5 ms·

Privacy is not dead

77 points by Nikolas0 13y ago

matho 13y ago
> if you really believe that you don’t have anything to hide, feel free to give me your passwords as a proof of concept. I do not intend to use a privacy service from someone who claims it is easy (it isn't) while confusing privacy with authentication. I may not wish to give up my password because I don't want actions to be taken in my name: this is irrelevant to privacy concerns.
- loup-vaillant 13y ago
  Then I guess you would have no problem giving him (or anyone else) a read-only access to all your mail that doesn't mention authentication data (passwords and such)? Or a read-only access to whatever online service you're currently using?
devx 13y ago
I find it a little absurd that this even needs to be said. As long as we're still humans, we'll always want private communications. Always. Even if US and all of the world's "democracies" turn into totalitarian surveillance states, we'll still want to have private communications with each other, and we'll find ways to do it - especially if in such a world the governments have no shame nor limitation in abusing that power (which you can bet will happen, and is already happening. We're just now finding out about some of them).
- nathan_long 13y ago
  Absolutely. I think privacy is even fundamental to relationships. Imagine if every conversation with a loved one had to be carried out on a stage with a microphone. It would destroy the relationship because there would be no intimacy. Privacy means, in part, freedom to be yourself.
- rayiner 13y ago
  For most of history, the way people communicated in private was to invite someone into their home and talk to them. That way still exists. All of the means of communication that were private in 1789 still are. What you're asking for is to go another step: to be able to spew unencrypted bits all over the internet for any of hundreds of sysadmins and network engineers to see, then turn around and claim its private. You want to broadcast your location in real time to Google and ATT, who sells it to advertisers, then claim its private. Maybe you should be able to do that. But its disingenuous to claim that what you're asking for is basic human private communication. What you're asking for is for the government to treat the internet as something other than what it is: a public network designed with almost no thought to keeping information private. At the most basic level, being a routed network with no built in encryption IP leaks your data out to every intermediate router on the way to the destination. SMTP passes your clear text email through multiple servers on the way to someone's inbox. Its a vast system designed with no thought to leaking your private data out into the world. Maybe its because nobody teaches low level networking in school anymore, but I'm amazed at how many technologists indulge what is a technical fiction: that the two ends of a socket are connected by a private link.
  - pessimizer 13y ago
    >That way still exists. All of the means of communication that were private in 1789 still are. If you ignore cell phones and cars that constantly broadcast their positions, surveillance cameras everywhere, and that there are no sidewalks and no commons anymore, so where would you meet these people and how would you meet with them without the information being observed and stored? The only possible goal of a system intended to flawlessly prevent 'terrorist' conspiracy is to create a system that flawlessly prevents unrecorded association and communication. The Stasi managed it with technology that was available in 1789. This has nothing to do with computers, other than the terrible fact that they make doing this a lot cheaper.
  - Silhouette 13y ago
    For most of history, the way people communicated in private was to invite someone into their home and talk to them. That way still exists. For most of history, the way people communicated at all was to speak to someone face to face. Luckily for us, modern technology provides other options. Surely you're not seriously suggesting that the principle of privacy and the arguments for why it is a good thing do not apply in any new context? What you're asking for is to go another step: to be able to spew unencrypted bits all over the internet for any of hundreds of sysadmins and network engineers to see, then turn around and claim its private. I don't see anyone here claiming that. It seems to me more often in this general debate people are asking for rather more reasonable things, like: 1. If you send data you intend to be private over the Internet, for example by encrypting it and sending it to a specific recipient, you shouldn't have to worry about crackers, communication services, or governments that don't have a good reason expending significant resources to infringe your privacy anyway. 2. If you choose to share some personal information with a modern service like Facebook, and choose to use the provided options to restrict who else gets to see it, you shouldn't log onto Facebook one day and find it's all been shared with other people anyway. 3. If you do want to visit someone to communicate in person the old-fashioned way, you shouldn't have to forfeit all of your normal rights and be subject to arbitrary invasions of your person and possessions just to travel. None of these things matter if you live in a quiet countryside village and the only people you ever want to communicate with privately are your neighbours, but for most people in the western world, these activities are a normal part of modern life, and it is not unreasonable to expect governments and laws to protect everyone's privacy while they do them.
