LAST MONTH, I met Edward Snowden in a hotel in central Moscow, just blocks away from Red Square. It was the first time we’d met in person; he first emailed me nearly two years earlier, and we eventually created an encrypted channel to journalists Laura Poitras and Glenn Greenwald, to whom Snowden would disclose overreaching mass surveillance by the National Security Agency and its British equivalent, GCHQ.
This time around, Snowden’s anonymity was gone; the world knew who he was, much of what he’d leaked, and that he’d been living in exile in Moscow, where he’s been stranded ever since the State Department canceled his passport while he was en route to Latin America. His situation was more stable, the threats against him a bit easier to predict. So I approached my 2015 Snowden meeting with less paranoia than was warranted in 2013, and with a little more attention to physical security, since this time our communications would not be confined to the internet.
Our first meeting would be in the hotel lobby, and I arrived with all my important electronic gear in tow. I had powered down my smartphone and placed it in a “faraday bag” designed to block all radio emissions. This, in turn, was tucked inside my backpack next to my laptop (which I configured and hardened specifically for traveling to Russia), also powered off. Both electronic devices stored their data in encrypted form, but disk encryption isn’t perfect, and leaving these in my hotel room seemed like an invitation to tampering.
Most of the lobby seats were taken by well-dressed Russians sipping cocktails. I planted myself on an empty couch off in a nook hidden from most of the action and from the only security camera I could spot. Snowden had told me I’d have to wait awhile before he met me, and for a moment I wondered if I was being watched: A bearded man wearing glasses and a trench coat stood a few feet from me, apparently doing nothing aside from staring at a stained-glass window. Later he shifted from one side of my couch to the other, walking away just after I made eye contact.
Eventually, Snowden appeared. We smiled and said good to see you, and then walked up the spiral staircase near the elevator to the room where I would be conducting the interview, before we really started talking.
It also turns out that I didn’t need to be quite so cautious. Later, he told me to feel free to take out my phone so I could coordinate a rendezvous with some mutual friends who were in town. Operational security, or “opsec,” was a recurring theme across our several chats in Moscow.
In most of Snowden’s interviews he speaks broadly about the importance of privacy, surveillance reform, and encryption. But he rarely has the opportunity to delve into the details and help people of all technical backgrounds understand opsec and begin to strengthen their own security and privacy. He and I mutually agreed that our interview would focus more on nerdy computer talk and less on politics, because we’re both nerds and not many of his interviews get to be like that. I believe he wanted to use our chats to promote cool projects and to educate people. For example, Snowden had mentioned prior to our in-person meeting that he had tweeted about the Tor anonymity system and was surprised by how many people thought it was some big government trap. He wanted to fix those kinds of misconceptions.
Our interview, conducted over room-service hamburgers, started with the basics.
Micah Lee: What are some operational security practices you think everyone should adopt? Just useful stuff for average people.
Edward Snowden: [Opsec] is important even if you’re not worried about the NSA. Because when you think about who the victims of surveillance are, on a day-to-day basis, you’re thinking about people who are in abusive spousal relationships, you’re thinking about people who are concerned about stalkers, you’re thinking about children who are concerned about their parents overhearing things. It’s to reclaim a level of privacy.
We should not live lives as if we are electronically naked.
Lee: What do you think about Tor? Do you think that everyone should be familiar with it, or do you think that it’s only a use-it-if-you-need-it thing?
Snowden: I think Tor is the most important privacy-enhancing technology project being used today. I use Tor personally all the time. We know it works from at least one anecdotal case that’s fairly familiar to most people at this point. That’s not to say that Tor is bulletproof. What Tor does is it provides a measure of security and allows you to disassociate your physical location. …
But the basic idea, the concept of Tor that is so valuable, is that it’s run by volunteers. Anyone can create a new node on the network, whether it’s an entry node, a middle router, or an exit point, on the basis of their willingness to accept some risk. The voluntary nature of this network means that it is survivable, it’s resistant, it’s flexible.
[Tor Browser is a great way to selectively use Tor to look something up and not leave a trace that you did it. It can also help bypass censorship when you’re on a network where certain sites are blocked. If you want to get more involved, you can volunteer to run your own Tor node, as I do, and support the diversity of the Tor network.]
Lee: So that is all stuff that everybody should be doing. What about people who have exceptional threat models, like future intelligence-community whistleblowers, and other people who have nation-state adversaries? Maybe journalists, in some cases, or activists, or people like that?
