There are a few schools of thought on where responsibility should lie in protecting user privacy. The first that it is a role of government and policy - in the same way the government sets standards for automobile and road safety they can set and enforce policies for user privacy.
The second school of thought is individual responsibility. Users should take steps to protect their own privacy on a case-by-case basis, in the same way they look after their own home security or personal safety.
The third would be a hybrid approach - that there is a role for the government to play in setting up a universal minimum level of privacy protection while users also have a role to play in their own protection. This is most akin to how healthcare works - i'm guaranteed treatment in an emergency room but I also might choose to keep myself healthy with diet, exercise etc.
I personally believe in user responsibility for personal privacy and security, where you can't and shouldn't depend on policy to protect you and that all users should be aware of the issues and actively educated on how to protect themselves. For a few reasons:
1. Policy is not universal. Some countries may have extensive and rigorous user privacy protections but that doesn't apply to users everywhere. While user privacy protections are strong in Europe, and consumers have access to recourse if they're privacy rights have been violated, that same advice doesn't apply to the majority of internet users, most of whom are residents of a nation or jurisdiction where there is no strong protection or user recourse.
2. Governments are a major party in privacy violations and are conflicted, so they can't be expected to behave in the interest of users. The most recent campaigns to roll out encrypted communications and connections in apps was prompted by the US government intercepting internal Google data. The government will almost always be incentivized to lower barriers to ease intelligence gathering and in most of the world government surveillance trumps individual rights.
3. Similarly, government can't be trusted. This is the point Ed Snowden made when he argued for individual and tech solutions to privacy over government policy[0]. Snowden cites the difference in Obama's campaign promises and what he delivered[1], and this isn't unique to Obama - the FCC ISP privacy rules being blocked this week is yet another example of how easily and quickly policy can be undone, while the mass surveillance Snowden disclosed is an example of how public policy and private actions can be different.
4. Tech solutions to privacy doesn't imply individual responsibility. We can, and do have, tech solutions that are universal - such as the campaign to roll out encrypted communications and connections with Whisper and LetsEncrypt.
5. Policing government policy is labour intensive and difficult. It relies on privacy researchers - usually individuals - to track what companies are doing with user data. With more data being shared between companies it is even more difficult to apply individual oversight to how policies are being enforced. See Natasha Singer's reporting in the NYTimes on data brokers[2]
6. There are usually very minor enforcement penalties for companies that violate user privacy policy. The FCC tracking opt-in rules were prompted by some ISPs adding tracking headers or cookies to user traffic. AT&T and Verizon were adding tracking cookies to user traffic and it took two years to notice, and there were zero implications for both companies[3] other than the new FCC rules which are now dead.
7. Even in the perfect world of good policy, good application of policy and good enforcement you still have more data than ever being stolen and leaked online. You only have to look yourself up on haveibeenpwnd or a similar database to find that for a lot of people, all of their PII has already leaked[4]
It is very clear to me that technology solutions have the primary role in protecting user privacy. Policy isn't a waste of time but it can't be relied upon. The question is how user privacy protection is packaged for a mass-audience. User privacy requires an equivalent of what 'use WhatsApp, use Signal' is for user security, what 'install antivirus, don't click on attachments' used to be for user security and the growing popularity and awareness of ad blockers.
I'm not sure what that will be or what it will look like, but warning people away from VPN's probably isn't going to help. Chances are that some form of VPN connection will become part of the standard solution (along with HTTPS/encrypted comms everywhere) now that the reality of ISPs and users not sharing privacy interests is here and many are aware of it.
Theres a great market opportunity here - perhaps not for VPNs as a product but VPN as a technology.
> The second school of thought is individual responsibility. Users should take steps to protect their own privacy on a case-by-case basis, in the same way they look after their own home security or personal safety.
I think this is a bullshit argument. Nobody looks after their home security or personal security the way we expect users to be careful of their privacy, nor do we accept the amount of intrusions into our house or personal space as we are told is reasonable in information.
Imagine you could get a free pizza every week, you just need to let the driver go through your house and correspondence. Imagine if you had to sign over the risk that your house might be burgled if you signed up for a bank account...And the police didn't act on it.
These examples seem ludicrous, but that is not because I'm making them like this, it's because the premise that we all do "personal responsibility" is a myth.
We have police, laws, community rules, all of these things to protect our houses and personal security. If you leave the door unlocked, robbing it is still a crime. Likewise, if you walk around on an unsafe neighbourhood and get robbed, it would be ludicrous to hear "well, the city warned you that part is unsafe, so the police isn't going to investigate"
> We have police, laws, community rules, all of these things to protect our houses and personal security. If you leave the door unlocked, robbing it is still a crime. Likewise, if you walk around on an unsafe neighbourhood and get robbed, it would be ludicrous to hear "well, the city warned you that part is unsafe, so the police isn't going to investigate"
The irony of this statement is that this actually happens quite often in certain east of the track neighborhoods, especially when the victim is a minority. It goes to show that this attitude, while I don't agree with it, isn't so far from the reality as you might think.
Coming from out west, this is one of the cultural reasons I am pro-gun. The police are just there to draw the chalk line around your body, it is your responsibility to defend yourself, your loved ones, and your home.
Always remember that the constitution was created to protect, not establish rights, rights that you have independent of the constitution itself, and of these rights, the right to self defense is one. The second amendment is simply about defense against tyranny. Even if you got rid of the second amendment I still have the right to bear arms.
Which makes me wonder, how well could the right to self defense argument be applied to encryption?
It's almost like everyone forgot about the 90's crypto wars, but it makes me think of something Eben Moglen said about the 90's crypto wars being just a temporary setback to TPTB;
This might be very cultural thing(I'm from Europe). But unless you want to live in a society dominated by warlords and gangs, laws and society is the better way imo. Again my opinion, but for me the gun defense is a myth perpetuated in the US for ideological reasons. Keep your guns,but they won't keep you safe against a gang which will just shiv you at night, or simply outgun you. The reason all civilisations of a certain density have centralised law enforcement is it's simply inefficient for everyone to defend themselves (think narco states: sure, you can hire a guard, but your neighbour also has to hire one. If you try to start a neighbourhood guard cooperation then you are one step towards government and police)
And coming from Europe, we create new rights all the time
Agreed. Parent's analogy only works in a world where breaking and entering was legal, and it was everyone's personal responsibility to defend their home.
We live in a world where breaking and entering is possible, and the police may only come after the fact, and might not come at all — it is everyone's personal responsibility to defend his home. Likewise, we live in a world where violating one's privacy is possible, which means it is probable, and thus it is everyone's personal responsibility to defend his privacy.
What do you think would have more of an impact on the security of your home: repealing the laws against breaking & entering, or removing the lock from your door?
It's naive to think of oneself as strong enough to self-protecting. I know there's a certain appeal in the lone wolf myth that speaks to the (mostly male) psyche. But never in the history of mankind has it been the winning strategy to be strong and independent.
Since we were apes in trees, our security has relied entirely on a strong net of social bonds. Cooperation is the strongest force multiplier, and no matter how many guns you have, you wouldn't have chance against even against a small group. Laws are nothing but a formal manifestation of group behaviour.
Then, there's the attacker-defender asymmetry: defending yourself means defending yourself 100% of the time. There is no middle-class home in the US that I couldn't get into if I really wanted, nor are there any non-famous people that I couldn't kill with a bit of dedication.
It wouldn't be possible to protect against such threads without the rule of law. And even if it were, it would amount to a giant collective waste of resources. Personally, I also don't want to think of any stranger as a thread, but that's what it would require.