- lnanek2 13y ago
  Wanting something and expecting it from public companies like the phone company and Microsoft are different things, however. I think almost anyone on the street knows about phone taps from TV and movies for example, so there's almost no one who thinks your phone can't be tapped. I don't really follow this writer's claim that all the stuff built on top and later somehow magically becomes private. Nor that there will be mass consumer adoption of some solution that avoids possible tapping at the cost of other things, such as network size and price. If you went door to door asking people to pay twice their phone bill for an untappable phone, how many do you think would say yes? I think not many. The writer claims many.
bayesianhorse 13y ago
After the past few months there is virtually no situation in which you should have a reasonable expectation of privacy.
- angersock 13y ago
  Be that as it may, we can and should seek to create a world where one can have that expectation of privacy. Pointing to the status quo and saying that's all there is doesn't help us much. (And yes, I'm being lazy here in not justifying my assertion that we should all be able to have that expectation of privacy; I haven't had my morning coffee yet, so just take it as a lemma.)
- ctdonath 13y ago
  If you're talking to someone in a public park, and a stranger with a badge comes up and starts video recording your discussion while commenting "don't mind me, it's just an administrative search", and this happens to pretty much everyone all the time, you DON'T respond with "well, there is virtually no situation in which you should have a reasonable expectation of privacy."
  - loup-vaillant 13y ago
    Well, he's right. Expectation of reasonable privacy does not match reality, and therefore is foolish and shouldn't be done. Not to say that we shouldn't _demand_ privacy.
tech-no-logical 13y ago
with regard to most people with a grain insight this article is all about stating the obvious, albeit in very big letters. I agree nonetheless. apart from the 'give me your passwords' example, that's not what privacy is about. 'automatically cc me all your incoming and outgoing email' might be a better analogy.
deleted 13y ago
[deleted]
pothibo 13y ago
I think nobody values privacy. People don't want to pay for an e-mail account. People don't want to pay for a social network. People don't want to pay to read the news online. I believe that privacy and free (as free beer) is an utopia.
- alextingle 13y ago
  Of course people will choose "free" over "costs something", if all else is equal. You are not adding much to the debate by pointing that out. Far more interesting to note that paid services (yes, people used to pay for e-mail) have largely been elbowed out by services that look as though they are free, but actually extract their payments by guile and deceit. Now that the general public is starting to appreciate the value of their personal data, perhaps we'll see a rebalancing of the market.
  - pothibo 13y ago
    I believe you missed my point. Most people outside the tech world have no idea who Edward Snowden is and what exactly happened with the NSA scandal. Computers are just a black box to them with something magical happening underneath (I'm not kidding here). If they don't understand what they are using, how can they understand the tradeoff between something free vs something they pay for?
    - oskarth 13y ago
      Are you sure about your first statement? Everyone in my family knows about Snowden. And not because I told them. None of them are even remotely close to the tech world. I'm from Sweden.
      - hawkw 13y ago
        Ah yes, Sweden. A place where there is no technology. At all.
    - wes-exp 13y ago
      The idea that only technology nerds are aware of the NSA scandal is plainly untrue. Right now many members of Congress are upset, and even the President himself has had to provide a response on the issue. This has become front page news that any ordinary person can see as he walks past the newspaper stand.
Sagat 13y ago
I think it's better to avoid encryption unless it's for really sensitive information or knowledge that could hurt you if broadcast. Using Tor or Truecrypt essentially paints a target on your back: you are paradoxically more likely to be under surveillance by agencies if you use them, even if you aren't concealing anything illegal or reprehensible.
- delinka 13y ago
  "Using Tor or Truecrypt essentially paints a target on your back: you are paradoxically more likely to be under surveillance by agencies if you use them..." "Paradoxically" you say. I don't think there's a paradox here. I think it's far too rare that people use these tools to protect themselves, and therefore the surveillance community sees it as a potential flag worth investigating. Therefore, we should all use these tools, make them common place, and force them to learn to be efficient at their jobs tracking down actual risks.
- alextingle 13y ago
