News for hackers. Stuff that matters.
Re:My Privacy Plan by frisco on Sunday June 09, 2013 @06:29PM (#5850988)
I feel like this is a rather porous plan for privacy.

> 1. Sign up to relevant pressure groups

Ok, I like this one. No reason not to. Support the EFF.

> 2. Install HTTPS Everywhere

Since I believe that the NSA likely already have all of the relevant private keys, I'm not sure about this one. HTTPS is still better than no HTTPS, but don't overestimate it.

> 3. Install Adblock Plus

Yep ok. Making it harder to be tracked across the internet is good.

> 4. Review my browser use

Sure. Use Chrome + best practices.

> 5. Review web services I use and switch if necessary

Suddenly this appears: a catch-all "change everything I do on the internet". Stop using Facebook, Skype, Gmail, etc. Probably not going to happen. I'll come back to this in a second.

> 6. Download and Use Tor

Given my belief that the government is probably running enough nodes to reconstruct Tor identities, I'm not convinced that this helps much.

> 7. Use the Onion Browser on my mobile

See #6.

> 8. Run "host-proof" Web applications

This is an extension of #5. I like the idea, but this is hard. Startups like Ciphercloud and Social Fortress are ostensibly working on it; I look forward to when they're available. I imagine that if any significant percentage of people start using, say, Social Fortress on Facebook, Facebook will make it against the TOS.

I do think that the NSA has probably broken RSA. It's notable that they haven't approved it for securing classified data, despite the fact that it would significantly simplify the DOD's current pains around key distribution. This, of course, takes SSL with it, but importantly takes PGP, too. Running GPGMail on a desktop isn't enough.

###

My privacy plan will involve learning more about politics. Who are our representatives? What districts play disproportionate roles here? How are the oversight committees formed? Who's on them and why? What can we do to be involved? This is a much longer timescale play -- it's a lifetime of being involved, rather than a quick technological fix now. I'm not confusing a personal interest here with having influence -- I'm just one person, and not a high-profile one, and alone I won't have much impact. But, I don't believe that there's any substitute for a politically engaged constituency.

I don't believe that Washington is fundamentally corrupt or irreversibly damaged. In the Snowden video he spoke about how these decisions are viewed as policy and not law -- so a future president may decide to go off the deep end into despotism. But since it's still policy, there are systems for this. It's not ok to simply complain that the system will defend itself and there's nothing you can do. Apply the same mindset that drives you through the multiple brick walls that are a startup to changing Washington.

Re:My Privacy Plan by riquito on Sunday June 09, 2013 @06:48PM (#5851051)
>> 4. Review my browser use

> Sure. Use Chrome + best practices.

If you care about your privacy your best bet is Firefox, not Chrome

Re:My Privacy Plan by Trezoid on Sunday June 09, 2013 @07:25PM (#5851215)
I was thinking much the same thing. "Yeah, lets review our browser use, and then switch to the browser made by one of the companies pointed to in this whole mess.
Re:My Privacy Plan by magic_haze on Sunday June 09, 2013 @09:09PM (#5851650)
I think that's a completely simplistic and disingenuous statement. The Chrome team have done a _lot_ the last few years to strengthen security on the web. And you're forgetting that the main attack vectors these days are through plugins, not the core browser itself. Chrome's decision to bundle their own secure version of Flash (that actually updates without a hassle) has probably done more good for people's computers than anything else peddled by other companies recently.
Re:My Privacy Plan by noerps on Sunday June 09, 2013 @11:10PM (#5852090)
Last time I checked Chrome it wasn't possible to remove certificates from the store, has this changed yet?
Re:My Privacy Plan by _b8r0 on Sunday June 09, 2013 @07:06PM (#5851148)
> 5. Review web services I use and switch if necessary > Suddenly this appears: a catch-all "change everything I do on the internet". Stop using Facebook, Skype, Gmail, etc. Probably not going to happen. I'll come back to this in a second.

You say that, but having switched to DuckDuckGo[1] for the past few weeks I'm slowly but surely losing my reliance on Google for personal stuff. Sure, it's not as good as Google in terms of finding relevant results or having the rest of the ecosystem, but it's no worse than using the web a few years ago, which to me is good enough (and I make some pretty esoteric searches).

I'm looking further into moving away from the traditional Internet to something a bit more self-hosted and it looks possible.

Re:My Privacy Plan by yk on Sunday June 09, 2013 @10:14PM (#5851899)
The trick about using DDG is their !bang [1] notation, which you can use to pipe searches directly into the search of another site. ( At least for many large sites.) Especially, if you prefix your search with !g you will get the Google result page for that search. This is of course a privacy vs usability trade off, but Google still sees only a few searches. With this, I actually think that DDG beats Google as search engine, since quite often I want to just search Wikipedia (!w) or Stackexchange (!se) and in this cases DDG takes me directly to these sites.

[1]https://duckduckgo.com/bang.html

Re:My Privacy Plan by harlanlewis on Sunday June 09, 2013 @08:46PM (#5851540)
> [DuckDuckGo] not as good as Google in terms of finding relevant results or having the rest of the ecosystem, but it's no worse than using the web a few years ago

About a year or so ago I was using DuckDuckGo for every search, but after a couple months switched back after falling into the habit of following almost every DDG search with another one on Google to make sure I was getting the real results.

Frustratingly, where DDG failed most was on the generic stuff where I expected to find results on the bigger sites. Esoteric searches are harder to judge, as neither engine reliably presented what I'd consider high-confidence results on first query.

Re:My Privacy Plan by sneak on Sunday June 09, 2013 @08:40PM (#5851518)
> You say that, but having switched to DuckDuckGo[1] for the past few weeks I'm slowly but surely losing my reliance on Google for personal stuff.

Everyone you converse with via email still uses Gmail.

Game over.

Re:My Privacy Plan by AJ007 on Sunday June 09, 2013 @09:36PM (#5851765)
The mobile Onion Browser, as disclosed on their website and not app store description, has secure security shortcomings that make it at best worthless at worst dangerous.
Re:My Privacy Plan by Everlag on Sunday June 09, 2013 @07:23PM (#5851209)
Wait, in what world would RSA be able to be broken with current tech to the degree that the NSA can decode it fast enough to make it essentially plaintext?

I get the whole keeping it for later decryption bit but really, 4096 bit RSA is not going to be easily borked no matter what scale of computing power you throw at it.

Re:My Privacy Plan by frisco on Sunday June 09, 2013 @07:31PM (#5851251)
A quantum computer would generate private keys readily. Quantum computers are well within the accepted laws of physics and there are multiple companies working on them. None is believed to exist with sufficient power to find an RSA private key quickly today, but I'll just mention that the first conventional computers were invented in secret for breaking codes.
Re:My Privacy Plan by RachelF on Sunday June 09, 2013 @08:19PM (#5851432)
> use encryption at rest, e.g., encrypt your documents with > AES before you send them to Google Drive.

Syncdocs http://syncdocs.com does Google Drive encryption at rest with AES256, however, who knows if the NSA has already cracked AES?