> What do you think would have more of an impact on the security of your home: repealing the laws against breaking & entering, or removing the lock from your door?
Honestly, the latter. I don't believe laws prevent thieves from breaking in, nor do they keep honest people honest. I don't really buy the deterrent theory of law in general, anyway: law exists to punish in a civil and orderly fashion, not to deter.
This is ridiculous nonsense (although living in the West of the US myself, I know a few people who have this mentality). We just don't live in a world where the fact that nobody is robbing you blind is entirely due to fear that you'll shoot them. That's pure fantasy. They're not robbing you blind due to things like : they have jobs and are gainfully employed doing something more profitable than robbing people; they'd (eventually) be caught and sent to jail; and so on..
> We have police, laws, community rules, all of these things to protect our houses and personal security. If you leave the door unlocked, robbing it is still a crime. Likewise, if you walk around on an unsafe neighbourhood and get robbed, it would be ludicrous to hear "well, the city warned you that part is unsafe, so the police isn't going to investigate"
Agreed, and it still amazes me how these advertisers and startups can simply hand-wave away any responsibility for any compromising data about you ending up in the wrong hands with a simple shrug.
This policy fight isn't a fight to regulate the market (like the automobile regulations you mentioned). It's a fight for a fundamental right to privacy. Any technology improvement that can protect privacy can be made illegal, and enforced by a boot on the face (see China).
If the government makes encryption without government key escrow illegal (not at all outlandish, has been discussed in many countries), will you personally, nikcub, continue to use encryption without key escrow? If you are willing to risk imprisonment to do so, you are among the bravest people. It is a small group.
The policy fight is massively more important than the tech. A tech that takes 100 years to develop can be made illegal in a day.
If everyone starts using VPNs, ISPs will ban them. There might be some game of cat and mouse, but eventually the same lobbyists that lobbied to remove these privacy rules are going to lobby to take some of tech options off the table.
Many don't consider this to be a fundamental right.
> A tech that takes 100 years to develop can be made illegal in a day.
As the recorded history goes, I think it was always the other way around - a new technological development suddenly invalidating a set of laws, and lawmakers playing catch-up with its use.
I wish governments of the world got their collective shit together so we could have sane privacy laws, but as it is now, technology is an important leverage to push the policymakers in the right direction. Maybe you can't focus 100% on it, but it would be foolish to just ignore it. It's the single most powerful tool we have here.
I partially agree with your points, but I still insist the policy fight is more pressing, because the tech is only possible to use with the right policy.
If the US and Europe change to be like China, all that tech is worthless because the spooks can come knock down your door if they suspect you're "hiding something."
In physical world we differentiate between public and private spaces, with different expectations of privacy in each of them. There's a debate to be had about appropriate demarkations on the Internet.
Where I walk and what I do on the street is private even though it's in a public space (exceptions apply). Similarly what I do and where I go on the internet is private even though it is a public space (exceptions apply).
If someone follows me in the street for hours (days, weeks, life) and note everything that I do, I'd be right to call that a violation of my privacy ?
And many do. The right is enshrined in several of the amendments to the U.S. Constitution, as well as the Universal Declaration of Human Rights:
No one shall be subjected to arbitrary interference with his privacy, family, home or correspondence, nor to attacks upon his honor and reputation. Everyone has the right to the protection of the law against such interference or attacks.
There is Warren and Brandeis, "The Right to Privacy", 1890, which specifically addresses the publication of private aspects of citizens' (and residents') lives:
* Recent inventions and business methods call attention to the next step which must be taken for the protection of the person, and for securing to the individual what Judge Cooley calls the right "to be let alone" [10] Instantaneous photographs and newspaper enterprise have invaded the sacred precincts of private and domestic life; and numerous mechanical devices threaten to make good the prediction that "what is whispered in the closet shall be proclaimed from the house-tops." For years there has been a feeling that the law must afford some remedy for the unauthorized circulation of portraits of private persons;[11] and the evil of invasion of privacy by the newspapers, long keenly felt, has been but recently discussed by an able writer.[12] The alleged facts of a somewhat notorious case brought before an inferior tribunal in New York a few months ago,[13] directly involved the consideration of the right of circulating portraits; and the question whether our law will recognize and protect the right to privacy in this and in other respects must soon come before our courts for consideration.*
> It's a fight for a fundamental right to privacy.
Where did this right come from? and since when is this a thing? Don't mean to be condescending but "the right to privacy" isn't really a thing in this particular domain (legally speaking)
Sticking to a Western context, this is a pretty fundamental distinction between the US and the EU in the understanding (and, crucially, in the implementation/enforcement) of human rights.
I can't pretend to do justice to the long history of the concept, but we can at least say that for the latter, privacy has been considered an important human right since at least the UN declaration of 1948. This has been carried over into European law, see all the iterations on EU data protection laws. The UN statement is Article 12: "No one shall be subjected to arbitrary interference with his privacy, family, home or correspondence, nor to attacks upon his honour and reputation. Everyone has the right to the protection of the law against such interference or attacks."
For the US, this dimension of human rights did not deeply inform policy. Here discussion around a "right to privacy" really began in a different context with Brandeis and a right to be "left alone", largely meaning from the press. Many of the cases that inform privacy law in the US are oriented towards such scenarios and do not necessarily translate well to the context of data. See http://groups.csail.mit.edu/mac/classes/6.805/articles/priva.... There is rather a discussion on the accuracy of financial data about a person that stems from credit reporting.
The other area that would have to be discussed is of course wire-tapping laws, but leave that for another day... In sum, the question of a "right to privacy" has a long tangled history even just within the West, but is decidedly a thing in the EU.
Fair point. I certainly don't believe in natural law. I don't think we should fight for a right to privacy because it's inhenrently owed to us by the universe or some such.
I think we should fight for it because I think it makes life better and because I don't want to live under an oppressive government.
I really don't understand this line of logic on fundamental rights. If you're referring to the UDHR, it's a piece of paper put together by Eleanor Roosevelt a little over half a century ago. It's a human document of arbitrary concepts put together by people who believed enforcing those would improve the world in aggregate.
The idea of basing our sense of right on what is law, rather than basing the laws we write on our sense of right seems to be bafflingly common.
Re your final sentence, there's a possible third option (though your second has merits): coming up with both rules (law) and guidance (rights, ethics, morality) based on what improves the overall common weal.
Hrm. I'm wondering now if there's a possible ethical case for actions which don't improve the common weal. Or how to resolve conflicts between short-term present vs. long-term future outcomes, or other conflicts -- say, you classic Trolley Problem.
I also wanted to note that your dismissal of Fundamental Rights is a good point. I'm finding far more agreement with the Pragmatists (Dewey, James, etc.) than various Natural / Fundamental Rightists. If only because any idiot can jump up and claim "This is My Fundamental Right" and ... all rational discussion stops.
> The second school of thought is individual responsibility. Users should take steps to protect their own privacy on a case-by-case basis, in the same way they look after their own home security or personal safety.
> I personally believe in user responsibility for personal privacy and security, where you can't and shouldn't depend on policy to protect you and that all users should be aware of the issues and actively educated on how to protect themselves.
The problem is that while home security and personal security is something everyone understands on a basic level, the impact of personal information being public or being available to others is not.
Many people believe that whether other people, companies or government agencies or advertisers know some details about their private life doesn't matter much, but many don't understand the potential impact. Perhaps insurance policies go up inexplicably because you googled backache or headache remedies a few times. Perhaps certain political affiliation or opinions can be outlawed and put you on watch lists in the future (think of the McCarthy era in the US).
