[HN Gopher] Why I Wrote PGP (1999)
___________________________________________________________________
Why I Wrote PGP (1999)
Author : pdkl95
Score : 390 points
Date : 2021-08-08 02:21 UTC (20 hours ago)
(HTM) web link (philzimmermann.com)
(TXT) w3m dump (philzimmermann.com)
| jtsuken wrote:
| My favourite conspiracy theory is that the whole Trevor
| Martin/George Zimmerman affair
| (https://en.wikipedia.org/wiki/Killing_of_Trayvon_Martin) was
| pushed so hard by US media mainly to suppress any reference to
| George Zimmerman and PGP after the publication of Snowden's
| papers.
| stavros wrote:
| Did you mean Phil Zimmermann? The two last names aren't spelled
| the same (and it peeves Phil when people forget the second n).
| schwartzworld wrote:
| Couldn't be genuine outrage about a child getting murdered in
| cold blood
| rsyring wrote:
| Created 1991, updated 1999
| forgotmypw17 wrote:
| I think one of the best arguments for using PGP is how long
| it's been around and is still in use, for two reasons:
|
| The encryption mechanisms have been tested many times by many
| people.
|
| And the tooling exists for just about platform and language.
| tptacek wrote:
| The encryption mechanisms were tested, found wanting, and
| replaced in subsequent systems. PGP's installed base
| prevented them from keeping up. As a result, the
| constructions used in PGP today are essentially reviled by
| cryptography engineers.
| forgotmypw17 wrote:
| What do you mean by "constructions"?
| tptacek wrote:
| Cryptographic constructions.
| forgotmypw17 wrote:
| Can you recommend a text about this? As a layperson, I'm
| still having trouble understanding what you mean by that.
| zahllos wrote:
| Here's a quick overview: We have what we call primitives
| that achieve a certain goal. For example AES on its own
| does a pretty good job of being a block cipher. However
| it doesn't fulfil all our expectations for actual secure
| communication alone and for this we need to use it as
| part of a slightly larger scheme.
|
| These are the constructions tptacek refers to. How we put
| together the bits we have in a way that meets our
| expectations, which we refer to as semantic security.
| This doesn't just apply to AES but also to public key
| crypto as well. This might seem quite abstract, so let me
| put it this way: AES alone doesn't know if the ciphertext
| you feed it has been modified by an attacker. It will
| simply process that data with a given key. The decrypting
| software might notice and report an error (the message
| will look garbled), and there are circimstances where
| this can actually be exploited to reveal information.
| This is not what we expected to happen.
|
| We've learned a lot about this since the early 90s. Many
| modern primitives actually come with all the parts we
| would call a construction built in, to avoid potential
| misuse (although these schemes are for the most part
| academic right now). Almost all modern systems combine
| primitives like AES in such a way as to meet our
| expectations. Except perhaps Telegram but nobody knows
| what they're smoking.
|
| If you want an actual textbook, Introduction to Modern
| Cryptography by Katz and Lindell, or Cryptography Made
| Simple by Nigel Smart will cover this in plenty of
| detail, and are also good all round introductions to most
| areas of cryptography by leading experts. I learn towards
| the book by Smart, but either will be perfectly fine.
| paulryanrogers wrote:
| Really? The fundamentals or the implementation?
| tptacek wrote:
| The fundamentals. I mean, very much both! But the
| fundamentals are the more important part.
| breput wrote:
| This is pure snark and should be downvoted into oblivion, but
| by 2015 even Phil Zimmerman couldn't figure out the tooling:
|
| "Sorry, but I cannot decrypt this message. I don't have a
| version of PGP that runs on any of my devices"
|
| https://twitter.com/josephbonneau/status/638772283713060864
| forgotmypw17 wrote:
| Strange, I've found it for all major platforms. I don't do
| much encryption, but keygen and message signing works for
| me on Android, iOS, GNU+Linux, FreeBSD, Mac, and Windows.
| upofadown wrote:
| I think that sometimes we forget that PGP is primarily a
| political statement. It makes the world a better place simply by
| existing.
| breput wrote:
| PGP felt so subversive back in the day.
|
| Key signing parties[1] and porting the "international" version[2]
| to run on the Amiga. And the very real threat that the Clipper
| Chip[3] would lead to the outlawing of all other encryption
| methods.
|
| [1] https://en.wikipedia.org/wiki/Key_signing_party
|
| [2] https://www.unix-ag.uni-
| kl.de/~conrad/krypto/pgp263.features...
|
| [3] https://en.wikipedia.org/wiki/Clipper_chip
| nelox wrote:
| Yes, the only munition available on a t-shirt!
| dylan604 wrote:
| Did PGP did that too? I know DeCSS did this. Did they borrow
| the idea from PGP?
| georgeecollins wrote:
| Yes. http://www.loundy.com/Roadside_T-Shirt.html
| alfiedotwtf wrote:
| The government thinks it still is.
| breput wrote:
| PGP's biggest weakness was that it was too early. There was
| no normal user accessible software available. No regular
| person was going to establish the web of trust or use command
| line utilities.
|
| So now we have easy, strong encryption and the keys are
| controlled by...someone. Definitely not the user, though.
|
| Funny story - even Phil Zimmerman can't use PGP:
| https://twitter.com/josephbonneau/status/638772283713060864
| So maybe it is just a hard problem.
| jandrese wrote:
| No, PGP's weakness is that the Web of Trust is an
| unworkable solution for the general population for key
| exchange. It works fine for a you and your circle of crypto
| nerds, but as a general solution it's impossible.
|
| IMHO this is a case where perfect was the enemy of good.
| Many possible solutions were rejected because there was a
| possibility that someone could MITM your first contact,
| even though in the real world this is unlikely. The key
| registries were almost a solution but none of them ever
| gained enough traction to be a default solution and mail
| clients were strangely hesitant to incorporate them even
| when they did implement PGP.
|
| PGP was always half of the solution. Sadly they never
| figured out the other half. Microsoft almost got it working
| with Exchange, but even then you usually it only works on a
| single domain at a time. You can't use encrypt an email to
| someone at a different company even if they are using
| Exchange.
| XorNot wrote:
| Web of Trust is a perfectly fine system but UI-wise a
| total disaster. There's also the reality that what most
| people _need_ most of the time is a web of trust that
| includes government agencies, banks and other major
| institutions.
|
| For the vast majority of useful communications for users,
| your web of trust ideally goes You -> Government ID
| Agency <- Recipient. And that's _fine_ - that 's what
| people actually need. People get scammed or deceived by
| faking those credentials.
| UncleMeat wrote:
| Web of Trust mixes two kinds of trust.
|
| If my mom gives me her public key, I trust that it is her
| public key. If my mom signs some other person's public
| key - I really don't know how much I trust that. Trusting
| that somebody is who they say they are is not the same as
| trusting them to properly vouch for another person.
| jandrese wrote:
| This is the reason Frendster failed. Friending someone
| automatically made you a friend with all of their
| friends, even the ones that were jerks or you had never
| met.
| jandrese wrote:
| Having to physically meet people to exchange long hex
| strings was never going to scale.
| [deleted]
| XorNot wrote:
| No but that's the point: you do have to physically go to
| the DMV, or the bank, quite frequently. And for most
| people, the important point to point communications are
| interactions you want validated against those entities.
| dijit wrote:
| I fundamentally disagree with you that web of trust is
| hard.
|
| There are much harder problems solved in easy to use
| ways, there's just very little financial gain for this
| problem.
| easton wrote:
| Notably, in recent hosted versions of Exchange that has
| been resolved since they can use Azure AD to authenticate
| across tenants, and if you don't have Office 365 you can
| make a temp account in their tenant when you click on the
| link to see the email. It works fine (unless you're still
| on-prem for email).