  Better yet to get everybody to use encryption, always.
  - Sagat 13y ago
    I agree wholeheartedly, but that's like saying we should make everyone use condoms all the time to eliminate AIDS. A perfect solution that is unfortunately unfeasible.
    - Nursie 13y ago
      But in this case a smaller group of humans controls the implementation of software, so it's at least a little more feasible.
apas 13y ago
Oh. My. God. HN's comments quality is at an all-time low. Can't understand how many people miss (or ignore deliberately) the point and pedantically focus on semantics trying to prove a silly counter-point which doesn't add in the conversation.
- Sprint 13y ago
  Look at yourself.
  - joefantastic 13y ago
    Better to martyr than ignore the elephant, no?
    - Sprint 13y ago
      Be a better community member and you will get down-vote rights.
      - nitid_name 13y ago
        How does that work, exactly?
        czr80 13y ago
        If you have sufficient karma (500, last I knew) you can downvote comments.
      - joefantastic 13y ago
        Thanks for the tip. I had no idea that downvote rights even existed.
infocollector 13y ago
If you do value privacy, please do check us out https://register.blib.us https://register.blib.us (pre-alpha software, still being written. We are still looking for early adopters). BTW, we did double our pre-alpha users in the past one month!
- theg2 13y ago
  Alpha software and a username of "info collector"? Where do I sign up!?
  - infocollector 13y ago
    Random usernames have a way of biting you back. Indeed I've been assigned to collect information from users, and what they want in Blib ( Did not think of the double meaning ). Just click "Register/Sign up" Button here: https://register.blib.us https://register.blib.us (Currently we only support @gmail addresses and use OpenID to authenticate). :( - I agree that was a bad choice - to pick Google as a provider. Beta should fix this.
- Loughla 13y ago
  Maybe I'm completely ignorant of the process, but what is the point of a (marketed as) completely private system that is automatically, and required to be linked to a google account?
  - infocollector 13y ago
    Excuse us for being pre-alpha: (and using Google's OpenID): Its a demo of OpenID, which can be migrated to many other providers. In Beta, you should be able to login with 100 other providers, and forget about Google :)
DanBC 13y ago
> When I sign up for an email account I expect my emails to be private, between me and the people I exchange them. That's foolish. Ever since it was introduced people knew that email was not private. You should expect that everything you put anywhere is going to be read by spies. That's why spies exist; to gather information. You use that as part of your risk assessment. "Will I be sentenced to death or torture if this document is discovered?" "Will I go to jail if this document is discovered?" "Will my company lose business if this document is discovered?" "Will I be embarrassed if my terrible teen-angst poetry is found?" Then you decide how much effort you're going to use to hide the information, or the source of the information, or both. While it's right that governments shouldn't be wasting money slurping the data of everyone it's unlikely to be an argument that the public will win any time. And even when there are laws "They" will find a lawyer to tell them that what they're doing is legal, and no-one ever gets to take them through court to show that it isn't. Oversight fails. You should assume a well-funded government is reading everything[1] all the time. I suspect that makes more of a difference if you're in $Oppressive_Regime than in the US or UK. And if people really did care why would they dump so much stuff onto Facebook? [1] see the mistakes that people make with creating encryption products, and using those products, it's probably a good idea to assume you've made a mistake and this government can read everything even if you encrypt it.
- amirmc 13y ago
  > "You should expect that everything you put anywhere is going to be read by spies. That's why spies exist; to gather information" That's ridiculous. It seems like you're condoning mass-surveillance by saying "It's their job". Doesn't the government get to tell them what their job is and don't we get to tell our government what we think?
  - night815 13y ago
    You make two assumptions: 1. all spies work for a government 2. government employees follow all the rules and guidelines. that is, they follow the law themselves.
  - baddox 13y ago
decasteve 13y ago
Privacy is important. I had a hard time to articulate why but the Groklaw farewell (posted on HN recently) really hit it home for me. Re-read the quotes (in grey): http://www.groklaw.net/article.php?story=20130818120421175 http://www.groklaw.net/article.php?story=20130818120421175
jheriko 13y ago
this is the wrong way to look at the problem. the better statement is 'nobody should expect privacy (online)' where i would like to stress the brackets around online as much as i can if you take steps to ensure privacy you should probably realise that they are all futile in the face of someone making a targetted effort to break it... eavesdropping, espionage, noseyness - these are nothing new... see most of recorded history for examples.
legion050 13y ago
I expect privacy, yet anticipate privacy violations..