Many people also don't realize how much information can be derived from your network traffic, even if it is not explicitly present in the data itself.
Educating people on this kind of complexity and nuance is much more complicated than explaining what a fence does, or how curtains work. It would be expensive and hard, and many people won't understand the need for it anyway.
The other problem is that most peoples' home security is not effective against anything except casual intrusions (i.e. drunk people accidentally entering the wrong house).
'use WhatsApp, use Signal' ... warning people away from VPN's probably isn't going to help.
When you put it that way, I think we should warn people away from "VPN" just like we (now) warn people against "military-grade encryption" because that term is more likely to indicate snake oil than working privacy. So there needs to be a brand like Signal that delivers what VPNs promised.
Some VPNs do deliver what they say. They proxy your traffic, and they don't keep logs. Some, such as AirVPN and IVPN, have changed jurisdiction to protect user privacy. PIA has demonstrated in court that it doesn't keep logs.
While I disagree with you in many particulars, I'm grateful for the depth of this comment.
Regarding VPNs, one issue that I'm sure you're aware of but didn't discuss, is that VPNs aren't really a technical privacy solution. Rather, they're a technical solution for moving your privacy concerns from one policy jurisdiction to another that you see as more favorable. That can be private policy (your VPN provider has a better privacy policy than your ISP), or public policy (the Netherlands have better privacy policy than the US). But the policy issues still matter. If every government had a dystopian privacy policy, and enforced it on all of their ISPs and VPN providers, then a VPN would be useless.
VPNs aren't really a technical privacy solution. Rather, they're a technical solution for moving your privacy concerns from one policy jurisdiction to another that you see as more favorable.
Now that is a very insightful and illuminating observation.
> Users should take steps to protect their own privacy on a case-by-case basis, in the same way they look after their own home security or personal safety.
While I agree with your point, home and personal safety are completely broken analogies for this problem. They are regulated heavily by policy (criminal law) and violations enforced by the government (law enforcement).
This is an important difference. Home locks are trivial to pick for even novices, yet we continue using the same locks. Why? Why isn't there an arms race between lock manufacturers/homeowners and burglars? Because there is external enforcement: if your house is locked, even weakly, that is signaling your intent to prevent access and opens a burglar to legal ramifications if they pick it and enter, regardless of how easy it is.
"Everyone is responsible for their own security" is a wild-west fantasy land that we don't live in. And just because you take actions to increase your personal security farther than normal (e.g. guns, dogs, better locks, etc) doesn't mean you get to put fingers in your ears yelling "lalalala" and pretend externally provided security doesn't exist.
Perhaps I should clarify that I am not discouraging the use of VPNs, but I am encouraging more involvement in the policy process. Indirectly, I guess I am encouraging a better understanding about the intricacies of VPN services.
A hybrid approach as you suggest seems agreeable to me.
Lots of people seem to think the right answer is selling improved security. I disagree. It would be much more exiting to get the data coming from politicians homes, and the homes of their staff. It would be a fantastic way to generate news. Why is senator X's household researching cancer treatment? Will they step down this year? I can't help but think military bases would google their next deployment, that's another set of huge news articles.
If you're more into the finance side of things, CXO's home clickstreams would probably be enlightening. Or hedge fund managers. Some will be fully encrypted and secure, but just the dns would be a strong signal about what companies they're researching.
That is the kind of business that will drive privacy legislation.
I think you overestimate the average politician. They may not bother with the internet. I'm confident Senator Lamar does not.
But really, i don't think it would take very long to figure out where he and his staff in DC and in Tennessee live. I don't know what the data purchase rates are, so that could be expensive. But buy the data for a bunch of neighborhoods. Perhaps 50,000 people. watch the data for a while, query strings with Lamar would be good indicators.
Heck, make some really finely targeted ads on Facebook.
I think the reality is most news sourced this way would be super tabloidish. i mean, you're going to figure out what porn they look at faster than what policy they're developing.
I think you're onto something. I also think this falls into investigative journalism - which used to be able to drum up funds for that sort of cost.
There are all sorts of problems like this. What could you learn from the browsing history of people that work in sensitive areas? i.e. nuclear facilities, national labs, financial/industry regulators, etc. City and state representatives probably give away a lot through browsing. There's plenty of low lying fruit ripe for exploiting in huge ways.
Another avenue: merely knowing when someone is likely to browse the internet tells you:
-they're awake
-they're at home/indications of their location
-their level of awareness (think security workers or even prison guards)
Imagine being able to figure out the best time of day to hit a bank by browsing history? In an aggregate way you could probably figure out staffing (corporate level) or whether someone's home (residential level).
I've always liked the idea of using the copious public video of these politicians to train voice and face recognition NNs, specifically targeting anti-privacy politicians. Maybe even sell pre-made raspberry pis with all of this stuff preloaded for journalists to scatter around places that politicians congregate.
I think it's only fair that these folks get to be the first ones to live in the kind of world they are creating. And none of them should have a problem with any of this, because I'm certain none of them ever do anything wrong and therefore have nothing to hide.
Getting the information through their ISP may be too subtle. Just send them a FOIA request for the browser history. When they ask why or deny it, you can raise the question of why they want to keep their information private, but allow our information to be fair game.
This doesn't work. They will simply deny your request and say "no big deal". I mean, they're important people, of course you shouldn't see their private browsing information!
The big deal is when you drop a report full of embarrassing information you collected without their knowledge and they are powerless to stop it because of their own bill they passed.
If my ISP were to sell my data, how would they refer to me to the buyers? Would it be legal for them to use a cookie identifier in HTTP traffic they routed?
Well, pastebinning communication of a politician (or better - their kid) seems like such an effective idea, I wonder why this doesn't seem to happen? Is there a strong roadblock somewhere there? It's not like most politicians and their staff know much about Internet security.
A heads up: theres a really nice project called Streisand[1] which provides a multi-protocol VPN with very little effort. You can launch one on a cheap cloud provider (like DO, if their policy allows).
I've used streisand on DO (while traveling in China) and it worked well. There's also a similar project called algo[1] which provides a single protocol with maximum security, in contrast to streisand's multi-protocol flexibility (and increased surface area).
I think a recurrent concern is OpenVPN's reliance on TLS, and its codebase complexity as a result of being built on OpenSSL--but with far less attention and resources and vuln hunting compared to say, actual browsers. Complexity + lack of auditing person-hours is never a good combo. (See https://twitter.com/tqbf/status/806646188158152705)
Matt Green's audit of OpenVPN, when completed, may lead to more light on the matter. Otherwise, we're just relying on informed intuitions.
As a "security people" I think me and tptacek could split a great number of hairs and get not too far on this one, but I am open to new info. I know a lot can hide in the complexity of OpenSSL. Maybe the whole thing with IPSEC was to sway us toward OpenVPN likes. Regardless, I still lean slightly towards OpenVPN
But honestly I am out to defeat ad networks. I only aspire to give nation states indigestion (at a mass scale). Individually if a well funded adversary wants any one of us I think they have us.
Would a 512mb RAM DO server be enough for this? I've been looking for an alternative to a VPN for a while, but it would only be cost effective with the $5 option.
Yes. Your bottleneck will most likely be network and CPU speed as that's used for encryption. Google around for specific numbers, but my intuition is that network will max out before CPU does even on the $5/mo instance.
