Security After the Death of Trust 162
An anonymous reader writes "Simon St. Laurent reviews the options in the wake of recent NSA revelations. 'Security has to reboot. What has passed for strong security until now is going to be considered only casual security going forward. As I put it last week, the damage that has become visible over the past few months means that we need to start planning for a computing world with minimal trust.'"
Minimal Trust: (Score:5, Insightful)
Shouldn't that have been the paradigm from the beginning if you really wanted security?
Just because you think a person or organization can mostly be trusted today, doesn't mean it will always be the case.
Re:What? (Score:5, Insightful)
We never really trusted our government.
The problem with elections is that the government always wins :(
Re:Minimal Trust: (Score:4, Insightful)
It has been available for a kind of long time. RFC 2440 for encrypted email was written in the 1990s, but people are really resistant to anything that might help their own privacy. I can't even get my friends to use "Off The Record" for secure IMing. They don't care that their IM is going unencrypted over the network, or at least not enough to spend 2 minutes to install it.
Yes nothing is perfect including this but encryption is a lot better than not. Endpoints (who you talk to) is still exposed but having your message contents hidden still seems like an improvement, but people won't do it even when it's easy and you prompt them to.
Re:Minimal Trust: (Score:5, Insightful)
Until you chat with a friend, make dirty terrorists jokes, and this friend is thought by the NSA to be a terrorist. You'll find yourself interrogated before you know it.
There are countless scenarios that may see you regret this carelessness.
Re:Minimal Trust: (Score:5, Insightful)
It has been available for a kind of long time. RFC 2440 for encrypted email was written in the 1990s, but people are really resistant to anything that might help their own privacy.
The problem is getting a critical mass of users to adopt encryption. And although it's largerly a matter of people either not caring, or not knowing enough to care, it's also a problem of not wanting to stand out in the crowd and risk getting singled out. My friends and I don't use e-mail encryption because, with so few other regular users of it, we would simply be marking ourselves for special attention from TLA's.
It's the kind of thing where a significant portion of the population - say 10% - needs to start using e-mail encryption simultaneously. And unfortunately, that's not likely to happen any time soon. I've said it before and I'll say it again: like sleight-of-hand in a magician's act, bread and circuses really do work to keep people distracted from what their leaders and masters are doing. Until enough of us pull our heads out of our popcorn bags, organize, and start engaging in the Internet's equivalent of 'passive resistance', the 1% and their minions are going to keep screwing us over.
Re:most people don't want to bother (Score:3, Insightful)
The screwy thing about that, is that it needs a plugin at all. This is ancient shit. For the last 15-20 years, most email clients have come ready to use pgp out of the box, but then you get to the high-profile (i.e. popular, because it comes with pre-installed consumer OSes) email clients, and they require people to search for plugins, in order to get basic 1990s-level tech. The problem used to mainly just be Apple Mail and MS Outlook (and then, sadly, Thunderbird, WTF) but then smartphones got popular, and the situation with today's smartphones is even worse, if that's possible. It's really pretty negligent for MS and Apple (and now Google) to be shipping out OSes with broken email by default. That means negative security by default. Shame on them.
Re:It wasn't a revelation (Score:5, Insightful)
Why would a government not take the effort to look into what people do on a daily basis when they have the technology .
To me it was also predictable, because I've read history books and noticed again and again that the most ruthless, sociopathic, often bloodthirsty control freaks are the ones who want power so badly that they'll do anything to achieve it. That's the nature of government. Public awareness and understanding is the only real thing holding it back. We have public apathy and ignorance because most people have been softened and made complacent by convenience and pointless indulgences (hundreds of channels of brain-dead horse-shit, news media controlled by 5 corporations all of which are cozy with government, public education for obedient workers and not for self-directed thinkers).
But that the government would want to spy on its people and would use technology in that manner, no that's not remotely surprising to anyone who understands the nature of governments and the people who most want to run them. What we need is a majority of people who comprehend this basic fact that has been repeatedly observed throughout history. The stakes are higher now, and become higher the more our tech advances. Our leaders have noted that bread and circuses works, that's because they actually do learn from history.