| dosman33 wrote:
| The sad thing is if the clipper chip was ubiquitous today that
| could have killed the ability for spammers to spoof numbers.
| Some days I can get a dozen robo calls, each with a different
| spoofed number. People that want non-backdoored crypto could
| still do so.
|
| I'm still blown away at how hard it is to get people to use any
| encryption, even people who work in infosec/etc. If nothing
| else, 2020 was a great year for the uptick in using crypto to
| communicate with non-technical fam and friends.
| toast0 wrote:
| You don't need a clipper chip to trace nuisance calls. You
| need an authenticated network that records the origin of
| calls, and hopefully passes that through when calls are
| forwarded _and_ makes it simple and worthwhile to report
| nuisance calls _and_ aggregates those reports and takes
| meaningful action against the origins.
|
| Anyway, we're getting shaken/stir or whatever
| RealSoonNow(TM), so we'll probably have better CallerID. I
| don't think it'll be enough to solve the problem, without a
| reporting mechanism, but I guess we'll see in the next couple
| years.
| dosman33 wrote:
| "You don't need a clipper chip to trace nuisance calls. You
| need an authenticated network that records the origin of
| calls,"
|
| So where is this magical solution you speak of? We're all
| products that the phone company sells to telemarketers,
| there is no incentive for them to give us these tools now.
|
| Again, the clipper chip would have made it difficult for
| anyone to pretend to be someone they are not, cryptographic
| signature is part of the deal to ensure you are talking to
| who you think you are talking to.
| warkdarrior wrote:
| Would you want the same capability on the Internet? If not,
| what makes Internet communication different from POTS
| communication?
| mjevans wrote:
| I would want to require:
|
| 1) That the source IP address be from a range
| 'controlled' by the operator of a given AS. This might be
| proven, semi Out of Band, for a duration by a PKI
| challenge with a key representing that authority. (Allows
| distributed services on the same IP anywhere. Fulfillment
| can be asynchronous if UDP.) Edit: This would also be how
| to securely claim an AS route; you might still need a
| link authorized for this level of service.
|
| 2) The mentioned feedback mechanism should be coupled
| with 'do not forward me anything from IP || net/mask for
| X time' via a similar mechanism. A reason might be
| provided, reasons of clear abuse MAY be aggregated and
| used to isolate misbehaving hosts / networks.
| lmm wrote:
| Internet connections have a more-or-less reliable source
| IP (spoofing does occasionally happen and we take
| measures to mitigate it), IP ranges have owners and if an
| address is consistently used for abuse (attacks, spam
| email, ...) then people do report this to the owner of
| that address?
| geocar wrote:
| > IP ranges have owners and if an address is consistently
| used for abuse (attacks, spam email, ...)
|
| IP ranges have registrants. Servers usually are assigned
| IP addresses temporarily by the registrant, or by someone
| the registrant has assigned the block of addresses to by
| some other means. This means differs from region to
| region. In the US the responsible party is ARIN, and
| registrants can reassign addresses using a database
| called SWIP. In the EU both registrants and their
| partners use the same database called RIPE. I have never
| registered addresses in other regions.
|
| > then people do report this to the owner of that
| address?
|
| Yes. Registrant again, but yes. And if you don't get
| satisfaction, then you can (and should) escalate all the
| way to the region's authority.
| geocar wrote:
| Yes.
|
| Email has a "from" address that the SMTP protocol (the
| thing that often carries emails) that is separate from
| the IP address of the sending server, the exact same way
| "CALLER-ID" is a separate field from the billing address
| (called ANI, or Automatic Network Identification) in
| telephone networks.
|
| Requiring that ANI match CALLER-ID would break many
| voicemail systems and call-forwarding systems. They can
| be fixed, but it will be expensive to do so.
|
| Similarly, requiring the email "from" address agree with
| the SMTP server's responsibilities breaks mailing lists
| and email-forwarding, and again, this _can_ be fixed, but
| it is proving expensive to do so.
| jrochkind1 wrote:
| The US government intentionally made it inconvenient and
| infeasible to include encryption at a key time in
| technological development, and I think it had lasting
| consequences.
|
| Yes, if the internet community had acceded to their demands
| to use the clipper chip, that would have been one route to
| them lowering the barriers they had put in place to
| encryption. They also could have just recognized that
| widespread encryption was in the national interest without
| the clipper chip, instead of deciding it was opposed to it.
| hmfrh wrote:
| > Some days I can get a dozen robo calls, each with a
| different spoofed number.
|
| I live in the EU and have literally never gotten a robo call
| in my life. It's a political problem, not a technical one.
| breput wrote:
| Robo calls should be filtered at the network level. The
| Clipper Chip would have done nothing to prevent this.
|
| There is actually encryption technology[1] available that
| would solve this or at least make it traceable and blockable.
| But here we are.
|
| [1] https://en.wikipedia.org/wiki/STIR/SHAKEN
|
| Edit: Also the political situation at the time was that if
| Clipper was adopted, all other encryption technology would be
| outlawed. It was a very scary time.
| dosman33 wrote:
| The key word here being "should", and they are clearly not
| filtering at the network level. I can tell, I still get
| spoofed robocalls... The clipper chip provided end users
| the ability to cryptographically prove callers were who
| they claimed to be independent of the network operator,
| which is a key need of a crypto system.
|
| Robocalling with spoofed ANI has been a problem long enough
| that I think we can safely say the network operator is 100%
| complicit with this activity now. The phone company could
| track down kids war-dialing blocks of numbers in the 1980's
| in order to make sure they were not telemarketers not
| paying higher telemarketing fees. Do people really think
| the phone company is not getting a cut of these
| robospoofers?
| uncomputation wrote:
| There's something... different about how people (techie people
| are most of my sample) would write before the 00's. I'm not sure
| if it has to do with the medium, or the constraints of the time,
| but reading it always fills me with something I can best describe
| as peace/nostalgia. The belief that technology honestly can
| change the world for the better and that the most influential
| people driving it have good motives instead of profit motives.
| And they were real visionaries most of the time. By contrast,
| anything seemingly after the dot com boom (I can't draw a clear
| line, this is just throwing a dart) seems, I don't know how to
| describe it. Too self-aware, too clever? It's similar to the
| contrast between HN and other forums/social media out there. I'm
| not sure, but whenever an older article or something shows up, I
| usually enjoy it. Perhaps it's that only the best have survived
| till now.
| harryf wrote:
| Aside from shifts in morality and underlying cynicism that took
| place online from around 2007, once the "unwashed masses"
| because addicted to Facebook, I think the biggest thing that
| killed good writing online was analytics.
|
| Once most people discovered their well thought-out blogpost got
| only 100 page views while a meme with a cat got 10 million,
| many just gave up. But what's missing in those numbers is, of
| those 100 page views, perhaps 10 were people you actually
| respect, have influence in your field, were actually using your
| Open Source project etc.
|
| By optimising metric like page views we lost sight of the
| genuine impact we might have had with good writing.
| intricatedetail wrote:
| I think FOSS didn't predict that work done by volunteers will
| be appropriated repackaged and sold by big corporations without
| sharing profits with contributors nor sharing any patches. This
| caused people to develop defensively - contribute as little as
| possible and only for their own benefits. Developers no longer
| wanted to be taken as fools.
| wiremine wrote:
| The dot com boom is a reasonable point in time to make the cut.
| But it's never a single event. Ever other posters referenced
| 9/11, which was definitely another major event.
|
| I'd add Columbine as another event, which occurred in 1999 [1].
| That seemed to have a lasting affect on that cohort, which was
| also the group that got hit hard in the 2008 downturn.
