TE
科技回声
首页24小时热榜最新最佳问答展示工作
GitHubTwitter
首页

科技回声

基于 Next.js 构建的科技新闻平台,提供全球科技新闻和讨论内容。

GitHubTwitter

首页

首页最新最佳问答展示工作

资源链接

HackerNews API原版 HackerNewsNext.js

© 2025 科技回声. 版权所有。

The sins of the 90s: Questioning a puzzling claim about mass surveillance

243 点作者 ibotty7 个月前

14 条评论

m4637 个月前
I think the social element is one of the roots of the problem.<p>Basically, people don&#x27;t understand privacy, and don&#x27;t see what is going on, so they don&#x27;t care about it. Additionally, most privacy intrusions are carefully combined with some reward or convenience, and that becomes the status quo.<p>This leads to the people who stand up to this being ridiculed as tinfoil hat types, or ignored as nonconformist.<p>everything after that is just a matter of time.
评论 #41982682 未加载
评论 #41977232 未加载
评论 #41983419 未加载
评论 #41979321 未加载
Lammy7 个月前
Downside of trading privacy for security: <i>anything</i> that makes a network connection creates metadata about you, and the metadata is the real danger for analyzing your social connections: <a href="https:&#x2F;&#x2F;kieranhealy.org&#x2F;blog&#x2F;archives&#x2F;2013&#x2F;06&#x2F;09&#x2F;using-metadata-to-find-paul-revere&#x2F;" rel="nofollow">https:&#x2F;&#x2F;kieranhealy.org&#x2F;blog&#x2F;archives&#x2F;2013&#x2F;06&#x2F;09&#x2F;using-metad...</a><p>The problem isn&#x27;t about the big corporations themselves but about the fact that <i>the network itself</i> is always listening and the systems the big corporations build tend to incentivize making as many metadata-leaking connections as possible, either in the name of advertising to you or in the name of Keeping You Safe™: <a href="https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;Five_Eyes" rel="nofollow">https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;Five_Eyes</a><p>Transparent WWW caching is one example of a pro-privacy setup that used to be possible and is no longer feasible due to pervasive TLS. I used to have this kind of setup in the late 2000s when I had a restrictive Comcast data cap. I had a FreeBSD gateway machine and had PF tied in to Squid so every HTTP request got cached on my edge and didn&#x27;t hit the WAN at all if I reloaded the page or sent the link to a roommate. It&#x27;s still technically possible if one can trust their own CA on every machine on their network, but in the age of unlimited data who would bother?<p>Other example: the Mac I&#x27;m typing this on phones home every app I open in the name of “““protecting””” me from malware. Everyone found this out the hard way in November 2020 and the only result was to encrypt the OCSP check in later versions. Later versions also exempt Apple-signed binaries from filters like Little Snitch so it&#x27;s now even harder to block. Sending those requests at all effectively gives interested parties the ability to run a “Hey Siri, make a list of every American who has used Tor Browser” type of analysis if they wanted to: <a href="https:&#x2F;&#x2F;lapcatsoftware.com&#x2F;articles&#x2F;ocsp-privacy.html" rel="nofollow">https:&#x2F;&#x2F;lapcatsoftware.com&#x2F;articles&#x2F;ocsp-privacy.html</a>
评论 #41976066 未加载
评论 #41976074 未加载
评论 #41996297 未加载
评论 #41973923 未加载
评论 #41974775 未加载
评论 #41974035 未加载
tptacek6 个月前
I think I agree with Bernstein that the talk is mostly incoherent about this &quot;privacy&quot; vs. &quot;security&quot; tradeoff.<p>However, I do want to call out his &quot;Amazon was doing good business before 1999 and the end of the crypto wars&quot;, and &quot;companies allocate just a small fraction of their security spend to cryptography&quot;:<p>* Prior to the end of export controls, Amazon was <i>still doing</i> SOTA cryptography<p>* Export controls themselves boiled down to clicking a link affirming you were an American, and then getting the strong-cryptography version of whatever it was you wanted; there were no teeth to them (at least not in software products)<p>* Prior to the widespread deployment of cryptography and, especially, of SSH, we had <i>backbone-scale</i> sniffing&#x2F;harvesting attacks; at one point, someone managed to get solsniff.c running on some pinch point in Sprint and collected tens of thousands of logins. Lack of cryptographic protection was meaningful then in a way it isn&#x27;t now because everything is encrypted.
评论 #41988018 未加载
g-b-r7 个月前
Aside from everything else, I don&#x27;t understand what Whittaker&#x27;s point was; she seemed to ultimately be advocating for something, but I can&#x27;t understand what, exactly.<p>It&#x27;s probably in the talk&#x27;s last sentences:<p>&gt; We want not only the right to deploy e2ee and privacy-preserving tech, but the power to make determinations about how, and for whom, our computational infrastructures work. This is the path to privacy, and to actual tech accountability. And we should accept nothing less.<p>But who are &quot;we&quot; and &quot;whom&quot;, and what &quot;computational infrastructure&quot; is she referring to?
评论 #41974863 未加载
评论 #41987850 未加载
singron7 个月前
I think this article isn&#x27;t considering wifi. Most early sites were pressured into using SSL because you could steal someone&#x27;s session cookie on public wifi.<p>Without cryptography, all wifi is public, and in dense areas, you would be able to steal so many cookies without having to actually get suspiciously close to anything.<p>I&#x27;m guessing without crypto, we would only access financial systems using hard lines, and wifi wouldn&#x27;t be nearly as popular. Mobile data probably wouldn&#x27;t have taken off since it wouldn&#x27;t have been useful for commerce.