Why not run a utility that visits random websites to drown the signal from the noise? Imagine this thing running 24/7 and visiting all sorts of sites, including all sorts of porn and fetish sites or whatever is taboo in your culture. Now its impossible to see what I'm actually visiting and you'd be foolish to not realize that these are generated url visits. A bit like how people used to copy and paste 'NSA keywords' into their emails and web postings.
Not sure why anyone isn't proposing this. Far better than dealing with the hassle and performance issues with a VPN. Want my browsing data? Fine, how's 1 million URLs a day grab you?
I've had a few problems getting it running on AWS but setup was a breeze on GCE. So far it's been cheaper (and safer) than most VPN providers I've seen. YMMV
You would be better of putting it on a Digital Ocean and then create / destroy a droplet when you need it. It is what I do and my cost is like $1.50 per month (as opposed to $5).
The solution is getting strong, enforced laws that protect our privacy and punish those who break them.
But for the moment, with advertisers viewing themselves as gods gift to the internet who think that all your information belongs to them simply by virtue of existing, and who will go to great lengths to acquire and store it all (for perpetuity), a solution is needed, and part of that is VPN's.
Data you release can never be recovered. Even if we were to chuck out the entire House and reverse this change in 2018, VPNs would still be a key part of the solution. It would only take one medical search sold to insurers (as a random example) to seriously affect you, so I agree that downplaying technical defenses is unreasonable.
You can make holding and using that data highly intractable.
If there are blisteringly strong penalties to holding and trading in personal data, the incentives to do so will largely disappear. Unfortunately, statutory regimes, particularly in the United States, seem to be going in the opposite direction.
With the ability to seek out and purge disclosed data, at least some of the damage can be mitigated. Considering that there is far too much information for humans to ever process but a small portion of it, that might actually be sufficient -- we won't be needing the Men in Black eraser pens.
All fair points, though I specifically had individual defense in mind. I don't know any good way for an individual to restrain accurate data once it's released, so poisoning is the only option I see to dilute the value of it.
At least when thinking about individual defenses, I tend to treat the regulatory landscape as a lost cause - currently I'm just hoping that privacy tools won't be actively outlawed.
Information-related activities have far more in common with epidemiology -- and at all kinds of levels -- than pretty much anything else.
Whether it's concern of your data going out, or bad genetics patterns coming in, your best bet is to cut off the routes of transmission.
In a plague-infested land, it's practicing exceedingly good hygiene which is in your best interest. If that means walling yourself off from the rest of society for a few years (as one royal household in Europe did), so be it.
Keep in mind that the Black Death even eventually reached Iceland, though some years after it scorched over the rest of Europe (4-5 years as I recall).
There are domains of problems which are intrinsically personal. Though rather more which manifestly are not.
(Though you've also got me thinking about what equivalents to own information spreading out there are, epidemiologically.)
> (Though you've also got me thinking about what equivalents to own information spreading out there are, epidemiologically.)
This seems like a really good question, actually. The disease model of information is quite effective, at least in terms of ideas like herd immunity, transmission rates, quarantine, etc.
But at the "patient zero" level it's quite strange, with personal information being a thing you know you have and don't want to spread unintentionally. It definitely changes some things compared to the standard model, though I think you have a point that you can invert things fairly effectively (i.e. 'hygeine' is to avoid spreading info, instead of contracting it).
I also wish there was more good writing on information hazards, which follow the epidemiology model almost precisely. So much of what's out there descends into Cthulu references or 'fake news' rants, rather than looking at the actual metaphors for things like "herd immunity".
(Surely someone has written an ironic essay about "vaccinating against anti-vax ideas"?)
There is some public-health treatment of information spreading, though not a whole lot of it. I've been the source of some, though the ideas pre-date me considerably. You could go back to religious contexts, the concepts of apostasy and blasphemy, or even (per I.F. Stone) the Trial of Socrates, for prior art.
For information specifically, it's interesting in that there are at least three possible goals:
1. Restricting or combatting the spread of toxic information.
2. Encouraging the spread of useful or helpful information. There's a great deal of this under the rhubric of "diffusion of information".
3. Limiting, for socially beneficial or malevolent purposes, the spread of generally private information.
The first two instances have clear epidemiological and evolutionary cognates: limiting the spread of disease or disease agents (bacteria, viruses, prions, contaminants), or the process of evolutionary advance or propogation of fitness adaptations.
The question of concealment ... thinking through here, I'm coming up with concepts such as camoflage, mimickry, colour or shape-shifting (e.g., cuttlefish, octopus). There are bacteria and viruses which evolve or mutate rapidly making various antibodies or antibiotics less effective quickly (another element taken up by fake-news and propaganda sites -- one article I was reading yesterday noted how new most such outlets were, earlier pieces I've seen noted how new sites were emerging late in 2016 and growing to million+ daily user). I need to think more about that.
As for the antivax situation, I've pointed out that information campaigns to refute anti-vax ideas regarding the efficacy (and safety) of vaccines against viruses which attack DNA/RNA, are an information attack on an information attack on an information attack on an information attack on information.
Tangential point, I've heard from a friend how much you can earn by being involved in a "premium" ad network, and it's basically around 100x what I can make as a SWE freelancer. I also remember a HN user claiming they make $30k/month from a simple "YouTube downloader" kind of site.
Because you have much more choice for VPN providers than for ISPs. And you can change VPN periodically, far more easily than changing ISP. Also, you can use nested chains of VPNs, much like Tor, to distribute trust. So adversaries must compromise multiple providers, quickly enough that logs will be available.
Edit: Also, you can pick VPN providers outside your adversary's sphere of influence. That's standard advice for users in China, for example.
Also, you can pay for a VPN without revealing your identity. Not so with ISPs. I use a VPN, for instance, to mask my Tor usage from my ISP. (I'm an American using the Internet in the United States.)
True. But the VPN provider effectively knows who you are, because they see your IP address. Or rather, a resourceful adversary can get your IP address from the VPN provider, and then get your identity from your ISP.
If you chain VPNs, however, it certainly makes sense to lease the second/indirect VPN anonymously.
I don't think IP alone will not be sufficient, for ex i am sure my ISP extensibly NATs the network and shares the same IP for many users. So much so that Google keeps asking for captcha every couple of days
And now both of your vpn owners have your data connected to your ips. You do have more choice but if both of them sell the data, it doesn't make any difference.
Consider CMU's exploit of the "relay early" bug. They identified users and onion servers through compromised entry guards. So with one VPN, the adversary knows the VPN exit IP. If they have authority vs the VPN provider, they get your identity. But if you're using nested VPNs, they need to go after the next VPN provider. Six is probably overkill. Maybe three is too. But it works well enough, so why not?
I've lived places where my only ISP choice was Comcast. I trust them as little as the worst VPNs, and having a choice of VPN lets you choose one which is trustworthy and in a convenient jurisdiction. That matters some in the States (no NSL to Canada, for instance) and a great deal in China or other countries.
Yes, it is unfortunate. But hey, you gotta deal with what's so.
There is a learning curve, and extra steps in configuring a working environment. But once the host and VMs are configured, uptime is no worse than with typical LANs.
It's strange to see the evolution of the technology versus policy debate. We started out with "the Internet views censorship as damage and routes around it." A little later we had Lessig saying "code is law." And now the refrain is "VPNs are not the solution to a policy problem."
I miss the idealism and optimism of the past. The only hopeful thing I can find in the new "quote" is that it seems that the tech world is finally aware of the need to work with policy makers and the public in addition to building new systems.