Snowden: So the first answer is that you can’t learn this from a single article. The needs of every individual in a high-risk environment are different. And the capabilities of the adversary are constantly improving. The tooling changes as well.
What really matters is to be conscious of the principles of compromise. How can the adversary, in general, gain access to information that is sensitive to you? What kinds of things do you need to protect? Because of course you don’t need to hide everything from the adversary. You don’t need to live a paranoid life, off the grid, in hiding, in the woods in Montana.
What we do need to protect are the facts of our activities, our beliefs, and our lives that could be used against us in manners that are contrary to our interests. So when we think about this for whistleblowers, for example, if you witnessed some kind of wrongdoing and you need to reveal this information, and you believe there are people that want to interfere with that, you need to think about how to compartmentalize that.
Tell no one who doesn’t need to know. [Lindsay Mills, Snowden’s girlfriend of several years, didn’t know that he had been collecting documents to leak to journalists until she heard about it on the news, like everyone else.]
When we talk about whistleblowers and what to do, you want to think about tools for protecting your identity, protecting the existence of the relationship from any type of conventional communication system. You want to use something like SecureDrop, over the Tor network, so there is no connection between the computer that you are using at the time — preferably with a non-persistent operating system like Tails, so you’ve left no forensic trace on the machine you’re using, which hopefully is a disposable machine that you can get rid of afterward, that can’t be found in a raid, that can’t be analyzed or anything like that — so that the only outcome of your operational activities are the stories reported by the journalists. [SecureDrop is a whistleblower submission system. Here is a guide to using The Intercept’s SecureDrop server as safely as possible.]
And this is to be sure that whoever has been engaging in this wrongdoing cannot distract from the controversy by pointing to your physical identity. Instead they have to deal with the facts of the controversy rather than the actors that are involved in it.
Lee: What about for people who are, like, in a repressive regime and are trying to …
Snowden: Use Tor.
Lee: Use Tor?
Snowden: If you’re not using Tor you’re doing it wrong. Now, there is a counterpoint here where the use of privacy-enhancing technologies in certain areas can actually single you out for additional surveillance through the exercise of repressive measures. This is why it’s so critical for developers who are working on security-enhancing tools to not make their protocols stand out.
Lee: So you mentioned that what you want to spread are the principles of operational security. And you mentioned some of them, like need-to-know, compartmentalization. Can you talk more about what are the principles of operating securely?
Snowden: Almost every principle of operating security is to think about vulnerability. Think about what the risks of compromise are and how to mitigate them. In every step, in every action, in every point involved, in every point of decision, you have to stop and reflect and think, “What would be the impact if my adversary were aware of my activities?” If that impact is something that’s not survivable, either you have to change or refrain from that activity, you have to mitigate that through some kind of tools or system to protect the information and reduce the risk of compromise, or ultimately, you have to accept the risk of discovery and have a plan to mitigate the response. Because sometimes you can’t always keep something secret, but you can plan your response.
Lee: Are there principles of operational security that you think would be applicable to everyday life?
Snowden: Yes, that’s selective sharing. Everybody doesn’t need to know everything about us. Your friend doesn’t need to know what pharmacy you go to. Facebook doesn’t need to know your password security questions. You don’t need to have your mother’s maiden name on your Facebook page, if that’s what you use for recovering your password on Gmail. The idea here is that sharing is OK, but it should always be voluntary. It should be thoughtful, it should be things that are mutually beneficial to people that you’re sharing with, and these aren’t things that are simply taken from you.
If you interact with the internet … the typical methods of communication today betray you silently, quietly, invisibly, at every click. At every page that you land on, information is being stolen. It’s being collected, intercepted, analyzed, and stored by governments, foreign and domestic, and by companies. You can reduce this by taking a few key steps. Basic things. If information is being collected about you, make sure it’s being done in a voluntary way.
For example, if you use browser plugins like HTTPS Everywhere by EFF, you can try to enforce secure encrypted communications so your data is not being passed in transit electronically naked.
Lee: Do you think people should use adblock software?
Snowden: Yes.