评论 #41976577 未加载
hobs7 个月前
In a nutshell I dont think we would have seen much change - corporations only engage in security insofar as much as they are required to - we&#x27;ve seen that even in this &quot;metastatic SSL enabled growth&quot; we&#x27;ve basically sold out security to the lowest common denominator, and core actors in the industry just use these security features as a fig leaf to pretend they give a single crap.<p>Now, would CERTAIN industries exist without strong cryptography? Maybe not, but commerce doesn&#x27;t really care about privacy in most cases, it cares about money changing hands.
评论 #41973125 未加载
评论 #41974506 未加载
anovikov7 个月前
How could that be relevant for more than a few more years? The world does not end with the US. Regardless of the ban, strong crypto would have been developed elsewhere, as open source, and proliferated to the point of making continuation of the ban impossible: by ~2005 or earlier, it will be either US closing off from global Internet becoming a digital North Korea of a sort, or allowing strong crypto.
评论 #41979410 未加载
评论 #41973968 未加载
belorn6 个月前
According to a talk by Eben Moglen (<a href="https:&#x2F;&#x2F;softwarefreedom.org&#x2F;events&#x2F;2012&#x2F;Moglen-rePublica-Berlin&#x2F;transcript.html" rel="nofollow">https:&#x2F;&#x2F;softwarefreedom.org&#x2F;events&#x2F;2012&#x2F;Moglen-rePublica-Ber...</a>), the noted connection between strong encryption and mass surveillance was a policy change by the US government. Before 2001, the policy was to repress and delay strong encryption and keep out of the public sector in order to maintain the states ability to monitor communication. After 2001 the policy changed towards mass surveillance strategies, which methods we got some insight into by the many leaks that was released a decade late by people like Snowden.<p>The connection is interesting, but the key word that I find important is the word policy. Mass surveillance is generally not a technology problem, it is a policy problem. If the government want to surveil every citizens movement they can put a camera on every street, regulate that every car has a gps and network connection that report their movements, have face recognition on every train and bus, and require government ID to buy a ticket that get sent to a government database. When the price of mass surveillance went down, the question of using it became a policy question.
cryptonector6 个月前
&gt; Meredith Whittaker, president of the Signal Foundation, gave an interesting talk at NDSS 2024 titled &quot;AI, Encryption, and the Sins of the 90s&quot;.<p>The lame claim that DJB is tearing to shreds in TFA is quite shocking coming from a senior manager at an institution that works on strong crypto. Really shocking. Is she just clueless?
评论 #42005037 未加载
WaitWaitWha7 个月前
One key part is that the crypto wars were around <i>export</i>, lest we forget &quot;PGP Source Code and Internals&quot;.<p>If there was no international business, <i>any-strength</i> crypto would have been and could have been used.
评论 #41973423 未加载
评论 #41977331 未加载
convivialdingo7 个月前
I used to work with the guy who was named by DJB in the crypto export case which removed the restrictions. IIRC, the NSA guy used to be his student!
ForHackernews7 个月前
I haven&#x27;t seen the talk, but it sounds plausible to me: Technical people got strong crypto so they didn&#x27;t worry about legislating for privacy.<p>We still have this blind spot today: Google and Apple talk about security and privacy, but what they mean by those terms is making it so only they get your data.
评论 #41973590 未加载
RamAMM7 个月前
The missed opportunity was to provide privacy protection before everyone stepped into the spotlight. The limitations on RSA key sizes etc (symmetric key lengths, 3DES limits) did not materially affect the outcomes as we can see today. What did happen is that regulation was passed to allow 13 year olds to participate online much to the detriment of our society. What did happen was that business including credit agencies leaked ludicrous amounts of PII with no real harm to the bottom lines of these entities. The GOP themselves leaked the name, SSN, sex, and religion of over a hundred million US voters again with no harm to the leaking entity.<p>We didn&#x27;t go wrong in limiting export encryption strength to the evil 7, and we didn&#x27;t go wrong in loosening encryption export restrictions. We entirely missed the boat on what matters by failing to define and protect the privacy rights of individuals until nearly all that mattered was publicly available to bad actors through negligence. This is part of the human propensity to prioritize today over tomorrow.
评论 #41973455 未加载
ikmckenz7 个月前
This is a good article, and throughly debunks the proposed tradeoff between fighting corporate vs government surveillance. It seems to me that the people who concentrate primarily on corporate surveillance primarily want government solutions (privacy regulations, for example), and eventually get it in their heads that the NSA are their friends.