So true and I could not agree more. When did technical problems start requiring political solutions?
I think it's a Trojan horse from politicians to start legislating where nobody needs legislation. The net will still route around censorship, but it's becoming increasingly harder in a world where a high percentage of global bandwidth transits through a small number of large deployments by centralized corporations.
The pessimist in me sees this as a sure sign that the "Balkanization of the internet" train has long since left the station. However I remain optimistic that "information wants to be free." As long as information exists somewhere (and people know to look for it), decentralized tools like torrents, ipfs, Tor, etc will continue to enable access to it.
What I worry most about is the public's increasing dependency on sandboxed devices. We celebrate sandboxing as a win for security, which it certainly is, but the more we depend on it, the more we are subject to the whims of its corporate gatekeepers. How long before laptops are as sandboxed as phones?
Software can only solve the technical problems so long as it can run on the hardware in your possession.
> When did technical problems start requiring political solutions?
When the technical solutions became criminalized. End-to-end encryption is only now becoming common, and English MPs are already talking eagerly about outlawing it. The need for political fights isn't exactly new - think of the Clipper chip in the 90s - but it hasn't abated either.
I see lots of suggestions that we can solve this with keeping tech ahead of law, but I don't think that's a realistic answer. People have tried that in banking and finance and a lot of other domains, and the result is that you eventually get stuck with whitelists (only access the internet these 3 ways) or intent criminalization (banning access the government can't see). You have to win some political fights, if only to carve out space for the technical solutions.
You're misrepresenting Lessig's point. His was not that code replaces statutory law, but that code is one of the four forms of law: Law, Norms, Market, Architecture (including code). Which is captured in his title, "Code and Other Laws of Cyberspace". (Emphasis added.)
The problem in this case is that morality (Norms) has gone AWOL, architecture is insufficient, and market incentives are buying statutory cover to pursue privacy eviceration with impunity.
No. I never said that "code replaces statutory law." I said it was strange to see the evolution from one extreme where code trumps law to the other extreme where technology can't solve policy problems. Lessig was mentioned in between those two extremes.
I won't tell you what you meant as you're the leading authority on that. However, what you wrote was "A little later we had Lessig saying 'code is law.'", and, if you'll allow, a reasonable interpretation of that is "code replaces law".
If you meant to convey a different meaning, you might have clarified. I stand by my statement that that appears to misrepresent Lessig's argument, which is a good one.
As for the range of opinions ... from John Gillmore to Staticsafe ... views differ. It's helpful to keep in mind that Gillmore, Lessig, and Staticsafe are all presenting arguments as challenges to conventional wisdom. To that end, presenting any of them as indicative of the CW is also ... misleading.
Unless you meant another argument.
Again: I'm not trying to tell you what you meant, but I'm telling you what I'm reading from that. And ... between exposition, clarity, and/or argument, it could be better.
Prof. Lessig said "code is law" I was just quoting him. Moreover "code replaces law" is an entirely unreasonable interpretation on its face and especially if you consider I said watch the evolution from A to B to C.
I guess I will just have to live with your disappointment.
Another thing often overlooked with VPNs is that they're just not that fast. I have a 600/40 connection, and I've tried at least six for-pay VPN providers. The fastest one I found (won't mention as my goal isn't to advertise for them) hits, at best, 100/30. And even then, only over L2TP. For whatever reason, OpenVPN is always slower on every PC I've tried this with.
And obviously, you gain a good deal of latency, especially if you use an overseas exit point.
And now we get to deal with shitty services like Netflix punishing privacy-conscious users and blocking access to paid accounts while your VPN is up.
I've used SoftEther VPN software on the type of cheap VPS you find on lowendbox.com.
I notice little if any change in speed. If anything, download speeds seem more consistent in speed without long pauses (or momentary bursts in speed).
It's very easy to install and configure, but I'm not sure how good it is at addressing the point of having a VPN, since I don't know how well the software has been audited by other people, and I wouldn't know where to begin. The same goes for how I must trust the VPS provider.
You can setup your own on digital ocean or aws light sail you will get better bandwidth... IP will not be blocked as it will not be known vpn IP and it can be rotated.. not saying these are solutions to the privacy problem only the technical ones
Potentially a workaround is getting a business account/connection. I doubt most businesses will want any kind of data gathering. So they'll be exempt but obviously more expensive. Could be worth it for no speed loses/VPN hassle.
Maybe they'll even offer pay for privacy on consumer accounts? It's just the price you pay when most people don't know about the issue, or don't understand the issue, or don't care about the issue.
That and CloudFlare ... more and more frequently I've been asked to solve those really annoying "pick seven of these sixteen pictures that have X in them" captchas. Those take way too long and I'll often just leave the site instead of answering it.
VPNs will definitely incur overhead and latency costs, yeah.
OpenVPN can be fairly slow if you are sharing CPU usage (ex. VPS provider) with other users. You are also most likely implementing NAT on your VPN server which is probably not accelerated unless you are paying for an expensive appliance that does so.
I use Private Internet Access and I can easily max out my 300Mbps/50mbps connection, both ways, when connecting through a neighbouring country(I'm in UK, and usually use either Sweden or Netherlands exit points)
Perhaps one solution might be to poison the data and have your router/device make spurious random DNS lookups and HTTPS connections. Ensure the list of random websites includes the top few hundred companies likely to be in the market for usage data. If enough people did this it would make the data useless.
Data poisoning is a fantastic approach: flood the captures with so much, and with so much trash that it becomes an increasingly large amount of work to just sort out the 'real' traffic (even before any advertiser analysis of what that real traffic contains).
There's a couple of things that do this actually: the AdNauseum plugin will hide ads for you, but will also click through on them often as well which helps pollute advertiser data capture. It won't of course be able to replicate you browsing on the page, but it'll go a long way to frustrating the efforts of 3rd parties who won't have access to the landing page metrics anyways.
There was also a post on /r/InternetIsBeautiful that was supposed to do something similar: essentially destroy your browsing habits by performing additional searches and following links in the background, but I think that relied upon a hardcoded list of searches, so it's ongoing functionality was somewhat limited.
A big challenge to making something that continually obfuscates your browsing habits is making sure it doesn't accidentally end up going throw actually sketchy or illegal stuff (i.e. sites/etc that could get you on lists/attention) and making it work in a way that isn't easily detectable/filterable as 'machine traffic'.
I guess that means you'd have to build in functionality to replicate following pages several links deep, not making successive requests immediately (sleeping execution/simulating scrolling), simulating some kind of 'natural' interaction: mouse movement + hovering over things + other things that users might do?
I'm sure most of that stuff is totally possible, probably even easy, might make for a fun personal project...
How would one go about doing this? More importantly... Is there a simple cross platform application I could have my friends and family install that takes little to no effort on their part?
I think data poisoning is going to become increasingly influential, simply because data restriction is so damn hard. Blocking every possible fingerprinting scheme is all but impossible, and any slip-up permanently releases information.
But data poisoning is relatively easy and offers an "additive" solution. Every use decreases the value of all the information you spill, which is way more appealing than demanding flawless defense at every turn.
Why aren't VPNs, and more broadly encryption, a solution to this problem? "Waving the wand of a technical solution," as the post pejoratively calls it, isn't such an unreasonable thing to do with an inherently technical problem. This problem only exists because of other technical wands we waved. Why solve this problem with policy? Policy is hard to get passed, hard to keep passed and even when it is passed often times it means nothing. Remember this is the same government that contains multiple organizations surveilling your every move, not because they legally can, because they illegally can. The point is, it's foolish to count on USG to give you a right to privacy, just look at the history on this, it's not going to happen. But it's especially foolish when this is a right that you can enforce for yourself. If you actually care about your privacy use a VPN, or Tor, don't sit around waiting for the government to do it for you.