77 points by Nikolas0 13y ago

matho 13y ago

> if you really believe that you don’t have anything to hide, feel free to give me your passwords as a proof of concept. I do not intend to use a privacy service from someone who claims it is easy (it isn't) while confusing privacy with authentication. I may not wish to give up my password because I don't want actions to be taken in my name: this is irrelevant to privacy concerns.

loup-vaillant 13y ago
Then I guess you would have no problem giving him (or anyone else) a read-only access to all your mail that doesn't mention authentication data (passwords and such)? Or a read-only access to whatever online service you're currently using?

devx 13y ago

I find it a little absurd that this even needs to be said. As long as we're still humans, we'll always want private communications. Always. Even if US and all of the world's "democracies" turn into totalitarian surveillance states, we'll still want to have private communications with each other, and we'll find ways to do it - especially if in such a world the governments have no shame nor limitation in abusing that power (which you can bet will happen, and is already happening. We're just now finding out about some of them).

nathan_long 13y ago
Absolutely. I think privacy is even fundamental to relationships. Imagine if every conversation with a loved one had to be carried out on a stage with a microphone. It would destroy the relationship because there would be no intimacy. Privacy means, in part, freedom to be yourself.
rayiner 13y ago
For most of history, the way people communicated in private was to invite someone into their home and talk to them. That way still exists. All of the means of communication that were private in 1789 still are. What you're asking for is to go another step: to be able to spew unencrypted bits all over the internet for any of hundreds of sysadmins and network engineers to see, then turn around and claim its private. You want to broadcast your location in real time to Google and ATT, who sells it to advertisers, then claim its private. Maybe you should be able to do that. But its disingenuous to claim that what you're asking for is basic human private communication. What you're asking for is for the government to treat the internet as something other than what it is: a public network designed with almost no thought to keeping information private. At the most basic level, being a routed network with no built in encryption IP leaks your data out to every intermediate router on the way to the destination. SMTP passes your clear text email through multiple servers on the way to someone's inbox. Its a vast system designed with no thought to leaking your private data out into the world. Maybe its because nobody teaches low level networking in school anymore, but I'm amazed at how many technologists indulge what is a technical fiction: that the two ends of a socket are connected by a private link.
- pessimizer 13y ago
  >That way still exists. All of the means of communication that were private in 1789 still are. If you ignore cell phones and cars that constantly broadcast their positions, surveillance cameras everywhere, and that there are no sidewalks and no commons anymore, so where would you meet these people and how would you meet with them without the information being observed and stored? The only possible goal of a system intended to flawlessly prevent 'terrorist' conspiracy is to create a system that flawlessly prevents unrecorded association and communication. The Stasi managed it with technology that was available in 1789. This has nothing to do with computers, other than the terrible fact that they make doing this a lot cheaper.
- Silhouette 13y ago
  For most of history, the way people communicated in private was to invite someone into their home and talk to them. That way still exists. For most of history, the way people communicated at all was to speak to someone face to face. Luckily for us, modern technology provides other options. Surely you're not seriously suggesting that the principle of privacy and the arguments for why it is a good thing do not apply in any new context? What you're asking for is to go another step: to be able to spew unencrypted bits all over the internet for any of hundreds of sysadmins and network engineers to see, then turn around and claim its private. I don't see anyone here claiming that. It seems to me more often in this general debate people are asking for rather more reasonable things, like: 1. If you send data you intend to be private over the Internet, for example by encrypting it and sending it to a specific recipient, you shouldn't have to worry about crackers, communication services, or governments that don't have a good reason expending significant resources to infringe your privacy anyway. 2. If you choose to share some personal information with a modern service like Facebook, and choose to use the provided options to restrict who else gets to see it, you shouldn't log onto Facebook one day and find it's all been shared with other people anyway. 3. If you do want to visit someone to communicate in person the old-fashioned way, you shouldn't have to forfeit all of your normal rights and be subject to arbitrary invasions of your person and possessions just to travel. None of these things matter if you live in a quiet countryside village and the only people you ever want to communicate with privately are your neighbours, but for most people in the western world, these activities are a normal part of modern life, and it is not unreasonable to expect governments and laws to protect everyone's privacy while they do them.
lnanek2 13y ago
Wanting something and expecting it from public companies like the phone company and Microsoft are different things, however. I think almost anyone on the street knows about phone taps from TV and movies for example, so there's almost no one who thinks your phone can't be tapped. I don't really follow this writer's claim that all the stuff built on top and later somehow magically becomes private. Nor that there will be mass consumer adoption of some solution that avoids possible tapping at the cost of other things, such as network size and price. If you went door to door asking people to pay twice their phone bill for an untappable phone, how many do you think would say yes? I think not many. The writer claims many.