Everybody should be running adblock software, if only from a safety perspective …
Lee: Nice. So there’s a lot of esoteric attacks that you hear about in the media. There’s disk encryption attacks like evil maid attacks, and cold-boot attacks. There’s all sorts of firmware attacks. There’s BadUSB and BadBIOS, and baseband attacks on cellphones. All of these are probably unlikely to happen to many people very often. Is this something people should be concerned about? How do you go about deciding if you personally should be concerned about this sort of attack and try to defend against it?
Snowden: It all comes down to personal evaluation of your personal threat model, right? That is the bottom line of what operational security is about. You have to assess the risk of compromise. On the basis of that determine how much effort needs to be invested into mitigating that risk.
Now in the case of cold-boot attacks and things like that, there are many things you can do. For example, cold-boot attacks can be defeated by never leaving your machine unattended. This is something that is not important for the vast majority of users, because most people don’t need to worry about someone sneaking in when their machine is unattended. … There is the evil maid attack, which can be protected against by keeping your bootloader physically on you, by wearing it as a necklace, for example, on an external USB device.
You’ve got BadBIOS. You can protect against this by dumping your BIOS, hashing it (hopefully not with SHA1 anymore), and simply comparing your BIOS. In theory, if it’s owned badly enough you need to do this externally. You need to dump it using a JTAG or some kind of reader to make sure that it actually matches, if you don’t trust your operating system.
There’s a counter to every attack. The idea is you can play the cat-and-mouse game forever.
Lee: What sort of security tools are you currently excited about? What are you finding interesting?
Snowden: I’ll just namecheck Qubes here, just because it’s interesting. I’m really excited about Qubes because the idea of VM-separating machines, requiring expensive, costly sandbox escapes to get persistence on a machine, is a big step up in terms of burdening the attacker with greater resource and sophistication requirements for maintaining a compromise. I’d love to see them continue this project. I’d love to see them make it more accessible and much more secure. [You can read more about how to use Qubes here and here.]
Something that we haven’t seen that we need to see is a greater hardening of the overall kernels of every operating system through things like grsecurity [a set of patches to improve Linux security], but unfortunately there’s a big usability gap between the capabilities that are out there, that are possible, and what is attainable for the average user.
Lee: People use smartphones a lot. What do you think about using a smartphone for secure communications?
Snowden: Something that people forget about cellphones in general, of any type, is that you’re leaving a permanent record of all of your physical locations as you move around. … The problem with cellphones is they’re basically always talking about you, even when you’re not using them. That’s not to say that everyone should burn their cellphones … but you have to think about the context for your usage. Are you carrying a device that, by virtue of simply having it on your person, places you in a historic record in a place that you don’t want to be associated with, even if it’s something as simple as your place of worship?
Lee: There are tons of software developers out there that would love to figure out how to end mass surveillance. What should they be doing with their time?
Snowden: Mixed routing is one of the most important things that we need in terms of regular infrastructure because we haven’t solved the problem of how to divorce the content of communication from the fact that it has occurred at all. To have real privacy you have to have both. Not just what you talked to your mother about, but the fact that you talked to your mother at all. …
The problem with communications today is that the internet service provider knows exactly who you are. They know exactly where you live. They know what your credit card number is, when you last paid, how much it was.
You should be able to buy a pile of internet the same way you buy a bottle of water.
These are research questions that need to be resolved. We need to find a way to protect the rights that we ourselves inherited for the next generation. If we don’t, today we’re standing at a fork in the road that divides between an open society and a controlled system. If we don’t do anything about this, people will look back at this moment and they’ll say, why did you let that happen? Do you want to live in a quantified world? Where not only is the content of every conversation, not only are the movements of every person known, but even the location of all the objects are known? Where the book that you leant to a friend leaves a record that they have read it? These things might be useful capabilities that provide value to society, but that’s only going to be a net good if we’re able to mitigate the impact of our activity, of our sharing, of our openness.
Lee: Ideally, governments around the world shouldn’t be spying on everybody. But that’s not really the case, so where do you think — what do you think the way to solve this problem is? Do you think it’s all just encrypting everything, or do you think that trying to get Congress to pass new laws and trying to do policy stuff is equally as important? Where do you think the balance is between tech and policy to combat mass surveillance? And what do you think that Congress should do, or that people should be urging Congress to do?