|
| But maybe a better line is the rise of Facebook, which shifted
| the story from the promise of tech to the promise of social
| connections.
|
| Of course, technology will never be able to safe us, and the
| human condition is what it is. So, really, while a small
| passionate group seemed excited back in the mid 90s, it was
| always false gold.
|
| [1]
| https://en.wikipedia.org/wiki/Columbine_High_School_massacre
| [deleted]
| roenxi wrote:
| I suspect it is that there are a lot less abstractions and the
| thinking is much more moored in the material. In this
| profoundly technical article there is barely even a mention of
| computers or algorithms, and the vision is of a more analogue
| world (of paper bills, phone companies, physical wiretaps,
| human agents).
|
| The modern internet is almost entirely clashes of abstract
| concepts. It also shows up in the slight breakdown on the
| internet of basic, verifiable facts. Nobody is relying on real-
| world stimulus to form opinions. It is a bit draining to keep
| up with.
|
| That and there is less optimism because it is clear how slowly
| the world changes. Consider the "The government has a track
| record that does not inspire confidence..." paragraph. Written
| 30 years ago, part of it could credibly be talking about
| Assange, have names swapped for Trump, etc. At some point
| intelligent people are going to get jaded pretending that this
| is new based on the overwhelming evidence that the internet
| gives us access to.
| [deleted]
| jrochkind1 wrote:
| The utopianists saw what they had wrought, and did not like it.
| skybrian wrote:
| One difference (in this article at least) is that there are no
| jokes or unnecessary cultural references.
|
| Another might be called moral clarity. Unfortunately, it's
| usually an illusion. We have much more experience with
| technologies invented under optimistic assumptions turning out
| to be a moral gray area at best, when you look at how they're
| used.
|
| I found this paper interesting:
|
| The Moral Character of Cryptographic Work
| https://web.cs.ucdavis.edu/~rogaway/papers/moral-fn.pdf
| Zababa wrote:
| I'd put "jokes" and "cultural references" together under
| "tone". Recent articles often feel like they're trying to
| catch the attention of children. There are lots of "candies"
| to make you read: pictures, GIFs, jokes, an attention
| grabbing title, colors, emojis, a friendly tone, lots of
| exclamation marks. On the other hand, that article is mostly
| black on white text, that's plain in a good way.
| jacquesm wrote:
| It's the recurring critique on my blog posts: that there is
| too much text and too little pictorial content. I'm not
| going to change anything because of that but it is
| interesting how you have identified this as a good thing
| when the bulk of the feedback that I get about this is
| negative.
| Zababa wrote:
| I've just read "Pianojacq, an easy way to learn to play
| the piano" from your blog. I like it. There is a video to
| show everything, and a direct link to the software. The
| tone is what I called "plain in a good way" in my
| comment, it's mostly information organized logically. I
| wish more blogs were like yours.
| jacquesm wrote:
| Thank you! The software has come a very long way since
| that first blog post (and so have my piano playing skills
| :) ).
| tasogare wrote:
| I especially hate this "corporate fun" style when it's a
| big tech repository where each bullet point of a list is
| replaced by an emoji.
| Zababa wrote:
| I really have a hard time with emojis outside of
| communications. Either they are saying something that was
| already said by the word or words before, and in that
| case they are useless, or they replace a word and make
| text harder to read. I also really don't like the concept
| of making objects into emojis, as we already have words
| to describre that, and emojis reflect a very limited
| world. For example, if you look at the food emojis, this
| is basically "I live in San Francisco and all of the food
| I get is from restaurants". I think I've heard it
| described one day as "the world of people that live in
| airports", and that fits well.
| vbezhenar wrote:
| That's because young people have very short attention span
| and they must be fed with instant gratifications all the
| time to continue reading. Those "candies" are targeted at
| them.
| newsclues wrote:
| Is it really just young people?
|
| Don't old people who sit in front of the news get a
| similar rush?
| vbezhenar wrote:
| That was my experience working with developers of
| different ages. Those who were born before 1995-2000 year
| are fine spending hours focusing on books. Those who were
| born after, prefer to learn from short engaging videos. I
| don't judge anyone, that's just my observations, I don't
| claim if one method is better than the other.
| sidlls wrote:
| Where do you get that? Do you mean software developers
| specifically?
| Zababa wrote:
| I don't think they are targeted only to them. The short
| attention span can be a thing, although I'm not sure it's
| generational. For example, the usual newspaper has a lot
| of small articles).
|
| On the other hand, part of the candies is to reassure
| your audience and try to bring them to you with something
| else than your content. That part applies to everyone,
| regardless of their age. For example, if you do a blog
| post on a programming technique, you could try to brand
| it (and yourself) as "software craftsmanship", insert a
| few references to people in that space, add a few
| paragraphs talking mostly about this ideology and not the
| content. Or you could use a lot of examples, references
| and jokes from something cultural (the current popular
| thing on netflix for example). These "candies" aren't
| targeted at people with short attention span.
| ozim wrote:
| No those "candies" are to create feeling that you are
| peers and that it is informal communication.
|
| That is why most people like movies made by Quentin
| Tarantino and not by Andrei Tarkovsky.
|
| I don't like when someone puts memes in each paragraph
| but at the same time I don't like to read "guru on a high
| horse" that comes like he is a smart ass because he
| pretends to be professional and all that.
| Zababa wrote:
| I think both types of candies can coexist. If someone
| makes a joke, it's probably to grab your attention. If
| someone talks about politics, it's probably to signal
| something to their peers. If someone uses the last marvel
| as an example, it's probably a bit of both.
|
| > I don't like when someone puts memes in each paragraph
| but at the same time I don't like to read "guru on a high
| horse" that comes like he is a smart ass because he
| pretends to be professional and all that.
|
| That's fair, I don't like this style too. Which is why I
| like to describe what I like as "plain English". I'd say
| the characteristic is that the content is mostly
| information, and not signalling or entertainment.
| Dudeman112 wrote:
| I think you are biased, and falling to the age-old
| "young/old people bad" where young/old is picked on which
| one you are not
|
| Commodari E, Guarnera M. Attention and aging. Aging Clin
| Exp Res. 2008 Dec;20(6):578-84. doi: 10.1007/BF03324887.
| PMID: 19179843.
| nickdothutton wrote:
| > One difference (in this article at least) is that there are
| no jokes or unnecessary cultural references. As someone who
| started his professional career in the mid 90s, working in
| what we now call cyber security, and having written both then
| and after a long gap... now. I was initially baffled and then
| somewhat put-off by the way style has changed between say
| 2000 and 2010. First I put it down to just being older. Then
| I wondered if authors were encouraged to "put more of you"
| into writing (which I am not a fan of unless you are
| explicitly writing autobiographically). Part of "bring your
| whole self to work"? Then I wondered if it was just an
| attempt to add colour to what may be a rather dry subject for
| anyone other than those working in our niche. Finally I
| thought that perhaps it was something a little more profound.
| A desire by the author to connect at some deeper level than
| the dry content, with an audience, a tribe if you will.
| sildur wrote:
| All those "jokes" are exhausting. I usually don't have the
| energy to finish reading an article. I assumed it was a
| problem with myself, lack of attention. Until some day I read
| an article from beginning to end, it was captivating. I found
| that weird, then I checked the date of the article: 1950.
| Damogran6 wrote:
| Link? :D <- Emoticon for the short of attention span.
|
| Honestly, I know it's popular to cast these things as 'Gen
| Z, kids these days don't know how it used to be'....but I
| know this 51 year old guy doesn't have near the attention
| span reading that he used to.
| jimmaswell wrote:
| Ever watched old commercials? It feels like they were less "in
| your face", not constantly jumping up and down for your
| attention. Calmly spoken and more likely to actually say
| something about the product. That shift is another indicator of
| the shift of things getting dumbed down in a way.
