Comment by smackay | Hacker News Reader

Comment by smackay | Hacker News Reader

Damned if they do, damned if they don't. It's really an impossible situation for the companies involved as their actions, as the comments so far state, will be viewed through the biases of the observer.

One way out, to appease the outrage over what happened, would be for a few CEOs to spill the beans on what took place at their organizations. But after they were carted away to jail the company would still be in the situation it was before. Another would be simply to shut up shop in the USA and move somewhere else - but where? It would need to be a county where the intelligence services did not have the capability - end of business. About the only realistic and probably credible response is not to sue but to put a lot of effort into supporting third-parties opposed to the situation such as the EFF. Then at least, despite what they were forced to do behind closed doors the company would at least have a visible position and be seen to be trying to getting of the handcuffs put on it by the government.

The tech industry needs to get over this underdog mentality. It dwarfs industries that people regularly claim somehow own the government (e.g. media industry).

If tech companies thought it was in their best interest, they could bury the DOJ in litigation for years and barely feel it in the pocket book. It happens all the time when it comes to other industries that have more balls.

Agreed. I'm always fascinated by how different industries punch above or below their weight in government.

The movie industry seems to more or less own half of Congress, and appears to be able to get industry-specific legislation created nearly at will. Yet total US movie industry revenue is in the neighborhood of $85 billion, which is about half of Apple all by itself, not even counting any of the many other valuable tech companies out there.

Calculate "total revenues"/"added value to society". The bigger this number, the more likely that the industry is heavily involved with the government.

Except for negative numbers, of course.

Because oil isn't valuable to society while internet advertising is very valuable.

I'm sure it was very tough for them, but this is why I wanted the tech companies to be allied against mass surveillance or censorship in all countries (if they thought getting revealed to the public would cause them to lose customers later). But instead some of them (cough Microsoft), would've much rather shut the door behind Google, in China for example, just for an extra percent in market share (which they never got).

If they would've started standing together on these issues, and get a lot more allies, they could've started to have a chance against the governments' demands for censorship, and try to win the public on their side, too. But no, instead they decided to backstab each other for a tiny piece of the market, thinking it's an "opportunity" to get rid of a competitor, rather than a long term catastrophe waiting to happen.

Not really.

How long would it take Google to implement key exchange with Web-of-trust using Google+ and enable encrypted email using open source clients?

Web companies could choose to blind the security state. or at least force the issue that they are compelled not to do so.

That's not viable. First, Google's business is built around data. Having unreadable emails kills half the features in Gmail as well as their targeted advertisements. No money and a less useful product means they go out of business (ignoring other products, of course, but I'm assuming you would advocate for similar models in those).

The other option is the government would just force them to bypass their own trust model to give them meaningful access, such as what happened with Lavabit.

I pay for some services from Google, presumably because you can't make enough ad money from free storage. Shouldn't I have the option to pay for secure storage and communication?

As for trust, there is no way you can trust cloud storage. You have to assume it's hostile, or that your data is crossing hostile territory to or from. The security model has to avoid trust, which is what I described: signed keys in a Web of trust, no CAs, and no closed-source clients.

Storage is a little different since there are some things you can reveal about files while keeping them private (filetype, size, last modified time) which are relevant to providers. Email is much more difficult, with the exception of the sender and the time there is very little information that can be provided from an encrypted email. That makes it harder to provide a feature-heavy client. You of course have the option for using something more light weight; Gmail does not have that option, it would be a completely different product and business model.

Using web of trust signed keys is all well and good for techies. How would Google possibly set that up for average folks in a way that they themselves could not circumvent? I certainly could not see my parents working with key pairs unless the vast majority of the work was done automatically.

If you had to compose your own email headers only "techies" could do it. There is nothing about secure communication that is harder, and their are examples of simple, secure systems.

Notes implemented secure messaging (except for that key escrow thing) that was as easy to use as any email client. Skype implemented ephemeral keys for real time communication that was VERY simple to use.

There is no excuse, and it will take less time than a lawsuit to provide customers with NSA-proof products.

Reply on news.ycombinator.com