Snowden: I think reform comes with many faces. There’s legal reform, there’s statutory reform more generally, there are the products and outcomes of judicial decisions. … In the United States it has been held that these programs of mass surveillance, which were implemented secretly without the knowledge or the consent of the public, violate our rights, that they went too far, that they should end. And they have been modified or changed as a result. But there are many other programs, and many other countries, where these reforms have not yet had the impact that is so vital to free society. And in these contexts, in these situations, I believe that we do — as a community, as an open society, whether we’re talking about ordinary citizens or the technological community specifically — we have to look for ways of enforcing human rights through any means.
That can be through technology, that can be through politics, that can be through voting, that can be through behavior. But technology is, of all of these things, perhaps the quickest and most promising means through which we can respond to the greatest violations of human rights in a manner that is not dependent on every single legislative body on the planet to reform itself at the same time, which is probably somewhat optimistic to hope for. We would be instead able to create systems … that enforce and guarantee the rights that are necessary to maintain a free and open society.
Lee: On a different note — people said I should ask about Twitter — how long have you had a Twitter account for?
Snowden: Two weeks.
Lee: How many followers do you have?
Snowden: A million and a half, I think.
Lee: That’s a lot of followers. How are you liking being a Twitter user so far?
Snowden: I’m trying very hard not to mess up.
Lee: You’ve been tweeting a lot lately, including in the middle of the night Moscow time.
Snowden: Ha. I make no secret about the fact that I live on Eastern Standard Time. The majority of my work and associations, my political activism, still occurs in my home, in the United States. So it only really make sense that I work on the same hours.
Lee: Do you feel like Twitter is sucking away all your time? I mean I kind of have Twitter open all day long and I sometimes get sucked into flame wars. How is it affecting you?
Snowden: There were a few days when people kept tweeting cats for almost an entire day. And I know I shouldn’t, I have a lot of work to do, but I just couldn’t stop looking at them.
Lee: The real question is, what was your Twitter handle before this? Because you were obviously on Twitter. You know all the ins and outs.
Snowden: I can neither confirm nor deny the existence of other Twitter accounts.
Disclosure: Snowden and I are both directors of Freedom of the Press Foundation.
I must do this as a matter of establishing a record despite my superlative respect for this journalist’s space (thank you ML).
After I posted my most recent comment here, and while still on this website, the following url suddenly inserted itself on the url field:
http://www.hackaday. com
The url disappeared almost immediately and was replaced by TI once more. This is troubling and so is the impersonation of Micah here by someone with obviously nefarious motives.
On another front, drudge report.com confirms my contentions in a pointer there:
The coalition gives a 45 min warning to ISIS before bombing their oil trucks. The pointer has a copy of a leaflet – one of thousands dropped before bombing actually occurs – in Arabic.
I shall say it again: nothing is as it appears. The blindingly trusting get played over and over and over again…
And then have the gall to blame it all on ES!
How to truly secure all your online and electronic tech’s devices data? Wait till the EMP blast/s attack knocks it all down and offline permanently. Which will most likely happen the hand and handiwork of our own COG shadow government and NEOCONS.
For posting my comment here in defence of Edward Snowden whom some here felt was responsible for the Paris tragedy and possibly for every earthquake, flood, drought and for both WW1 and WW2 and more, I was tortured so severely last night by the terrorists on the other side of ISIS, who feign disgust at what the abominable ISIS does while they commit worse, in a free and democratic society.
They did the same on the day I posted a comment to Mr. Bamford’s article.
As soon as I left the library – literally at the door – I suddenly could not breathe. Manipulating my physiology remotely, they paralyzed my diaphragm so that it could neither expand nor contract, a key function in the respiratory system.
Simultaneouly, they forcibly ejected partially digested food into the mouth along with stinging gastric acid, forcing reflexive violent coughs while unable to breathe.
I heard myself gasp and choke – not many of the dying live to tell of the last gasps for air -and felt superlatively weak. But just then the terrorists let go of my diaphragm and I drew the deepest breath of life.
Until they kill me, I shall strive to exercise my rights to think independently and to express my thoughts freely.
Edward Snowden did not authorize the invasion of Iraq in order to remove non-existent WMDs that the UN and everyone else said were not there.
Edward Snowden did not issue the De – Ba’athification of Iraq’s Sunnis derivatives. De-Ba’athification was how ISIS was conceived and born. ISIS is someone’s deliberate Frankenstein creation.
According to al Maliki, former Iraqi PM, 14 months after the so-called coalition against ISIS comprising of 60 nation’s was formed, any serious effort to uproot the terror group was yet to be launched until Russia came waltzing in and did in a few weeks what the coalition was either unwilling or could not do in the 14 months of it’s existence.Meanwhile ISIS grew in strength while everyone sat doing nothing. Edward Snowden is not responsible for any of it.