| emilsedgh wrote:
| You are right. All the good movements in tech happened ~20
| years ago. Free Software/Open Source, Wikipedia, etc, all date
| back to early days.
|
| Now it's all about that SaaS money.I don't mind the money part,
| but sadly, tech has become a gold mine for predators who smell
| the money and are out for blood.
| whoaisme wrote:
| Funny how it's obvious you're not a woman. 20 years ago if I
| groped a woman's ass or called or called my coworker Jose a
| wetback people would have clapped compared to today. And
| you're right, greedy predators like Gates and Ellison are a
| totally recent phenomenon. The past is better more noble and
| cleaner than the present. Honestly what a basic sentiment.
| dylan604 wrote:
| To me, there was something to say vs people posting shit just
| to meet a quota. There seems to be much less
| thought/research/editing of content now. It wasn't so gamefied
| before HTML2.0 and social.
| iso1210 wrote:
| Not convinced HTML2 'gamified' anything.
|
| "HTML 1" wasn't really a standard anyway and I don't remember
| what html2 actually brought - I remember not every browser in
| the mid 90s did tables, client side image maps etc but they
| were later additions to html2.
|
| Javascript (which came in with html 3.2) was far more of a
| step change than html2
| doublerabbit wrote:
| HTML5 brings incredible things to the table however with
| its taints of corporate presence and those who hold a
| dictation in direction. This is not "free".
|
| HTML doesn't have to be the only web transport. Build your
| browser and make your own protocol. IPFS is doing just
| fine.
|
| HTML4 was the last true free-release from any corporate
| grab. And it has everything youll ever need. However it
| just sits there forgotten taken by the glory of HTML5.
| bretthoerner wrote:
| I think they meant "Web 2.0"
| dylan604 wrote:
| Yes, you are correct. Totally meant Web2.0 when things
| became interactive and sites started allowing users to
| post comments and what not.
| zaptheimpaler wrote:
| By now the concept of competing for attention, for the limited
| 3-4 hours of free time you have a day is well known. To
| maximize engagement and clicks you just have to appeal to the
| shittiest parts of human nature - anger, fear, low attention
| spans. A few people figured out how to make the equivalent of
| cocaine (e.g outrage porn news, gamified social media) and now
| there is no going back - you compete with cocaine whether you
| like it or not. The more technical phrasing is that
| "intermittent variable rewards" are highly addictive - and this
| basically explains the entire design of social media or the
| shitty mobile games you see now.
|
| You can read statements/watch videos by Chamath Palihapitiya or
| Sean Parker admitting to this being an explicit strategy at
| Facebook. "Digital Minimalism" by Cal Newport is also a nice
| book that covers some of the same ground.
|
| If you ask me, our current way of managing society is a
| failure. You have large, well-coordinated organizations
| basically selling cocaine (fast food, youtube, social media,
| cigarettes) on end, but the other end (consumers) are
| necessarily less coordinated and informed because they don't
| operate within an organizational hierarchy with centralized
| decision making, shared knowledge and people dedicating 8 hours
| a day to maintaining those systems. Theoretically, companies
| live and die by how much value they create for their their
| customers. Practically, many companies resemble organized
| militia waging asymmetric warfare on unorganized masses in an
| increasingly zero-sum world.
|
| I think we need to focus a lot on organizing as people outside
| of the structure of a for-profit corporation. Theoretically the
| government plays this role but it's not enough.
|
| (inb4 omg you hate capitalism stupid commie)
| honzzz wrote:
| >> in an increasingly zero-sum world
|
| I don't understand this part - what do you mean by that? Why
| would the world be increasingly zero-sum?
| zaptheimpaler wrote:
| Most of the developed economies of the world have seen
| lower productivity growth since the booms after WW2 and
| have never recovered to previous levels. There are some
| arguments to be made that much of our current economic
| growth is artificial as well. The IT revolution has also
| not made much of a dent in overall productivity growth, at
| least as of yet - I don't know whether this is an artifact
| of how its measured, or the growth is yet to come, or
| perhaps there really isn't any growth. The bigger point is
| that our economies are simply not designed to work in a
| world where there is low growth [1]. In a zero growth
| world, the only way to make money is to take it from
| someone else, so you get more zero-sum behavior. The slow
| growth is also in line with what folks from the WEF are
| saying [2]
|
| [1] https://www.strongtowns.org/the-growth-ponzi-scheme
|
| [2] https://investmentmonitor.ai/global/the-urgent-case-
| for-stak...
| baby wrote:
| Very similar to the cryptocurrency field. Lots of noise
| nowadays.
| dannyw wrote:
| Bitcoin was born in the aftermath of the global financial
| crisis and the occupy wall street movement.[1] Events where,
| giant banks and institutions received trillions of dollars in
| unprecedented bail outs while 'main street' suffered with
| record unemployment, foreclosures, and destruction of small
| businesses.
|
| People rightfully realised that perhaps government should not
| have absolute and total control of the monetary supply and
| financial system. That a 'Plan B' may be in order.
|
| Unfortunately, today it's 90% people trying to get rich
| quick.
|
| [1]: https://en.bitcoin.it/wiki/Genesis_block
| cinquemb wrote:
| > Unfortunately, today it's 90% people trying to get rich
| quick.
|
| And that is, unsurprisingly (and quite banally), used by
| many detractors to dismiss it _all_ while handwaving away:
|
| > Bitcoin was born in the aftermath of the global financial
| crisis and the occupy wall street movement.[1] Events
| where, giant banks and institutions received trillions of
| dollars in unprecedented bail outs while 'main street'
| suffered with record unemployment, foreclosures, and
| destruction of small businesses.
|
| > People rightfully realised that perhaps government should
| not have absolute and total control of the monetary supply
| and financial system.
|
| Like people still hand wave away all the metadata and other
| work-arounds to compromising popular crypto systems that
| are highly touted because they are popular/convenient/etc
| or all the "get rich quick" mentality/motivations that
| exist outside of cryptocurrencies and have always
| existed...
| petters wrote:
| > And that is, unsurprisingly (and quite banally), used
| by many detractors to dismiss it all
|
| There is a stronger argument against crypto: the main use
| case (outside speculation) seems to be illegal
| activities. If what you are doing is legal, why not use
| government currency? If what you are doing is illegal,
| crypto is great. A currency outside the control of the
| government (police) is almost by definition made for
| illegal activities.
|
| In some countries, illegal activities are morally
| correct, though. Crypto helps here.
|
| But crypto has enabled entirely new types of crimes that
| did not exist before: ransomware.
|
| I have not completely for or against crypto. I am
| responding to your comment that people are dismissing
| because it seems like speculation only. I don't think
| that is true and that there are better reasons for
| dismissal?
| cinquemb wrote:
| If by trying to avoid aiding and abbeting the system
| described as:
|
| > ...giant banks and institutions received trillions of
| dollars in unprecedented bail outs [1] while 'main
| street' suffered with record unemployment, foreclosures,
| and destruction of small businesses.
|
| > People rightfully realized that perhaps government
| should not have absolute and total control of the
| monetary supply and financial system.
|
| Is defined as illegal in of itself by a government, then
| sure, there's no argument against dismissing it as
| illegal. Just like PGP falling under being illegal (from
| another comment) because it could exist as:
|
| > digital copies of the binaries and source code were
| prohibited for export as a munition
|
| There's no successful argument one can make against such
| illegality to said government. And I wouldn't bother,
| such people will never acquiesce if they haven't felt the
| lack of sufficient recourse to [1] (because they quite
| possibly may gain a lot of benefits by being indirectly
| or directly involved in [1])
|
| Luckily, reality isn't so rigid as to what people (or
| even other traditional governments abroad) will actually
| accept (then and now) and have sovereignty over deciding
| what they want for themselves and side stepping based on
| what can actually be enforced in totality in practice
| regardless of what any given institutionalized
| jurisdiction may think of it.