Then the question is: are technical experts the only ones who deserve privacy? Are the strong the only ones who deserve safety? etc etc.
While I also prefer a system which assumes no trust in government policy, it is still prefferable provide legal protections for the little guys whenever possible. In this case, the little guy is the vast majority of people who don't understand how the internet works.
I agree completely. Taking an interest in the laws is important because if the technical solutions are made illegal then there is no real solution.
We can't assume VPNs will always be legal for individuals with the horrible direction things are going.
I would like to add however that it would be really nice if the super-intelligent programmers on HN could come up with an open solution that is super easy to use that actually preserves the little guy's privacy. Like just a tickbox in Firefox that makes your whole PC untrackable.
Something so easy that anyone can use it, yet as secure as all the complicated technical solutions that are being presented in these comments.
It seems a lot more plausible to me that privacy technologies can be made accessible to the masses than that policies can be passed which protect the masses. After all the masses are only in this situation because other technologies which were once only accessible to experts became accessible to them. Does the government have a particularly good track record of protecting the little guys in your opinion?
I believe policy is important as a part of the solution because it is a matter of protecting the general public not just a select technically capable.
Yes, policy is hard and can be useless but I still believe it is an important goal to fight towards.
You can care about your privacy, use a VPN and use the democratic process to enact policy change. Those things need not be mutually exclusive. VPNs are only a part of the solution and incomplete, not the solution.
One thing I was wondering, beyond your own personal ISP, does this mean that the backbone providers, the Level 3's of the world, are going to get into selling data to advertisers? I was feeling personally ok because I use an ISP with a strong privacy pledge, but I wonder if their uplink is going to be selling my data. Though I guess it's less of a concern since the backbones don't have the complete personally identifying info that the customer ISPs have.
What incentive does a tier-1 provider have to collect data from their clients? Keep in mind their customers are not individuals, but large orgs: data-centers, corporations, office-buildings, universities, et al. They lack the strong correlation of "1 IP" => "1 customer" that a residential ISP tends to enjoy; they also lack the storage infrastructure that an AMZN, GOOG, MSFT, et al. tend to have as a function of doing business. (Since the problem tier 1 providers aim to solve tends to require large workingsets, not large datasets at rest per se, they tend to need RAM more than durable storage.) I imagine the infrastructure needed upstream to track such traffic would be immense & costly, and more importantly it would just not be very applicable to the provider's major product offering.
Furthermore just what would their end game be? Per all the DOCSIS whitepapers I've read: my residential ISP intends to sell me any number of "over the top" services: a plethora of cable channels, their own streaming services, VoIP, alarm systems, whole home DVR, etc. There is a lot of money to be made there in terms of equipment rental, upkeep, and paid programming. More importantly most of it goes right into their pockets. The way I see it, it's not about selling the data, it's about using it themselves.
Compare that to a tier-1 provider who has one job: get a drop to my network fabric. Their business revolves around (A) doing that regionally, (B) maintaining good peering, and (C) being extremely competent network engineers. As I see it a tier 1 provider has far less incentive to spy on their users compared to a residential ISP. This doesn't obviate the need for caution of course, since nation-state level actors have all the more reason to spy on tier-1 providers simply due to the volume of traffic that can be intercepted.
Thats an interesting bet. If they isolated to the subnets they sell off to ISPs (i.e exclude datacenters and such) what do you think would contribute to the cost/benefit difference of the two?
I understand the viewpoint of the article, but it assumes that the person waving the wand particularly cares about everyone else.
Personally, with the Investigatory Powers Bill in the UK, I will "wave the wand of a technology solution" to conserve and protect my own privacy.
Sure, if the policy was changed upstream then a lot more people would benefit than the technically inclined folks, but if there's a bug upstream we don't all sit with it and wait, we fix it locally and vendor.
It also assumes the person waving the wand has any faith that they can help anyone else.
The last paragraph, about holding the House accountable in 2018? That deserved the preface about "not understanding US politics". The privacy voting bloc is small, and the vast majority of it lives in places that already elect pro-privacy reps - Boston and SF are incredibly limited in what they can achieve.
I'd like to see internet privacy enshrined in US law. I'll fight to make that happen. But it's an "empty the ocean with a teacup" situation, and in the meantime it makes total sense for people to help themselves and those around them.
What would be wrong with selling preconfigured routers to solve the problem?
The router could talk to a standard web api to get information to configure itself. The web service behind the scenes could set up and teardown digital ocean droplets as necessary running streisand. The web service IP's wouldn't be blocked because they'd only be used to periodiy get configuration.
So then you buy a non technical person this router, they create an account on the configuration website and as Ron Popeil would say, set it and forget it.
I think the bigger hole is DNS. Full-tunnel VPNs to primarily TLS-encrypted sites seems like overkill. Encrypted DNS plus an "HTTPS Everywhere" plugin should obfuscate enough info for most people without significantly affecting latency.
DNSCrypt + HTTPS everywhere solves the latency issue but it doesn't solve some of the other issues.
You still need the technical know-how to set up a DNSCrypt recursive resolver. The resolver then talks to the respective recursive chain in plain text as DNSCrypt is not something that is widely adopted.
Hosting a private DNS server has its own issues. Many CDNs rely on DNS server to determine which POP to route you to. Pretty common for Australian internet users who switch their DNS to have videos streamed from Southeast Asia rather than Australia. That would cause huge perceived latency issues. Third-party DNS providers solve this with private agreements [1].
The IP addresses are still there in the clear. VPNs for everyone for everything is the only long term answer to this problem and others like anticompetitive zero rating practices.
The limitations are: no ipv6 support :(, sometimes leaks dns, and always crashes shortly after it is first started (then works fine when you start it again). There seems to be little active development.
To work around the limitations, I mostly use SOCKS (curl also supports SOCKS), plus run sshuttle to try to catch any additional traffic. For that matter, SOCKS alone would at least catch the most sensitive traffic for most people (and would make it easy to have another browser profile for watching netflix).
I get a $15/year OpenVZ account from ramnode.com, which supports VPN usage. I haven't had an issue with bandwith (it seems to undercount quite a lot) but don't watch netflix or otherwise use that much bandwidth.
The main issue I've had is that some websites (google, amazon, gog) will default to various other languages that I assume other people who are doing the same thing speak. Fixed by logging in to the site and they then seem to remember for a while even if you don't log in, but eventually they switch again.
The nice thing is that the remote server can be configured to just have an SSH server on port 80 (in case you ever want to use it from restrictive public wifi; I first stated to do this after seeing SSL downgrade errors on public wifi) with public key authentication, so there is much less to worry about in terms of being responsible for a system open to the internet all the time. In SSH, I set:
So still not a super easy option but a somewhat easier option than OpenVPN. It would be quite easy with an automated way to set up the remote ssh server correctly.
Edit: Speed is quite good with this setup and while I haven't done extensive comparisons, it does not seem to lower the connection speed by much.
Until a better solution is found, I think the way the recent IOT botnet stuff + this ISP privacy deregulation is portrayed in the media opens the opportunity for a startup that sells a secure, smart home router + VPN subscription plan.
Oh, and here I was thinking that trusting startups to our most private and intimate thoughts, traffic, readings, and communications was how we ended up with this mess in the first place.