Edward Snowden did not authorize regime change adventures in Syria. Nor is he responsible for inflicting largely ineffective, reluctant injuries on the terror group, perhaps because ISIS may have been counted upon to oust Assaad.
Russia conducted an investigation at the sources of finance and found that they originate from oil sales from oil wells under control of the terror group. But the investigation also found that they are financed by some members of the G20 ! What the fuck does Edward Snowden have to do with any of this vileness? Russia shared the info with members of the G20.
And now after Russia destroys 500 ISIS oil trucks, the coalition to whom it never dawned to do the same in 14 months of it’s miserable existence, finally destroyed some 100 oil trucks belonging to ISIS.
The creators of ISIS would have given encryption to the terrorists if it helped their case. No one needs Snowden for that.
So lay off the man and go read something and be informed!
Why is this traitor still breathing
Micah, you should have asked the traitor how he feels about sharing our national security playbook with enemies and terrorist groups like ISIS?
Hope little Eddie sleeps well at night living in Moscow. I’m sure his “privacy” is protected there and the Russian government fully respects his freedom.
Right. You have privacy, in Russia. Right. You are nothing but a Putin Lackey now and you better get use to it because long after the little man with a big ego kicks the bucket, the Russian government will be using you like the snot rag you are. Of course you want to come back to the US. Most traitors who fled to Russia felt the same way. Had you any real brains you would have known this before embarking on your Blunder of a Lifetime. Now excuse me while I eat my American Cheeseburger that contain actual beef, as opposed to the Russian version which is likely a cross between a cow chip and Soylent Green
I know I am out of touch, but I really don’t get this. Certainly I have things about me that I would prefer not to be public knowledge, but I can’t understand why anyone would waste their time trying to discover them. Are there a lot of people out there who really think there are others who are interested in their secrets?
Snowden is a traitor and an idiot.
And what are you? A borderline-Nazi surveillance slave-minded fool?
May there be many more heroic whistleblowers like Snowden, may we the people recover our constitutional rights not to be spied on by a peeping tom surveillance state, and may scum like you drop dead on the ground.
Jeek, Let’s just skip over the fact that he stole way more than just what the government was doing to it’s own citizens. If he had only done that, I’d be with you celebrating his whistleblower status as I’m sure many others would. But, the fact is he broke into systems (whistle blowers don’t need to do this, true whistleblowers, as part of their job, have access to the information they tell us about) to steal information, not just information on what the U.S. was doing to its citizens but all kinds information to our many secrets. Letting other governments know when, how and that we were spying on them is not whistle blowing, its sharing secrets, which in fact makes him a traitor. And Micah, shame on you for supporting Mr. Snowden and acting like he is someone we should listen to or emulate.
If I were going to harass the citizenship I would go with private speed cameras and prosecute privately as well. After all not many are good for more than a hundred bucks anyway you slice it. Knowledge isn’t yielding much. I have no idea what is going on with my electronics as is. But you paid me 200 for the protection in the end. I don’t so antithetical anymore.
Whoever it is that I pissed off it must be enough.
Ninjas and those sorts, they could sneak up on me. But what do I have that the ninja would want? The government has no secrets. Only people in private dealings do. The government should have an awareness. But the mechanics of government preclude movement into the unknown. Similarly a banks interest remain at the bank. There is nothing inhibiting them following you out the door. But it is rather personal.
Science makes observations. The observations would not present data valuable to another interest, so hide on the Internet.
Not everyone in the bible is Jesus. Only Jesus would need this level of cyber security.
One thing I surprisingly didn’t see mentioned in this article, or anywhere in the comments section, is the idea of utilizing a VPN (Virtual Private Network), which can filter out a lot of the unwanted prodding of corporations and entities into our activities, usually executed via the implementation of adware and scripts from third-party sources. Especially if you’re using a public network, setting up a VPN can be absolutely critical to (better) securing the transmission of data, and rules can be implemented to filter out the unwanted transmission of data to various sources. Other than obvious culprits such as Google, Facebook, and Twitter, there are hundreds, if not thousands, of entities that are complicit – Amazon, Scorecard Research, Taboola, Outbrain, and Plista are just a few examples of these. Some of them claim to simply cater to your interests under the guise of “Content Delivery Networks”, or CDNs, but you better believe (or at least, assume) that they are busy collecting very personal info about you.
