Well, no. There's a difference between the people who said, for many years, that GCHQ / NSA are monitoring all communications and the people who said that GCHQ / NSA are monitoring all their communications. People deny this, but there is a big difference between "collecting the content" and "collecting the content then grepping it for your contributions to that content".
> For the average person, the only choice right now is to carry on or not.
I am genuinely baffled by the responses to the snowdon "revelations". i) They're not new ii) They've been included in routine risk assessment for years.
What do you have that you want to protect, and who are you protecting it from? If you're protecting your teen-angst poetry from your classmates you can carry on as normal. If you're protecting a stash of images of child sexual abuse from law enforcement you need to continually assess your encryption and secrecy methods. If you're protecting plans to destroy America from a well funded government agency you need to worry about everything. But that's always been the case.
There are so many other, easier, attacks than a weakened pool of entropy so it's a shame that people are being distracted by this. Don't get me wrong, I don't like RdRand and I'd prefer it if it was open and transparent, but there's so many other weak steps that people could be fixing before they get to RdRand.
We have two recent demonstrations of why people should be concerned about this: McCarthyism and 9/11. Imagine McCarthy with access to years worth of stored electronic communications. But you got rid of that. Instead you got post-9/11 restrictions in the dark like the no-fly list. Imagine the post-9/11 attitudes to muslims escalating one step further. It takes very little before a lot of seemingly uninteresting stuff that nobody cares much about now is suddenly enough to ruin careers or relationships.
It takes very little before the impact of indiscretions online or on the phone can be used as a source to impose even more restrictions on you. Suddenly some people will get fewer job offers for example.
There are much worse possibilities. But these are just simple, straight forward escalations similar to episodes in the recent past.
For my own part, about 20 years ago I was politically active in a left wing political party where just a few years before mere membership was often sufficient that you'd get denied entry to the US. Despite the fact that membership lists were confidential and never released to outside sources.
But then again all officers of the party had known they'd been under extensive surveillance for many years (yet were considered crackpots for claiming so, until it was proven the Norwegian security services had engaged in extensive illegal surveillance, including against a left wing member of parliament on the parliamentary commission investigating their violations while they were investigating them)
The groups that western intelligence organization target have shifted, but I'd be outright shocked if there are not perfectly legal, democratic organisations where membership would cause restrictions on your air travel and trigger additional surveillance without any evidence of even potential threats (some members of the party I was involved with at various points where shadowed on the way to and from work routinely, and "ran into" surveillance people that taunted them about private conversations they'd had in their own home...)
This is the flaw with the idea that you don't have anything to hide. Everyone has lots to hide - as much as it doesn't look that way, we all filter and none of us post everything in our lives on Facebook. We just don't think we have anything to hide because many haven't done anything they consider to be wrong or believes the current government will care about. Guess what? Most of the people targeted by Joseph McCarthy didn't think they had anything to hide either, and most didn't until his witch hunts started, yet many of them lost their jobs and got blacklisted.
This is the really scary thing about these NSA revelations: The surveillance is bad. But the storage of data over time is 10 times worse - it means the threat is not just abuse now, but abuse from the next government too, and we don't yet know whether that government will be better or worse in terms of how it might use or abuse that data, or if they might simply decide to extend storage periods further and put people at further risk of even later governments.
But still, I look at stories like these...
(http://www.courthousenews.com/2011/06/29/37770.htm) " Dayton police "mistook" a mentally handicapped teenager's speech impediment for "disrespect," so they Tasered, pepper-sprayed and beat him and called for backup from "upward of 20 police officers" after the boy rode his bicycle home to ask his mother for help"
(http://www.ajc.com/news/news/local/2-officers-out-of-jobs-in...) Woman calls police for help; is repeatedly tasered and pepper sprayed
(http://www.courthousenews.com/2010/06/24/28330.htm) 86 yr old bed-ridden woman tasered after pulling knife from under pillow
...and I wonder why Americans aren't vigorously campaigning for better law enforcement.
These aren't hypothetical abuses that might happen in future under a worse government. These are all actual examples of abusive law enforcement, that are affecting real people today.
Having your medical needs neglected until your penis rots off and you die of penile cancer (http://www.sandiegoreader.com/news/2008/dec/10/cover/) is barbaric.
Popehat has all of these here: (http://www.popehat.com/2012/05/02/citizen-incredulity-and-la...)
> This is the flaw with the idea that you don't have anything to hide.
I'm not saying that people don't have anything to hide. I'm saying that even the people who do have something to hide have more important things to worry about than NSA slurping 3 days of content. (But not that the NSA slurping that content is acceptable, it isn't.)
Well, you say this as if actually doing any of these things would be necessary to end up on the hit-list of a future tyranny.
You yourself provide the clues that NSA surveillance is not necessary, however. Do you think everyone caught up in McCarthy's witchhunt was really a Communist? Stuff like storage of Internet data here would be a 'nice-to-have' for a future tyranny, but not at all a requirement.
The stuff that I do have to hide I don't let on the Internet unprotected, but it's because I don't trust the ISP or the web service that would hold the data, not because I'm worried about NSA.
Our modern deep-connected life is already a despot's wet dream, just ask Aaron Hernandez, who was caught completely without need for NSA involvement.
I do think you're 100% right with indefinite data storage being the concern. However if data storage of some form is implemented, it's probably way better (from a future dystopia POV) that they focus on retaining all-of-the-Internet for a short amount of time, rather than interesting-parts-of-the-Internet indefinitely.
I think perhaps you're suggesting separating the idea of information leakage from talking about those willing to exploit it. That's fine, but it's going to be really difficult to have a long technical conversation about things that might or might not happen without having any person/entity/organization to be doing them. It would be like telling a story without having characters in it. If I understand you correctly, you'd like this to be way too abstract to have much traction with anybody. By all means break out Alice and Bob and have a go at it. But I'm not sure I understand you.
I was also not trying to make a political point. I was simply trying to say that if you want to use the term "tinfoil hat people", then acknowledge that the term is a moving target based on a world of contextual information that keeps changing. That's all.
The key problem from all of this is the injection of distrust into the entire stack caused by state security. I'm not getting into the BTB and pipelining, this article is just a symptom of the problem. The entire technology stack is up for grabs, and authors are going to get a lot of mileage out of taking it apart.
So, to me, there are two questions here. 1) Can you demonstrate an attack that uses some weaknesses yet undetected by the average nerd? If so, that's news. 2) Can you speculate that with the resource of a nation-state, such an attack might be made? If so, to me that kind of qualifies as nerd gossip. It may turn out to be true, and it may just be a lot of hand-waving. Some people like this stuff. Some people don't. I never liked the hero-worship crap or the latest from famous author X, so if I had to choose from piles of crap I'd prefer this.
For the average person, the only choice right now is to carry on or not. That does not make the situation acceptable or tolerable, that's just how it is.
And I really like the word kerfuffle.