You have to trust someone at some point if you want to use the internet at all.
Do you trust any VPN providers? Or your ISP? Or the programmers of the browser that you're using? Or your CPU manufacturer? It's turtles all the way down.
Perfect is the enemy of good. If that protocol was open, it might foster a way to fold VPNs into the everyday person's internet connection, with the possibility to easily change VPN providers down the track.
And the point of this article, that VPNs are not the solution to a policy problem, is to change policy such that that trust may be far better founded.
Adding more players to a game that perverts and corrupts virtually every player on the field doesn't strike me as a particularly wise and enlightened approach.
Technology used to trump policy, in an unstable but stubborn way. Napsters and piratebays die, but file sharing lives. It's less intense now nit because of policies, but because legal ways to buy most music and videos became reasonably convenient for the mass user.
How well might connectivity limitation work? It took China immense centralization and a lot of technical effort to build the great firewall, which is not exactly impenetrable, though.
I used a droplet on DigitalOcean to configure an Algo server. Very seamless setup, highly recommend. There's a $10 promo floating around: DROPLET10. You can self host too.
Ya, this sucks... a lot. VPNs are a start with existing tech. I firmly believe new technology will solve this problem. Encryption everywhere. Overlay networks. New fully encrypted and annonymized DNS systems. Digital currency incentivizations. Policy helps but in the absence of policy technology will find a solution.
This whole damn thing spawns from the lack of competition with ISPs. If consumers had more than 1 or 2 options, we could choose with our money. I don't think the solution is to regulate the industry, but our privacy should certainly be protected by our fucking useless government.
Sweden is a member of the EU [1]. It has a 6-month data retention law [2]. Much safer to route through Norway, Switzerland or even the United States. (I use PIA [3].)
Everyone has different needs. If you are a journalist building up a story against powerful adversaries, then you absolutely find a VPN provider in an impartial jurisdiction. If you are just trying to hide your browsing habits from your nosey ISP, torrent a couple movies, and latency matters at all to you, a local VPN is not a terrible choice.
PIA has been dissed over their promotional practices. And for using weak encryption, which allowed them to minimize resource use, and undercut competition.
But I gotta say that their no-logs victory in court is impressive!
France runs a warrantless mass surveillance program [1]. It is one of the countries our OpSec consultant specifically recommends taking clean computers to. It is labelled, by "That One Privacy Site" as NOT being an "enemy of the Internet" (whatever that means). Difficult to take the rest of its recommendations seriously.
I personally use Cloak as it was easy to set up (https://www.getcloak.com/), but I'll be adding proxy.sh (https://proxy.sh) as my primary soon (on recommendation from a few security minded friends and their logging policy).
setting up VPNs doesn't scale. the entire internet can't be behind VPNS not to mention people with poor internet will not be able to use a VPN effectively
At the end of the day, it is obvious that policy is the right direction to stop this bleed of infringement. However; be it noted: those who have the capability to circumvent, or ethically "get around" such enchroachment; have a responsibilty to free those who may be entagled by that which is "freedom limiting". The argugment could be had, however; is it really freedom limiting for others to know your web history? Obviously, there are second, and third abilities to be held when a dominant party knows of the lesser's behavior. Still a great bit to parse. As for me and my house, we will tunnel safely through VPN.
Thx for the suggestion, advanced tomato looks great.
Some of the reports on the rt-n16's capacitor issues concern me. But then again I am getting in the habit of replacing the capacitors in my electronics.
You realise that routing all your home LAN traffic over the same VPN located ... at your home ... still gives your ISP all your personal browsing traffic.
Though your kids won't be able to snoop you from the internal interface.
Anyone thinking about futzing about with a WRT router should move their attention to Ubiquiti's EdgeRouter Lite [1] which is an amazing entry level enterprise-grade router that costs ~$99 to buy. It has all the configuration options and more that WRT provides in a native higher-powered router unit.
I found that none of the WRT powered routers could really handle a home 1Gbps connection and that the WRT is getting a little out of date and unmaintained.
VPN providers can totally scale. They will cease to be semi-dark-web services and turn first class. Services that test them will emerge verifying the security and encryption of tunnels.
Additionally there will be some who take an extreme view to this "zero knowledge" approach offering all forms of payment and workarounds to preventing down-stream ISPs/backhaul from tracking/identifying/classifying user traffic.
Maybe VPNs "are not the solution" but they still can do a lot of good in the mean time yet.
After reading digital ocean the 10th time on here. What makes people think that using a american company that complies with american laws and regularly gives out data is a much better option than renting a VPN in a country that still has privacy in place?
On the contrary, Hanlon's razor could just assume good intentioned VPN hosts failing to secure their design by negligence or ignorance of broken protocols.
To the contrary, Ockham's razor means shell VPN companies set up by the multi-billion dollar three-letter agencies whose entire job seems to be to gather as much data as possible by any means. :-)
I had all sorts of VPN problems over the years with various Linux desktops OS. What I do instead is that I have a proxy server with just an OpenSSH daemon on port 443 -- if there's web traffic, add sslh to taste -- and then use the SOCKS v5 proxy built into OpenSSH client and then http://darkk.net.ru/redsocks/ I might be the weird case here but I found this infinitely easier to set up than any VPN.
Unfortunately even recent versions of Android have some incompatibilites with OpenVPN.
When I tried again with Lollipop last month, the VPN's preferred DNS was not being set on the phone despite being sent from the VPN server, hence DNS lookups were leaking to whatever DNS server had been set before establishing the VPN. Quite a nasty gotcha. Workaround is to run a script to set the DNS, but that requires root privs which 'normal' users won't have.
So which VPSs are good for privacy? We all know DigitalOcean, AWS and Linode as simple to set up and use VPSs, but does anyone have any recomendations of VPSs based on their terms? I currently use DO for my VPS/VPN, but i've seen people voice concerns about them in the past. Is there a list of 'most free' providers?
The PCMag survey felt very heavily weighted to who they get referral fees from. Every top rated VPN had a special link and referral offer.
That being said I used it and ended up choosing one that they recommended basically due to lack of info from other sources that is timely. Was a couple months ago.
I run x2go on a linux server that I connect to remotely for browsing. It's at my house currently and configured to use a vpn, but I used to have one in the cloud.
I wonder if people would be interested in dedicated browsing VM. Unfortunately there is no good mobile client.
I swear this 98 percent of this article was from the Policy Change HN read yesterday.
I think the market for VPNs that have a policy for not keeping logs and easy-to-use will grow exponentially in the common days or weeks. For the more technically inclined, VPS
providers.
Not the solution perhaps but the next natural move of a cat and mouse game that predates the current policy change. It boils down to: Keep the internet lawless because there's no global entity that has my best interests at heart.
How about Apple provide a VPN as part of the device? Remember Apple was the one that broke the telecom's dominance on the mobile market. I wouldn't mind paying Apple for the privacy.
The (presently) top-rated comment on this thread by nikcub is not only wrong, but fractally wrong in every particular. I'm offering this as a possible counterpoint.
* False dichotomy: that the solution lies in only one sphere. (Lessig, Code). This is lightly moderated, but resurfaces at several later points in the argument.
* Personal responsibility. Check. Never mind that the source article states concisely and specifically why this doesn't work or scale.