In a nutshell (the actual details are complex, esp. if you’re not tech-savvy), VPNs are usually set up at home, as a waypoint of data transmission, even while you’re thousands of miles away. Your devices have to be configured to redirect traffic through the VPN that you have set up, so that the data transmitted to and from the internet is filtered. End-to-end encryption can be utilized, so that the data is securely transmitted between the device and VPN waypoint. Now, could this method be vulnerable to failing? In theory, probably – I’m not an expert enough, to say that it is foolproof. But this method is much better than going at it without a VPN implementation of some kind, IMHO.
My bad – apparently, a few comments below do mention VPNs. The above comment I have posted is the first one I have ever posted on this site, so I’m not 100% sure as to the average level of knowledge/expertise on these topics of the average reader here; however, a good number of them know more about these things than I do.
Also, Ars Technica posted an article about a week ago about how “smart” devices use ultrasound to communicate with each other, so as to tell companies which set of devices you use, which disambiguates the particular personas of those who use them – definitely worth a read. (Article: Beware of ads that use inaudible sound to link your phone, TV, tablet, and PC)
Anyone who needs to get “advice” from a Fool like Snowden who couldn’t do the job he signed up for, and instead became a “hero” to similarly addled Fools, isn’t too bright. Oh well. We knew that already. Snowden is a clear example of the low intellect and lack of values some Contractors bring to the table. Stay where you are Edward. Nobody who has “values” needs you around. You and Putin still Buds? I’ll bet you take off your shirts and ride around on farm animals together. Be careful what you do together though. Sarah Palin can see you from her front porch.
“… Snowden who couldn’t do the job he signed up for…” Really? He did his job so well he access to incredibly high-level computer-authorities, and copied data right out from under the noses of the NSA, and was already out of the country before they knew it. Who are the Fools who couldn’t do their jobs, now? Yours is a very uninformed comment (separate from you opinion of him and what he did, to which you’re entitled).
“… low intellect … “: similar comments apply. You’re uninformed.
“… values …”: Well, that’s a really big topic.
loss of freedom due to threats from any concept of a governing body is ongoing, as soon as one reliquishes control of their life to it. being an obedient follower of those who claim to protect you? criminals engage in any sort of ploy to become superior to others, take their efforts from them by decree or by simple seizure and the multitudes of bodies laid waste by their deeds is often seen as some measure of their superiority. secrets? what be secrets?
How about using an offline paassword manager such as PasswdSafe, lock with a strong master key and then using one of the cloud providers such as Box to make it readily available every where?
I can’t take this seriously if he’s recommending using a password manager. Any security expert or investigator would advise against it because guess what, they can be hacked as well. best thing to do is create random passwords, keep them hidden and separate in books or other locations a thief wouldn’t have time to search. Keep them completely offline.
Maybe it would not have mattered in Paris, however I am sure ISIS is grateful for all of your assistance.
Everybody knows that tor is funded by the US military, and even ‘top’ tor government employees admit that tor doesn’t work. The fact that snowden endorses tor mans that snowden is not to be trusted either.
“Users Get Routed: Traffic Correlation on Tor by Realistic Adversaries”
http://www.nrl.navy.mil/itd/chacs/biblio/users-get-routed-traffic-correlation-tor-realistic-adversaries
Micah and Mr. Snowden: I don’t see you addressing the potential threats of compromised compilers and compromised processors.
Open source software requires that you can trust compilers. Any compiler can have its binaries replaced by binaries that seem to work properly but insert malicious functionality into compiled code. The compromised compiler can be configured either (a) to insert malicious functionality into each new program it compiles, or (b) to insert malicious functionality only when a specific configuration of text is found in the source code. If a compromised compiler is asked to recompile itself from source, it produces a binary that’s still compromised. I’d like to have credible assurance that some compiler is being regularly checked to ensure that its binaries aren’t compromised in this way. As it is, if I download gcc from the Free Software Foundation I don’t know if I can trust it. Gcc, after all, is a high-value target for any major intelligence agency, and a sophisticated attacker could find ways to compromise it by hacking into the relevant machines or into certain internet connections. If the pro-privacy community was doing this kind of vetting even for one product, like gcc, I’d feel that we’d taken an important step towards the kind of resilience we need.