| dannyw wrote:
| 1. Why does FedEx exist? If what you are doing is legal,
| shouldn't you use USPS?
|
| 2. There are plenty of things that are federally illegal
| but many consider to be morally legal. Examples include,
| for example, weed dispensaries operating in states that
| have legislated cannabis.
|
| 3. What happens if a future government makes funding of
| ETE encrypted software, without CSAM scanning, illegal?
| ok_coo wrote:
| Money/Greed attracts a certain type of person who has different
| values, priorities, and interests.
|
| I think it mostly comes down to that.
| anyonecancode wrote:
| I agree with you, but my hypothesis is straightforward -- it's
| the money. The internet in particular, but tech more broadly,
| is now a mainstream industry, generating and attracting a lot
| of money. In the US, even a poorly paid SWE, for instance, is
| almost certainly making well above the median income. Decently
| paid SWEs make a lot more, and well paid SWES... And of course
| those who actually employ well paid SWEs and are only paying
| their developers the least they can get away with, while still
| paying them a lot, are obviously raking it in.
|
| There's good and bad in this, but it does clearly change
| things. When there's that much money on the line, ironically
| the stakes become higher and there's less genuine creativity
| and risk taking. The flip side is of course true -- too little
| money is a problem (I mean, I'm not about to trade my SWE gig
| for working in an Amazon warehouse as a means of spurring
| personal creativity), but given enough money past a certain
| baseline, things do change. There's a sweet spot at "enough
| money that people can feel free to be creative and take risks"
| and "so much money people are scared to take too many risks".
| danielschonfeld wrote:
| I am with you. But I think I know what it is, you touched on it
| and almost had it. It was indeed peace, we almost had it, world
| peace - feeling utopian and all loving in the 90s.
|
| Then came 9/11. It's the single point in history where just
| about everything to do with American society can be defined to
| be before and after.
|
| Doesn't matter what you think about the event and it's
| authenticity as described, the fact of the matter is that
| America as a country has been locked in this sort of country
| wide PTSD since and have changed completely. Along with it went
| peace, calmness, secularism, egalitarianism and altruism. We're
| constantly the hunted now, the ones who need security,
| everything needs to be dumbed down, so called common sense
| rules and it better be mine common sense and not yours. And on
| and on it goes. We're operating like a demented, schizophrenic
| who has woken up from a nightmare every day of their lives and
| have lost the fact they are living in their head instead of in
| the real world.
| jeofken wrote:
| > Doesn't matter what you think about the event and it's
| authenticity as described
|
| Interesting small mention. Is it common in America to
| disbelieve in the mainstream history of 9/11? I'm just
| getting glimpses from the new world via the internet and have
| no ear to the ground there
| tenaciousDaniel wrote:
| I'm not sure what the original commenter was talking about,
| but no, it's not. There is vast agreement in the US about
| what happened.
| danielschonfeld wrote:
| Not as vast as you think [1]. Also as of late it appears
| the victims don't want their president there in their
| 20th reunion for similar reasons.
|
| [1] https://en.m.wikipedia.org/wiki/Opinion_polls_about_9
| /11_con...
| danielschonfeld wrote:
| The answer to that is a personal one and I suggest for
| anybody on either side of any argument to recall
| Nietzsche's saying - Convictions are more dangerous foes of
| truth than lies.
| u801e wrote:
| > America as a country has been locked in this sort of
| country wide PTSD since and have changed completely.
|
| Population wise, that was the case for a number of years
| after 9/11. In terms of government policy, it's still the
| case. But in terms of the former, it's fading away as more
| time passes. People who were born in 2001 are or will turn 20
| this year. Just like events like the attack on pearl harbor
| and the Cuban missle crises, 9/11 will also become an event
| that's just known by reading history rather than a first hand
| experience.
| dTal wrote:
| They won't remember the transition or really realize it
| happened, but the cultural echoes last a hell of a lot
| longer than direct memory of the event. Hell, the
| reverberations of the civil war still echo today.
| damagednoob wrote:
| > It was indeed peace, we almost had it, world peace -
| feeling utopian and all loving in the 90s.
|
| Think you might need to qualify that. The mid-90s saw the
| Bosnian and Rwandan genocides.
| danielschonfeld wrote:
| It won't be the first time in history, Americans and with
| them the "western" world turned a blind eye to who's backs
| their hedonistic party was carried over.
|
| If you look at what was life like. What people cared about.
| What songs sang about. What households looked like. War was
| as far a concept from the average American.
|
| Sure we had the gulf war early 90s. We had Bosnia during
| Clinton years. But most Americans were more concerned with
| becoming stock traders from home, saving willy and the
| earth and how Clinton's cigars were used.
|
| Americans bombers dropping bombs by the ton to the backdrop
| of western advancement has almost become an expectation in
| our campaign of spreading our brand of democracy and its
| freedoms or else.
| monoideism wrote:
| > We had Bosnia during Clinton years.
|
| Oppose them or support them, it was literally American
| bombing campaigns that stopped the Bosnian genocide and
| the ethnic cleansing of Kosovo.
| danielschonfeld wrote:
| Admittedly the Yugoslav wars are not my strong suit in
| history, but if protecting genocide is all that is
| American, it makes you wonder where have we been the past
| decade when it came to Yemen. Same with the Uyghurs in
| China. Same with the civil war in Syria. I can list a few
| more...
|
| Feels like there was something more that led America to
| Bosnia, and it wasn't just our benevolence and saving the
| world from itself.
| monoideism wrote:
| > Feels like there was something more that led America to
| Bosnia, and it wasn't just our benevolence and saving the
| world from itself.
|
| There was a lot of pressure to "do something" in the
| Balkans, and the military wasn't averse to showing off
| its goods, so something was done. Imagine the media
| pressure with Yemen x1000. That was Bosnia and Kosovo
| (probably mostly because it was in Europe).
|
| Also, US military _has_ intervened militarily in Syria,
| many times, and even with troops on the ground. Did you
| miss it?
|
| The Uyghurs are a poor analogy, because despite the
| intense oppression they're under, they're not being mass-
| murdered. And a humanitarian intervention in China due to
| Uyghur situation is just not in the cards, because
| realism.
|
| So sure, Bosnia+Kosovo interventions weren't just
| "benevolence". It was a convergance of factors (power
| dynamics, US President open to idea, media+public
| pressure, limiting intervention to air campaign, etc).
| But it wasn't an oil pipeline or some ridiculous
| conspiracy, either, like I sometimes hear.
| keewee7 wrote:
| >Then came 9/11
|
| The rising pessimism and negativity since 2008/09 is a global
| phenomenon. I think it's wrong and very US-centric to
| attribute that to 9/11.
|
| The 2008 financial crisis and the rise of social media has
| probably more to do with the rise of millennial pessimism and
| negativity.
| phone8675309 wrote:
| I think the 2008 financial crisis showed most millennials
| that they would never be able to own anything of real worth
| and value from their work alone, that they would not accrue
| their own generational wealth but instead inherit from
| their parents (if they inherit at all), and that unless
| you're born into the big club, are useful to the big club,
| or are a massive outlier, that hard work and personal
| sacrifice will not materially improve your condition in
| life.
|
| At least that's what I got from it as an "elder millennial"
| (born in the very early 1980s).
