Hacker News Reader

Comment by fab13n | Hacker News Reader

What you say is true, but misses an important consideration: yesterday, only tinfoil hats believed they couldn't trust third-party companies with their privacy. Today, everyone knows that the only way to have privacy is to handle it personally, from their local computer.

The whole PRISM scheme worked because people supposed the government respected their privacy. Now that it's been proven false, I expect people to use local encryption schemes, were third parties can't give a key they don't have. I expect people to become careful about which certification authority signed their SSL key, and to use self-signed certificates whenever practical. Targeted spying will remain possible, but indiscriminate surveillance PRISM-style would become impractical.

Unless they know how to crack TLS, but we have no reason to believe this as of today.

View on HN

> Today, everyone knows that the only way to have privacy is to handle it personally, from their local computer.

I agree with you, but I think you have far too much faith in ordinary Americans. I invented some widely used anti-phishing technology, and I can tell you that spending a few months analyzing actual incidents where otherwise intelligent people did ridiculously unsafe things on the Internet will give you a new perspective on the tech savvy of the general population. Unless we (the tech community) make strong security both transparent to the user and enabled by default, the feds will be seeing everything they do. Sadly, most of them seem OK with that.

That's the great thing about software, especially Free software - all it takes is a handful of us to make systems where strong security is transparent and enabled by default and it will proliferate to all the regular people.

OK, I should have written "everyone that matters"; the point is to have a critical mass of expensive-to-eavesdrop communications, so that the NSA cannot routinely exploit much more than teenager gossips traded through Facebook.

Moreover, even if only the 10% best informed people use PRISM-proof communications, it's a safe bet that NSA's alleged targets (whatever the current definition of "terrorist" might be) are among them, so the argument that they're doing that to catch "terrorists" doesn't hold water anymore.

I believe the tech community is concerned about this, because it threatens the robustness of Internet. Today, nobody in the business can pretend with a straight face that top-level certification authorities are trustworthy; so I expect the next generation of security protocols, the successors of the (transparent and enabled by default) SSL, to treat governments as opponents.

I also believe that companies will change their security patterns, e.g. stop trusting American third parties such as Microsoft if they have competitors with political connections in Washington.

Define "everyone that matters"

Self signed certificates throw up all kinds of nasty "you're taking lots of risks" in browsers (if they're allowed at all). I would not expect that they will be more broadly used than before, particularly since installing a self-signed certificate locally is very hard to do for the average person.

And looping back to the tin-foil hatters, many of us have called into question why all browsers have, over time, decreased their support for self-signed certificates. There are modes wherein Firefox will not even offer the "proceed anyway" option [1]. Conspiracy theories abound, but the browsers' marginalization of self-signed certificates has always struck me as devious.

Yes, please do alert users that self-signed certificates are potentially sourced by nefarious organizations. But in most cases, they are used by small companies and individuals to simply encrypted content from trusted servers. So allow them to be permanently trusted.

Perhaps we will see an increase in interest in web-of-trust alternatives?

[1] https://bugzilla.mozilla.org/show_bug.cgi?id=435013

I don't see it follows. If anything, self-signed certs just make it easier for the NSA (or anyone else) to capture your traffic. Organizations should probably set up their own CA instead.

A CA outside the reach of the NSA would be really valuable right now. A free CA outside the reach of the NSA would save the world.

That's what we meant. IIRC you can't even use a self-signed certificate directly for authentication: you have to create your own self-signed root CA, then use it to sign you authentication certificate.

The point is, if what you do interest the US government, it can compel Verisign and the likes to betray your trust, so you shouldn't trust them. And what emerges progressively is that the threshold beyond which you're deemed "interesting" by US administrations is way lower than long believed.

If you're a company doing international business, you want to secure your strategic communications with your own root CA, not with that of a company who can't say no to the government.

You can, pretty trivially, import your private CA's public key into your keychain, and boom, no more warnings.

I do think that the average joe, doesn't know what a certificate or CA is, should be protected from automatically trusting an unknown CA.

Even on your local computer, it's probably a good idea to avoid operating systems that may be compromised by default. Also be careful about installing extra software, including browser plug-ins and addons. I am preaching to the converted though.

> it's probably a good idea to avoid operating systems that may be compromised by default.

It is if you're targeted. But then, if the US government is after you, you're already screwed anyway.

The point is to impede generalized surveillance of everyone without probable cause. Even if MS-Windows and OSX are bugged, which is almost certain, the NSA can't siphon all your data through your routers inconspicuously. It can only grab selected data from the computers of high-value targets, at a considerable cost, which is fine.

It's not about preventing states from surveilling legitimate suspects, it's about forcing them to respect the privacy of average joes, and limiting their control on the Internet as a whole.

>yesterday, only free thinkers believed they couldn't trust third-party companies with their privacy

fixed that for you

> Today, everyone knows that the only way to have privacy is to handle it personally, from their local computer.

My completely anecdotal experience is that when people want privacy, they're starting to avoid all manner of electronic communication.

Reply on news.ycombinator.com