bayesianhorse 13y ago

After the past few months there is virtually no situation in which you should have a reasonable expectation of privacy.

angersock 13y ago
Be that as it may, we can and should seek to create a world where one can have that expectation of privacy. Pointing to the status quo and saying that's all there is doesn't help us much. (And yes, I'm being lazy here in not justifying my assertion that we should all be able to have that expectation of privacy; I haven't had my morning coffee yet, so just take it as a lemma.)
ctdonath 13y ago
If you're talking to someone in a public park, and a stranger with a badge comes up and starts video recording your discussion while commenting "don't mind me, it's just an administrative search", and this happens to pretty much everyone all the time, you DON'T respond with "well, there is virtually no situation in which you should have a reasonable expectation of privacy."
- loup-vaillant 13y ago
  Well, he's right. Expectation of reasonable privacy does not match reality, and therefore is foolish and shouldn't be done. Not to say that we shouldn't _demand_ privacy.

tech-no-logical 13y ago

with regard to most people with a grain insight this article is all about stating the obvious, albeit in very big letters. I agree nonetheless. apart from the 'give me your passwords' example, that's not what privacy is about. 'automatically cc me all your incoming and outgoing email' might be a better analogy.

deleted 13y ago

[deleted]

pothibo 13y ago

I think nobody values privacy. People don't want to pay for an e-mail account. People don't want to pay for a social network. People don't want to pay to read the news online. I believe that privacy and free (as free beer) is an utopia.

alextingle 13y ago
Of course people will choose "free" over "costs something", if all else is equal. You are not adding much to the debate by pointing that out. Far more interesting to note that paid services (yes, people used to pay for e-mail) have largely been elbowed out by services that look as though they are free, but actually extract their payments by guile and deceit. Now that the general public is starting to appreciate the value of their personal data, perhaps we'll see a rebalancing of the market.
- pothibo 13y ago
  I believe you missed my point. Most people outside the tech world have no idea who Edward Snowden is and what exactly happened with the NSA scandal. Computers are just a black box to them with something magical happening underneath (I'm not kidding here). If they don't understand what they are using, how can they understand the tradeoff between something free vs something they pay for?
  - oskarth 13y ago
    Are you sure about your first statement? Everyone in my family knows about Snowden. And not because I told them. None of them are even remotely close to the tech world. I'm from Sweden.
    - hawkw 13y ago
      Ah yes, Sweden. A place where there is no technology. At all.
  - wes-exp 13y ago
    The idea that only technology nerds are aware of the NSA scandal is plainly untrue. Right now many members of Congress are upset, and even the President himself has had to provide a response on the issue. This has become front page news that any ordinary person can see as he walks past the newspaper stand.

Sagat 13y ago

I think it's better to avoid encryption unless it's for really sensitive information or knowledge that could hurt you if broadcast. Using Tor or Truecrypt essentially paints a target on your back: you are paradoxically more likely to be under surveillance by agencies if you use them, even if you aren't concealing anything illegal or reprehensible.

delinka 13y ago
"Using Tor or Truecrypt essentially paints a target on your back: you are paradoxically more likely to be under surveillance by agencies if you use them..." "Paradoxically" you say. I don't think there's a paradox here. I think it's far too rare that people use these tools to protect themselves, and therefore the surveillance community sees it as a potential flag worth investigating. Therefore, we should all use these tools, make them common place, and force them to learn to be efficient at their jobs tracking down actual risks.
alextingle 13y ago
Better yet to get everybody to use encryption, always.
- Sagat 13y ago
  I agree wholeheartedly, but that's like saying we should make everyone use condoms all the time to eliminate AIDS. A perfect solution that is unfortunately unfeasible.
  - Nursie 13y ago
    But in this case a smaller group of humans controls the implementation of software, so it's at least a little more feasible.

apas 13y ago

Oh. My. God. HN's comments quality is at an all-time low. Can't understand how many people miss (or ignore deliberately) the point and pedantically focus on semantics trying to prove a silly counter-point which doesn't add in the conversation.