| artursapek wrote:
| I agree, I think the difference is that in 1999 when he
| wrote that piece, there wasn't a clear audience in front of
| him that could react immediately. Nowadays, everything that
| gets written is immediately posted into social networks to
| be given instant gratification.
| ditonal wrote:
| I wouldn't understate the role of companies like Google
| that pioneereed "exploiting idealism as a PR strategy." The
| IPO listing claimed "Google is not a conventional company
| and does not intend to become one" and their recruiting tag
| line was "Do cool things that matter." They leaned hard
| into social issues like gay marriage and paid lip service
| to FOSS and hacker pet topics. But over time they've shown
| willingness to sacrifice any amount of user privacy,
| willingness to censor and suppress, willingness to
| illegally collude against labor, and willingness to embrace
| special rules to protect elites in their club.
|
| People nowadays complain that gay pride parades have gotten
| too corporate, but especially by companies that are willing
| to exploit people in other ways. But this is simply the
| playbook Google pioneered, to take good will around certain
| social issues and use it as a decoy while you pick people's
| pockets and put your boot on their face. I don't think we
| can understate the extent to which good causes have been
| infiltrated by bad corporate actors and how much that had
| undermined our trust in our communities.
| panta wrote:
| We had worse crises before that didn't change societies so
| deeply. With 9/11 we started renouncing to the concept of
| freedom that we gained with illuminism and the French
| revolution. Then we started putting "safety" before
| everything else.
| fakesheriff wrote:
| > Then we started putting "safety" before everything
| else.
|
| One caveat.
|
| It's safety first, unless they decide to go to war to
| ensure continued access to cheap commodities (Iraq) or to
| play weird sociopath power games (Vietnam).
|
| It's going to be kind of rich when they ask people from
| podunk towns in "flyover country" to go fight their next
| war, after years of ridiculing them and decimating their
| local economies.
| cygx wrote:
| _We had worse crises before that didn't change societies
| so deeply_
|
| During the Red Scare, loyalty review boards were
| instituted and civil servants insufficiently 'American'
| were sacked in the thousands.
| mbreese wrote:
| But there isn't a singular date to associate with the Red
| Scare... that's more a nebulous period of time. It was
| also a gradual process. The West was already preparing
| for the oncoming cold-war with the USSR before the end of
| WW2.
|
| The loyalty boards and Hollywood blacklisting were
| definitely a change is society, but it was so slow moving
| that I wouldn't compare it to a shift like 9/11.
|
| The world wasn't really different before and after
| something like the hearings of the House Un-American
| Activities Committee, even though that is what would be a
| likely event you'd associate with the Red Scare.
|
| When I think of 20th century cultural events that had an
| shift in society, I think more of the Cuban missile
| crisis, the Challenger disaster, the fall of the Berlin
| wall, etc... shorter events (not necessarily
| instantaneous, but well defined times) where you could
| define shifts in culture to before/after.
| dTal wrote:
| Change can still be change without being sudden.
| danielschonfeld wrote:
| I agree with the poster below me.
|
| While the financial crisis might be more of a root of all
| problems in Millenial and generations that followed minds
| it's not where it all started (I am a Millenial)
|
| Also don't forget 2008 was the year of the iPhone. The year
| we started inching towards being an always on society.
| goodoldneon wrote:
| 9/11 is an inflection point in modern day America, but there
| have been other equal/greater inflection points.
| Revolutionary War, Civil War, WW2... lots of war
| nmg wrote:
| Absolutely, and wars waged without declaration that were
| equally traumatic. Within the lifetime of the Internet, I
| think 9/11 is the major inflection
| Abishek_Muthian wrote:
| I think much of it has to do with that they were originally
| written for books, magazines with thorough editorial practices
| and a reputation to preserve.
|
| 'Richard Feynman and The Connection Machine'[1] another HN
| favorite comes to my mind. It was originally written for
| Physics Today magazine.
|
| I don't think it's limited to only long form content, Even
| today printed news papers which have been in existence for
| >=~100 years does have better quality of writing than online
| content(even from the same news media) due to some resemblance
| of their editorial practices.
|
| But all those printed newspapers are on the verge of bankruptcy
| or already dead. Their online counterpart is now only concerned
| with how many articles can be published/hour, There's not even
| proof reading because of this as they have to please Google,
| Facebook, Apple for those screen time.
|
| I've noticed when I give interviews to online news the writer
| often has to work with their web-admin to fix errors in my
| statements after publishing(when it's different from what I
| actually said)and often it takes several hours if it even
| happens. Where as in printed news papers had the habit of error
| correction in the next issue.
|
| [1] https://longnow.org/essays/richard-feynman-connection-
| machin...
| throwaway984393 wrote:
| It was a different time. The people writing these things were
| more nerdy and more mature. The social internet hadn't taken
| over. People weren't concerned with votes, stars, comments,
| likes, splashiness, attention, or trading funny pictures of
| cats. You could take your time to write something considered
| just because you needed to get the information down. Software
| projects were idealistic because most software out there was
| proprietary and expensive; paid software was an entrepreneurial
| risk, and free software was transgressive.
|
| If a culture is popular, it tends to saturate. The old internet
| simply couldn't compete with the new one.
| [deleted]
| dang wrote:
| Some past threads:
|
| _Why I Wrote PGP (1999)_ -
| https://news.ycombinator.com/item?id=10581971 - Nov 2015 (47
| comments)
|
| _Why I Wrote PGP (1999)_ -
| https://news.ycombinator.com/item?id=6823668 - Nov 2013 (109
| comments)
| bariswheel wrote:
| 'The only way to hold the line on privacy in the information age
| is strong cryptography.'
| Gradient-Ascent wrote:
| Everything is hackable. Connect a computer to the internet and
| you basically have lost.
|
| We know that today, encryption isn't the final solution when
| there are hackers and social engineering.
| IanClarke wrote:
| Everything is hackable.
|
| Connect a computer to the internet and you basically have lost.
|
| We know that today, encryption isn't the final solution when
| there are hackers and social engineering.
| cowmix wrote:
| I have sooooo many lost emails due to lost pgp configurations.
| Encrypted blobs in my mail spools.
| nolok wrote:
| The fact that you couldn't restore no matter what without the
| key speaks for pgp rather than against, in my book.
|
| By comparison I have very little trust in modern IM software.
| approxim8ion wrote:
| Do you think I could restore an encrypted signal backup
| without the key?
| nolok wrote:
| You missed my point which was not about whether you could,
| but about whether someone else could, either from your
| backup or from a entirely different copy they could have
| acquired during the original transmission.
|
| Same way I wouldn't trust a gmail/outlook/whatever-apple-
| named-theirs automatic mail encryption the way I can trust
| a bulky weird to use pgp one.
| Gradient-Ascent wrote:
| Today's analogy is bitcoin... Will all Bitcoin just be lost one
| day, because all keys get lost?
|
| I am aware that "there are solutions", but are they (really)
| enough? Isn't "breaking in" required at some point?
|
| Another endgame for Bitcoin is that all Bitcoin are stolen
| through the one tool which helps with ("unbreakable")
| encryption: Hacking / social engineering.
|
| Besides that we hab substantial discussions about why PGP isn't
| really cutting it for use with email (to cumbersome, at one
| point you lose your private key, recipient struggles to
| decrypt, etc.).
| artursapek wrote:
| More and more Bitcoin is going to be held by custodians, like
| crypto exchanges, retail trading apps like Robinhood, and
| even traditional banks. Handling your own Bitcoin keys will
| end up being a niche cypherpunk thing, like using command-
| line PGP. It's actually a perfect analogy, because most
| popular "E2EE" chat apps are also custodial with your keys.
| Gradient-Ascent wrote:
| You don't own your bitcoin then (if you are not the only
| one who has the key) - Elon Musk pointed that out. The
| custodian owns your Bitcoin (and can run away with them or
| also lose the key).
