypt the server hard drives.
    - noloqy 13y ago
      Fun fact: in Holland the department of justice has recently obtained the right to force you to decrypt your hard drive.
      - krasin 13y ago
        This is why deniable encryption exists. http://en.wikipedia.org/wiki/Deniable_encryption http://en.wikipedia.org/wiki/Deniable_encryption
        deleted 13y ago
        [deleted]
      - killerpopiller 13y ago
        use hidden truecrypt-container in a truecrypt container.
  - drivingmenuts 13y ago
    Keep your server in a hardened concrete closet and a strong magnetic coil in the only doorframe. Hey, it sounded good on paper.
- SilasX 13y ago
  Well ... What if I launched a cloud based startup that used homomorphic encryption on your data? I mean, it'll be another 10 years before we get the encryption overhead below a factor of a million, but at least we won't be able to give away your data in any useful form...

mtgx 13y ago

I've been saying the same thing for a while. Many companies need to form some sort of alliance against government censorship and surveillance, not just in US, but globally. One company alone, even one as big as Google, can't stand up to a government like the Chinese one. 100 big American companies that are vital for their economy, might be able to do it.

john_b 13y ago
Yes, but they won't do it until it hurts their bottom line. If I owned a European cloud business of any kind I would be heavily advertising to the US market right now. When customers start leaving major US internet companies because they no longer feel that they adequately protect their data and privacy, things will change.
- moens 13y ago
  IMO the very nature of the centralization of power works against individual rights, one of which is (arguably) privacy. As corporations grow they tend to lose a sense of the customer as a means, and instead choose which type of customer they need in order to maximize profits (or other goals). Corporations (or any large centralized power base) will optimize for the most exploitable customer or user base, culturing this base if possible. To help broaden a target user base corporations need strong centralized governments more than they need even sizable (but less "culturable") segments of their market base. Upshot: mature corporations (political parties / religions / etc) will not typically stand up to a centralized government on behalf of a rights-demanding fraction of their market... indeed, typically, they will do the opposite.
  - rayiner 13y ago
    And let's face it, it's not like corporate America needs the government's help to abuse you based on your private information. Not in a day and age where you can be denied a job because of your credit history or kicked off your insurance because of your health records. People throw off tons of data, and companies have been working for decades to figure out how to use it to screw you.

rlvesco7 13y ago

Do we think that services like Mint are handing over all our financial data to the government (making it easy for them to have a picture of your entire finances)? If so, are there any viable, offline alternatives?

a3n 13y ago
text files, paper statements and your file cabinet. There are various open source check register and book keeping packages. GnuCash is complete but possibly overkill for some people. http://en.wikipedia.org/wiki/Comparison_of_accounting_software http://en.wikipedia.org/wiki/Comparison_of_accounting_softwa...
uptown 13y ago
Probably. They also scoop up all your credit card transactions, so for in-person purchases, they've got your location logged there as well. http://www.motherjones.com/kevin-drum/2013/06/wsj-nsa-program-also-tracking-credit-card-transactions http://www.motherjones.com/kevin-drum/2013/06/wsj-nsa-progra...
coldarchon 13y ago
http://sourceforge.net/directory/os:windows/freshness:recently-updated/?q=finance http://sourceforge.net/directory/os:windows/freshness:recent... GNU cash seems fine, personally I use YNAB which gets saved in the clouds of Steam. http://store.steampowered.com/app/227320/ http://store.steampowered.com/app/227320/
scrabble 13y ago
I could never sign up for Mint. I see the value in it, but providing a private business with a view into all my financial accounts just seems like a huge mistake.
- sgrove 13y ago
  Other than banks, creditors, and credit-score companies? I imagine there are far more businesses with access to view our financial accounts than we realize day-to-day.

nwzpaperman 13y ago

What part of "privacy is dead" do people not understand? You think multi-core processors in your iPhone or android is to make the calls more clear? How many people here can say they haven't integrated a "smart" Apple or Google phone into their lifestyle? Someone with more HN love should post that poll. Everyone needs to reconsider their worldview and a few important definitions they hold. One of those is privacy. My definition of privacy: anything I relay to ANY one person is no longer private. What's the old saying about three people keeping a secret? Information wants to be free and privacy is not its natural state. It's always been this way, but the physical barriers to diffusion have been completely decimated in the past two decades. This is not a mere blip in a long term trend, it is fundamental, IMO. That being said, I believe there are new values we can all embrace to make the most of the state of the human experience today. Perhaps someone should can a thread on Internet values for the 21st century and beyond. PS - Anyone ever wonder how MSFT got an anti-trust pass in the US, but not in the EU? "In the interest of national security..."