Sprint 13y ago
Look at yourself.
- joefantastic 13y ago
  Better to martyr than ignore the elephant, no?
  - Sprint 13y ago
    Be a better community member and you will get down-vote rights.
    - nitid_name 13y ago
      How does that work, exactly?
      - czr80 13y ago
        If you have sufficient karma (500, last I knew) you can downvote comments.
    - joefantastic 13y ago
      Thanks for the tip. I had no idea that downvote rights even existed.

infocollector 13y ago

If you do value privacy, please do check us out https://register.blib.us https://register.blib.us (pre-alpha software, still being written. We are still looking for early adopters). BTW, we did double our pre-alpha users in the past one month!

theg2 13y ago
Alpha software and a username of "info collector"? Where do I sign up!?
- infocollector 13y ago
  Random usernames have a way of biting you back. Indeed I've been assigned to collect information from users, and what they want in Blib ( Did not think of the double meaning ). Just click "Register/Sign up" Button here: https://register.blib.us https://register.blib.us (Currently we only support @gmail addresses and use OpenID to authenticate). :( - I agree that was a bad choice - to pick Google as a provider. Beta should fix this.
Loughla 13y ago
Maybe I'm completely ignorant of the process, but what is the point of a (marketed as) completely private system that is automatically, and required to be linked to a google account?
- infocollector 13y ago
  Excuse us for being pre-alpha: (and using Google's OpenID): Its a demo of OpenID, which can be migrated to many other providers. In Beta, you should be able to login with 100 other providers, and forget about Google :)

DanBC 13y ago

> When I sign up for an email account I expect my emails to be private, between me and the people I exchange them. That's foolish. Ever since it was introduced people knew that email was not private. You should expect that everything you put anywhere is going to be read by spies. That's why spies exist; to gather information. You use that as part of your risk assessment. "Will I be sentenced to death or torture if this document is discovered?" "Will I go to jail if this document is discovered?" "Will my company lose business if this document is discovered?" "Will I be embarrassed if my terrible teen-angst poetry is found?" Then you decide how much effort you're going to use to hide the information, or the source of the information, or both. While it's right that governments shouldn't be wasting money slurping the data of everyone it's unlikely to be an argument that the public will win any time. And even when there are laws "They" will find a lawyer to tell them that what they're doing is legal, and no-one ever gets to take them through court to show that it isn't. Oversight fails. You should assume a well-funded government is reading everything[1] all the time. I suspect that makes more of a difference if you're in $Oppressive_Regime than in the US or UK. And if people really did care why would they dump so much stuff onto Facebook? [1] see the mistakes that people make with creating encryption products, and using those products, it's probably a good idea to assume you've made a mistake and this government can read everything even if you encrypt it.

amirmc 13y ago
> "You should expect that everything you put anywhere is going to be read by spies. That's why spies exist; to gather information" That's ridiculous. It seems like you're condoning mass-surveillance by saying "It's their job". Doesn't the government get to tell them what their job is and don't we get to tell our government what we think?
- night815 13y ago
  You make two assumptions: 1. all spies work for a government 2. government employees follow all the rules and guidelines. that is, they follow the law themselves.
- baddox 13y ago

decasteve 13y ago

Privacy is important. I had a hard time to articulate why but the Groklaw farewell (posted on HN recently) really hit it home for me. Re-read the quotes (in grey): http://www.groklaw.net/article.php?story=20130818120421175 http://www.groklaw.net/article.php?story=20130818120421175

jheriko 13y ago

this is the wrong way to look at the problem. the better statement is 'nobody should expect privacy (online)' where i would like to stress the brackets around online as much as i can if you take steps to ensure privacy you should probably realise that they are all futile in the face of someone making a targetted effort to break it... eavesdropping, espionage, noseyness - these are nothing new... see most of recorded history for examples.

legion050 13y ago

I expect privacy, yet anticipate privacy violations..