| IanClarke wrote:
| Today's analogy is bitcoin...
|
| Will all Bitcoin just be lost one day, because all keys get
| lost?
|
| I am aware that "there are solutions", but are they (really)
| enough? Isn't "breaking in" required at some point?
|
| Another endgame for Bitcoin is that all Bitcoin are stolen
| through the one tool which helps with (unbreakable) encryption:
| Hacking / social engineering.
|
| Besides that we hab substantial discussions about why PGP isn't
| really cutting it for use with email (to cumbersome, at one
| point you lose your private key, recipient struggles to
| decrypt, etc.).
| [deleted]
| lottin wrote:
| According to the legend, they weren't allowed to publish PGP on
| the internet because US laws forbade exporting of cryptographic
| tools, so they made a book with the entire source code and
| shipped that overseas.
| caf wrote:
| As I heard it at the time, they had to actually physically
| carry the book overseas.
| jrochkind1 wrote:
| It's not a legend, it's easy enough to confirm.
|
| https://philzimmermann.com/EN/essays/BookPreface.html
| pawal wrote:
| Yes, export regulations were heavy back then. To have proper
| SSL in your Netscape, you had to import this patch file from
| Australia. And then we had this whole Crypto Wars thing going
| on. Look at Steven Levy's excellent book on the subject, or
| search on the Wired archives.
| atoav wrote:
| I wouldn't call it legend, it was released via MIT press. See:
| https://en.m.wikipedia.org/wiki/Pretty_Good_Privacy
| jonathankoren wrote:
| My undergrad university library has (had?) a bound copy of PGP
| source code on the stacks for checkout.
|
| If I remember correctly, digital copies of the binaries and
| source code were prohibited for export as a munition, but
| publishing the source code in a book, made it a book, and thus
| eligible for export.
| j0e1 wrote:
| > But while technology infrastructures can persist for
| generations, laws and policies can change overnight. Once a
| communications infrastructure optimized for surveillance becomes
| entrenched, a shift in political conditions may lead to abuse of
| this new-found power. Political conditions may shift with the
| election of a new government, or perhaps more abruptly from the
| bombing of a federal building.
|
| Prescient.
| b0rsuk wrote:
| The technotronic era involves the gradual appearance of a more
| controlled society. Such a society would be dominated by an
| elite, unrestrained by traditional values. Soon it will be
| possible to assert almost continuous surveillance over every
| citizen and maintain up-to-date complete files containing even
| the most personal information about the citizen. These files
| will be subject to instantaneous retrieval by the authorities.
|
| (Zbigniew Brzezinski, Between Two Ages, 1971)
| forcry wrote:
| Vaccine mandates comes to mind.
|
| Imagine Hitler had mandatory vaccines at his disposal, set in
| place by some benevolent administration for a seemingly good
| cause. He wouldn't have needed gas chambers that just does not
| scale as much.
| dang wrote:
| We've banned this account for posting the same things over
| and over. Single-purpose accounts are not allowed here, and
| using the site primarily for political/ideological battle is
| also not allowed here.
|
| Please don't create accounts to break HN's rules with.
|
| https://news.ycombinator.com/newsguidelines.html
| forcry wrote:
| So I posted a response to your comment that got instantly
| flagged and hidden. Wonder if HN employs automatic scanning and
| flagging for keywords.
| tptacek wrote:
| I guess. Pretty much everyone was saying that back then.
| arminiusreturns wrote:
| From an old comment of mine on the topic:
|
| https://youtu.be/sKOk4Y4inVY?t=518 [1]
|
| 1. "In 1995, there was a debate at Harvard Law School - four of
| us discussing the future of public key encryption and its
| control. I was on the side, I suppose, of freedom. It's where I
| try to be. With me at that debate was a man called Daniel
| Weitzner who now works in the White House making Internet policy
| for the Obama administration.
|
| On the other side was the then Deputy Attorney General of the
| United States and a lawyer in private practice named Stewart
| Baker who had been chief council to the National Security Agency,
| our listeners, and who was then in private life helping
| businesses to deal with the listeners. He then became, later on,
| the deputy for policy planning in the Department of Homeland
| Security in the United States and has much to do with what
| happened in our network after 2001.
|
| At any rate, the four of us spent two pleasant hours debating the
| right to encrypt and at the end there was a little dinner party
| at the Harvard faculty club, and at the end, after all the food
| had been taken away and just the port and the walnuts were left
| on the table, Stuart said, "All right, among us now that we are
| all in private, just us girls, I'll let our hair down."
|
| He didn't have much hair even then, but he let it down.
|
| "We are not going to prosecute your client, Mr. Zimmermann," he
| said. "Public key encryption will become available. We fought a
| long, losing battle against it, but it was just a delaying
| tactic." And then he looked around the room and he said, "But
| nobody cares about anonymity, do they?"
|
| And a cold chill went up my spine and I thought, all right,
| Stuart, and now I know you're going to spend the next twenty
| years trying to eliminate anonymity in human society and I am
| going to try to stop you and we'll see how it goes.
|
| And it's going badly. We didn't build the net with anonymity
| built in. That was a mistake. Now we are paying for it." -Eben
| Moglen
| vbezhenar wrote:
| Tor is the anonymous net. It might be not perfect against
| targeting state-level attackers, but generally it works and
| delivers its promise.
| user3939382 wrote:
| > it works
|
| Does it? Dragnet surveillance might not easily inspect all
| Tor traffic, but it can easily see who is using it, flag
| those identities, and put them on a list for increased
| scrutiny. Unless a major web browser has it enabled by
| default, I don't see it delivering on its promise.
| IggleSniggle wrote:
| > What if everyone believed that law-abiding citizens
| should use postcards for their mail? If a nonconformist
| tried to assert his privacy by using an envelope for his
| mail, it would draw suspicion. Perhaps the authorities
| would open his mail to see what he's hiding. Fortunately,
| we don't live in that kind of world, because everyone
| protects most of their mail with envelopes. So no one draws
| suspicion by asserting their privacy with an envelope.
| There's safety in numbers. Analogously, it would be nice if
| everyone routinely used encryption for all their email,
| innocent or not, so that no one drew suspicion by asserting
| their email privacy with encryption. Think of it as a form
| of solidarity.
|
| ----
|
| I agree with you. And also perhaps those of us with nothing
| to hide really need to spend more time on Tor
| phone8675309 wrote:
| The fact that the inventor of onion routing technology from
| the United States Naval Research Laboratory was involved in
| the creation of Tor pretty much ensures that Tor will be
| useless at evading 5 Eyes and equivalent nation-state actors.
|
| If they've not come at you when you're using Tor then it's
| that they don't care to find you. It's not that they can't
| find you.
| pydry wrote:
| The fact it is state built and state funded doesnt give me
| confidence that it protects you against state level
| adversary.
| vbezhenar wrote:
| They built it for their spies, so they can exchange
| information without traces. And they popularize it, so
| metadata analysis becomes useless. It's unlikely to have
| vulnerabilities, because other states could find and use
| them.
| breput wrote:
| Matthew Green does a pretty good job picking apart PGP's issues,
| although he completely fails at suggesting alternatives and also
| completely ignores non-email use cases.
|
| https://blog.cryptographyengineering.com/2014/08/13/whats-ma...
| jwr wrote:
| I am so tired of crypto experts criticizing PGP without
| suggesting an alternative. So much has been written, so many
| soapboxes have been climbed on, and yet there seems to be no
| good replacement.