* Hybrid system. Or as I prefer, the worst of both worlds. In the healthcare example, a guarantee of emergency room services is posited as a sufficient mitigation for mandating individual responsibility in all other areas. Disregarding the fact beneficial health outcomes comes from public or preventive measures, not acute (read: late, expensive, heroic measures) interventions:
"In all, 86 per cent of the increased life expectancy was due to decreases in infectious diseases. And the bulk of the decline in infectious disease deaths occurred prior to the age of antibiotics. Less than 4 per cent of the total improvement in life expectancy since 1700s can be credited to twentieth-century advances in medical care."
― Laurie Garrett, Betrayal of Trust: The Collapse of Global Public Health
* As with all good Techno-Libertarians, nikcub "personally believe[s] in user responsibility". Despite some 50+ years of experience that user responsibility for security simply does not work or scale.
Nikcub continues with specifics:
* Universality of policy. Which seems to boil down to "since every jurisdiction cannot offer the same high levels of protection, no jurisdiction should". What ever happened to the concept of a competitive marketplace for ideas, including legal and moral frameworks? Isn't the very idea of liberal democracy that its principles, premises, and protections are so manifestly self evident that all people everywhere would want them? (And hence: why it's such a major pain in the ass of tinpot despots everywhere.)
* Some governments are bad ... so no governments can be trusted. Again: a slope so slippery nikcub loses his footing instantly. We can apply the same argument to ... anything. Including his proposed technological solutions: Software is a major party in privacy violations and is conflicted (and buggy), so it cannot be expected to behave in the interest of users. In government as with software, the proper response to buggy implementations is to fix the bugs, not burn the house down and abandon the domain completely.
* Government trust. Where do I even start (the concept and questions of trust are ... a whole 'nother essay). If liberal democratic government, the agent and agency* of The People, cannot be trusted, then what can?* Private, self-interested business? Which, I'll hasten to add, has landed us in the present kettle of fish? If you're finding that your government (or parts of it) aren't trustworthy, then you have two problems. But the one doesn't invalidate proper approaches to the other, and fixing the problem of government trust gives you an exceptionally powerful tool to apply in remedying privacy and other policy failures. Say, such as single-payer, universal, socialised medicine.
* Tech solutions that are universal ... are called policy. And, to add to that, a primary reason for approaching such policies through government is that governments have the clout and scale to make policies stick. Keep in mind that this need not be at national or international scales. Policies at the sub-national scale -- say, Northern Ireland or Scotland within the UK, or California or New York within the United States, could have major impacts. Given the option of adopting multiple and conflicting regulatory standards, or a unified and coordinated standard, companies will often prefer the latter. The case of US EPA and California EPA emissions standards would be an excellent study in same.
* Good policy is hard work. Yes, well, hard problems are hard. This doesn't make them not worth pursuing. And remedying the specific problems highlighted would be a key goal of any privacy regulatory overhaul.
* Penalties are small. Well, duh: embiggen them. I thought yuuuuge!!! was in now, anyways....
* On information disclosure: yes, it's very hard to un-leak data. On the other hand, comprehensive and pervasive regulations against the storing or transmission of personal data, stiff penalties for doing so, and sufficient rewards for reporting on such violations, will tremendously decrease the incentives for doing so. Given that the value of vast troves of personal information to firms such as Facebook is ... roughly $12/year per person, those penalties need not be tremendous, though they do need to be sufficient given scales of detection. This isn't dissimilar to present approaches against counterfeiting of money or goods: the fundamental capability to violate norms exists, but with appropriate penalties, and incentives, against transacting in such money or goods, it can generally be tamped down to an acceptable level. The more so if technology and other means are applied in concert with policy.
The argument continues spewing the additional canards of perfect worlds (no policy world is perfect, at best it is sufficient), sole reliance, and of mis-casting the argument as warning people away from VPNs (it doesn't, it merely points out that VPNs alone are grossly insufficient).
And for the capper, we have free-market it harder. As if it wasn't free-market interests, and failures, which haven't landed us precisely in the present situation.
The second school of thought is individual responsibility. Users should take steps to protect their own privacy on a case-by-case basis, in the same way they look after their own home security or personal safety.
The third would be a hybrid approach - that there is a role for the government to play in setting up a universal minimum level of privacy protection while users also have a role to play in their own protection. This is most akin to how healthcare works - i'm guaranteed treatment in an emergency room but I also might choose to keep myself healthy with diet, exercise etc.
I personally believe in user responsibility for personal privacy and security, where you can't and shouldn't depend on policy to protect you and that all users should be aware of the issues and actively educated on how to protect themselves. For a few reasons:
1. Policy is not universal. Some countries may have extensive and rigorous user privacy protections but that doesn't apply to users everywhere. While user privacy protections are strong in Europe, and consumers have access to recourse if they're privacy rights have been violated, that same advice doesn't apply to the majority of internet users, most of whom are residents of a nation or jurisdiction where there is no strong protection or user recourse.
2. Governments are a major party in privacy violations and are conflicted, so they can't be expected to behave in the interest of users. The most recent campaigns to roll out encrypted communications and connections in apps was prompted by the US government intercepting internal Google data. The government will almost always be incentivized to lower barriers to ease intelligence gathering and in most of the world government surveillance trumps individual rights.
3. Similarly, government can't be trusted. This is the point Ed Snowden made when he argued for individual and tech solutions to privacy over government policy[0]. Snowden cites the difference in Obama's campaign promises and what he delivered[1], and this isn't unique to Obama - the FCC ISP privacy rules being blocked this week is yet another example of how easily and quickly policy can be undone, while the mass surveillance Snowden disclosed is an example of how public policy and private actions can be different.
4. Tech solutions to privacy doesn't imply individual responsibility. We can, and do have, tech solutions that are universal - such as the campaign to roll out encrypted communications and connections with Whisper and LetsEncrypt.
5. Policing government policy is labour intensive and difficult. It relies on privacy researchers - usually individuals - to track what companies are doing with user data. With more data being shared between companies it is even more difficult to apply individual oversight to how policies are being enforced. See Natasha Singer's reporting in the NYTimes on data brokers[2]
6. There are usually very minor enforcement penalties for companies that violate user privacy policy. The FCC tracking opt-in rules were prompted by some ISPs adding tracking headers or cookies to user traffic. AT&T and Verizon were adding tracking cookies to user traffic and it took two years to notice, and there were zero implications for both companies[3] other than the new FCC rules which are now dead.
7. Even in the perfect world of good policy, good application of policy and good enforcement you still have more data than ever being stolen and leaked online. You only have to look yourself up on haveibeenpwnd or a similar database to find that for a lot of people, all of their PII has already leaked[4]
It is very clear to me that technology solutions have the primary role in protecting user privacy. Policy isn't a waste of time but it can't be relied upon. The question is how user privacy protection is packaged for a mass-audience. User privacy requires an equivalent of what 'use WhatsApp, use Signal' is for user security, what 'install antivirus, don't click on attachments' used to be for user security and the growing popularity and awareness of ad blockers.
I'm not sure what that will be or what it will look like, but warning people away from VPN's probably isn't going to help. Chances are that some form of VPN connection will become part of the standard solution (along with HTTPS/encrypted comms everywhere) now that the reality of ISPs and users not sharing privacy interests is here and many are aware of it.
Theres a great market opportunity here - perhaps not for VPNs as a product but VPN as a technology.
[0] https://www.wired.com/2016/11/despite-trump-fears-snowden-se...
[1] https://www.forbes.com/sites/thomasbrewster/2016/11/10/edwar...
[2] http://www.nytimes.com/2013/09/01/business/a-data-broker-off...
[3] https://www.techdirt.com/articles/20150115/07074929705/remem...
[4] https://haveibeenpwned.com/