Trust is context- and stake-dependent (Score:5, Insightful)
I trust some people's knowledge and expertise in one domain, but not in another. Likewise, if I were a US citizen running an entirely legal US company I'd have not the slightest problem with trusting the NSA cloud with all my company data (if they had such a service). I trust AES with keeping my personal data unencryptable by crooks and criminals, but I probably wouldn't use AES to encrypt all my data if I were a member of the Chinese military. It really depends in the threat scenario and your goals. An unconditional discussion of trust is fruitless.
Re:Minimal Trust: (Score:4, Insightful)
If the NSA want to feel like idiots, they're free to do so.
A similar thing happened to a friend in Germany. And not, the German police didn't feel like idiots, and quite happily wrecked the guys life. If you have a gun, you never feel like an idiot. Instead you just pull the trigger on anybody who dares to snicker...
Re:Minimal Trust: (Score:5, Insightful)
For the rest, nobody cares
I do. I fucking care that I can't communicate without big brother leaning over my shoulder to make sure I'm a good citizen. It's fucked up. Even if they never used a single byte of the data, the act itself is fucked up. Besides that, laws change. Much more of your day to day life than you imagine is already illegal to some extent or another. With pervasive eavesdropping you're just one ticked off bureaucrat away from a prison sentence. And even if you yourself by some miracle live (an almost impossible) squeaky clean lifestyle, it's even less likely that your family and friends to as well.
Re:Minimal Trust: (Score:5, Insightful)
Yeah? What exactly do I need to be kept "safe" from? Are they going to send thugs round to interrogate me for flirting on Facebook?
"If you give me six lines written by the hand of the most honest of men, I will find something in them which will hang him." -Cardinal Richelieu
No I would imagine not. Any given person likely has little to fear from increased surveillance; most people's lives are uninteresting. But if someone is looking at you with the intent of finding wrongdoing, they will find it. Especially if they have a history to look back on.
The other issue is that these surveillance powers are being used against anyone the US government doesn't like, for whatever reason. Do you agree with everything the US government does and says? I'd guess not. Do you support the actions of people who are organizing to push back against those policies you disagree with? I'd imagine so. Well these surveillance (and detention) powers are being used against those groups who are fighting for what you believe in, whether you participate or not. So your interests are being indirectly harmed by these powers.
Re:Minimal Trust: (Score:4, Insightful)
I'm aware of that, but generally the worst that happens if they don't like you is that they'll stop you from legally entering the US. You have to be being a douchebag on a pretty epic scale before they start being able to justify rendition.
ORLY?
Do you think Khalid El-Masri [wikipedia.org] and Maher Arar [wikipedia.org] would agree? Or do you not have a Muslim sounding name, so you figure you'll be fine? First they came for the Muslims, something something...
Re:P2P crypto software (Score:4, Insightful)
That is the real problem. If all I do is work from my desktop then I can just use kmail and its fairly strong gpg support and I'm done. The problem is that I use many operating systems, including ChromeOS, so I need Android clients, web-based clients, etc. I've yet to see anybody write a really good web-based email client, and even the IMAP options are very limited if you want to use tag-based email management (as in Gmail).
I really don't want to use Gmail. Its identity management is broken on Android, it isn't good at threading, there is no way to use it with encryption, and it gives Google access to all my mail. The problem is that nobody has come up with an equivalent FOSS option. The best I can do is cobble together a bunch of stuff and still get an inferior product. I've yet to find a web-based MUA that handles keyboard shortcuts nearly as well as Gmail...
Re:Hardware (Score:4, Insightful)
Like Intel embedding 3g radios in the vPro processors [softpedia.com]? Putting trojan in FPGAs [dangerousprototypes.com]? If i can't walk to the next continent, why worry to start walking?
Do what you have at your hands, you can improve a lot your security in the points where you control. And let the rest of the world figure the missing pieces, with open source software you also have portability, when an alternative comes in that area (i.e. moving to ARM) you will be able to take a step forward. Just don't get too tied to a solution that you can't control.
Re:most people don't want to bother (Score:4, Insightful)
They don't care about the NSA because they "aren't doing anything wrong".
They are missing the experience of living in a police state, bless them. One of the reasons Germany is a little (not enough, but a little) less ignorant of this is that many of its citizens still remember the GDR and the Stasi.
Even risking to Gowdin this, but maybe it gets them thinking to tell them that the Jews in Germany also thought they didn't do anything wrong. The Nazis, on the other hand, were very happy that religious affiliation was on government record and were extremely efficient in rounding up all the Jews who, remember, didn't do anything wrong.