|
| I deeply respect Philip Zimmermann for creating "pretty good
| privacy" rather than trying for "perfect privacy". PGP is
| exactly that: pretty good. Not great, not perfect, but pretty
| good indeed. And it's there. And it works. It's a compromise,
| which works well for many people's requirements. Oh, and did I
| mention that it EXISTS?
|
| I use PGP every day. My private keys are stored on Yubikeys,
| which is supported. I have offline backups of those, which is
| supported, too. I can encrypt my backups for multiple keys,
| sign lists of hashes of files to verify integrity, and people
| can send me private E-mail.
|
| None of this works perfectly, but it does work, and (not being
| a teenager anymore) I appreciate the fact that PGP has worked
| since 1991 or so, and I can reasonably expect it to work for
| the rest of my lifetime, unlike much modern software, which
| while being incredibly fashionable, seems to flare out a couple
| of years later.
| e2e8 wrote:
| This article present some alternatives to PGP.
| https://latacora.micro.blog/2019/07/16/the-pgp-problem.html
| tptacek wrote:
| There isn't "an" alternative to PGP, because the idea of a
| single tool like PGP that covers all the use cases PGP attempts
| to cover has been revealed to be bankrupt. PGP does a bad job
| at practically everything it's applied to, because different
| problem domains ask different things from their cryptography.
| Backup tools want deduplication. Secure messaging wants
| relentless forward secrecy. Package signing systems want short,
| simple signatures --- meanwhile, messaging systems want
| authenticated key exchanges _without_ signatures. Sometimes you
| want non-repudiation, but often you want the opposite.
|
| To put this in perspective, it's a little like someone invented
| a bad balanced binary tree before anybody else came up with a
| hash table or a radix tree or a heap, and then a weird
| subculture formed around that balanced binary tree based on the
| idea that you should only ever use that tree algorithm, even
| though someone subsequently came up with red-black trees that
| were superior in every way to the original.
| pvg wrote:
| _it 's a little like someone invented a bad balanced binary
| tree_
|
| It's a little like that culturally but it's almost entirely
| unlike that technically - a suboptimal data structure or algo
| tend to be just suboptimal-but-functional whereas bad
| cryptography and bad cryptography engineering often fail
| catastrophically. I know you know this, of course! But for
| one thing, someone used an iffy analogy on the internet, etc.
| For another, PGP people love misusing exactly this sort of
| analogy.
| tptacek wrote:
| I'd use the analogy of "someone came up with C and then
| people came up with high level languages and even low-level
| languages that provided memory safety and..." but then we'd
| just be in another debate about how mired in the 1980s we
| should remain. :)
| 9387367 wrote:
| Have you written anything on proposed solutions? That
| would be an interesting read if you have.
| aborsy wrote:
| With attacks on encryption and privacy by governments and big
| companies, we need more tools such as PGP.
|
| The user should hold the keys, not a government or company.
|
| Technical aspects are generally secondary, and should improve,
| but we shouldn't dismiss good approaches due to implementation
| details.
| breput wrote:
| You're absolutely correct. But unless the tools are designed
| so the average user can easily manage their own keys, it's
| basically PGP again.
|
| I think U2F/WebAuthn dongles actually could solve this
| problem but there are all sorts of new problems now like "how
| do I use this with my iPhone and also with my PC" or "what
| happens when lose my (physical) keychain with my dongle".
| toastal wrote:
| Not necessarily an endorsement (although I do own one),
| OnlyKey lets you store and use PGP keys in this way as well
| as U2F, OTP, etc.
| tptacek wrote:
| This is an especially funny thing to say when you compare
| the number of daily users Signal --- itself a niche
| cryptosystem --- has to PGP.
| breput wrote:
| The Signal protocol is very well designed but the
| implementation requires a telephone number (I know it is
| coming). That's a step removed from PGP which can be
| completely offline.
| tptacek wrote:
| That's interesting and all, but my point is just that
| you'll have to stop and think about _how many_ orders of
| magnitude separate the userbase sizes.
|
| A simpler way to make the same point would be that
| relative to modern cryptography, to a first
| approximation, _nobody_ uses PGP.
| breput wrote:
| Maybe only the _right_ people use PGP.
| tptacek wrote:
| I honestly have no trouble believing that's what PGP's
| userbase believes about themselves, which is absolutely
| part of the problem.
| UncleMeat wrote:
| Safe communication should be available to everybody.
| Given how many professional engineers botch PGP at some
| point, it isn't exactly a great option for people like
| journalists who may need to depend on it with their
| lives.
|
| "Don't worry, these few thousand techies are the only
| ones that need secure communication" is sheer arrogance.
| approxim8ion wrote:
| That's fine, but even the "right" people need to interact
| with the "unwashed masses" sometimes. If your
| cryptosystem isn't readily accessible to everyone, it's
| kind of useless.
| JoachimSchipper wrote:
| A good point, but one addition: nobody _directly_ uses
| PGP.
|
| While Debian and other package signing continues to use
| PGP (and yes, Debian may move away, and signify/minisign
| is preferable) there are lots of "infrastructure" uses.
| aborsy wrote:
| Funny term, "niche cryptosystem"
|
| It's like a frog, which is about to beat a frog with a
| wand, frog says, come on, I am already a frog!
| upofadown wrote:
| OpenPGP implementations suck for usability. All the other
| messaging implementations also suck for usability.
|
| Having obscure arguments about the underlying cryptography is
| fun and all, but doesn't really make the world a better place.
| TeeMassive wrote:
| Is there a good websites listing the ways being spied on can
| affect you personally?
|
| Would be great every time a "I don't care if the NSA watch my
| dick picks, bro" naive person bring this to my face again.
| pdkl95 wrote:
| In addition to the reason already mentioned, one of the most
| important reasons privacy is _necessary_ is how people -
| especially _children_ - discover new aspects of their own
| identity, personality, and interests.
|
| Children will _experiment_ when they think their parents aren
| 't watching. Freedom to experiment and explore their
| interaction with the world is obviously very important for
| children, but this use of privacy never really goes away.
| Consider if you wanted to learn an instrument but have never
| played music before (or any other difficult skill). You
| probably want the _freedom to practice badly_ for a while. If
| you had to practice knowing people were watching you, would you
| feel as free to experiment learning this type of skill?
|
| Problems of abuse and power are obviously very important
| concerns. However, I believe the _chilling effect_ surveillance
| has on people will cause a major shift away from people
| experimenting with learning new things and exploring their
| hobbies will become an insidious, system damage to culture and
| social liberty.
| [deleted]
| imiric wrote:
| Not really a website, but this paper[1] breaks down and refutes
| the "I've got nothing to hide" argument quite well.
|
| [1]: https://papers.ssrn.com/sol3/papers.cfm?abstract_id=998565
| atoav wrote:
| Well my main reasons outside them are:
|
| A) Abuse. The assumption that only true, evil crimes mean
| surveilance technology will be used is wrong. It will be used
| to harass partners, exes, famous people, activists,
| journalists, people with the wrong skin tone etc. In fact all
| of this happened already.
|
| B) Power. Giving a government global surveilance capabilities
| also increases it's power into a realm where the government's
| nature will change. It will declare things being its business
| that were formely none of its business. It will go good for a
| while because our aystems change slowly, but at one point
| authotarians will take power and then you provided them with
| the perfect tool to target, assassinate, control and enforce.
|
| C) Vulnerable groups. There are certain professions and groups
| that enjoy protection from government spying for a good reason.
| If you accept surveilance for yourself, you are also accepting
| it for them. And the next time you might really need your
| client-attorny-priviledge or your doctor-patient communication
| to stay private, it might be too late.
|
| These are mostly "systemical" perspectives, but they are much
| stronger for me than "It is gross, they should not watch it".
___________________________________________________________________
(page generated 2021-08-08 23:02 UTC)