Compromised processors (including both CPUs and other chips which can function as processors) are another high-value target for intelligence agencies, and I’d expect to see some agencies working on trying to compromise the commonly-used ones at the source. Just because we don’t want it to be true doesn’t mean they won’t do it, since it’s such a high-value target. The compromise could be done by voluntary arrangement with the manufacturer, by National Security Letter, or (if you’re really daring and sophisticated) by hacking into the manufacturer’s systems and altering their designs a la Stuxnet without the manufacturer even noticing (easier to do with an unsophisticated manufacturer of a non-CPU processor). Of course, the compromised processor would still function normally in 99.999+% of situations. The good news is that it doesn’t seem completely out of the question that citizens could develop techniques that keep data safe even with a potentially compromised processor. Ideally the processors themselves should be vetted at a hardware level. Again, just because we don’t want to deal with such a deep compromise doesn’t mean it won’t happen.
But if the pro-privacy community is going to start doing some serious vetting, I think it’s better to start by making sure we have trustworthy compilers, and put off processors until later since they’re a little harder. If we don’t do the vetting, the time will come when the internet is used by the enemies of freedom to delete data and disrupt communications, making the development of trustworthy technology impossible.
I’ve heard a completely unsubstantiated rumor that every post 486 processor has already been compromised during manufacture as you describe. The engineer described some step-and-repeat function creating adjunct circuitry only detectable to microwave analysis, and I have no clue what he was talking about.
If terrorism is a cancer, Snowden gave cancer the keys to our immune system.
Your fellow FPF Director John Cusack and a conversation with Arundhati Roy:
http://www.truth-out.org/opinion/item/33664-things-that-can-and-cannot-be-said-a-conversation-between-john-cusack-and-arundhati-roy
Good morning kids. It is 0500 in the Anza Borrego, with a high temp expected to be 75 degrees. Just 60 miles away, at 6000 feet, the low is about 35 degrees. About 120 miles from Anza Desert is the Mount Soledad National Memorial. Find me and Ill buy you a Mexican ice cream bar from a Syrian vendor.
I notice that many in the security sector seem to continue to promote Google products, Edward Snowden included (as evidenced by his use of Google+ for video lectures and support of Google Play apps), despite their revealed and admitted intrusion into privacy. I have converted to using a BlackPhone with Private OS just to keep Google out of my phone. But even BlackPhone is now putting Chrome on its phones.
Also, many privacy advocates recommend the use of apps that can only be obtained from Google Play. It is no secret that these app repositories can and have been hacked and also require that the user get a Google account. The companies that promote these apps insist on users obtaining them from google play rather than a secure FTP.
As a relatively intelligent and somewhat well-informed person I have concluded that there must be an INCREDIBLE amount of cognitive dissonance going on with security and privacy advocates for them to promote anything Google. (I am considering using Signal).
Can you please provide a technically sound reason why it is safe to use Google products and maintain the privacy standards that are now required in today’s age of government surveillance? i feel like I must be missing something.
Secondary to this is why security products like ProtonMail, which suffered one of Switzerland’s largest DDOS attacks in history to prevent its use, and BlackPhone (with its Private OS) are not being promoted among privacy advocates.
I would appreciate any feedback from privacy advocates that can help me understand this apparent disconnect.
The reason Snowden often uses Google Hangouts to do video interviews is because it works and it’s reliable, despite the fact that he doesn’t get any privacy while using it. He wouldn’t use it to discuss secrets. There just aren’t a lot of options for video calls, but this may change soon.
The rest of it all comes down to threat model. If you’re a nation-state surveillance target, you can’t just use a normal Android phone and download normal apps from Google Play and think that means your phone won’t get hacked. But if you’re just trying to make it so your normal communications, which are easily spied on by network eavesdroppers or service providers, with encrypted communications that aren’t, then switching to Signal or similar apps is a great approach.
One thing that is great about Google Play (and the iOS App Store) is that all apps are codesigned. So if you try to download Signal from the Play Store and somehow a network attacker manages to swap the .apk with a malicious version, your phone will refuse to install it because the cryptographic signature won’t verify. This isn’t true if you just download a .apk from an https website.
In short: You can up your security game without very much work by switching to some secure apps, tweaking some of your settings, and using better password habits and two-factor auth, and everyone should, because it’s very easy and non-disruptive. If you need to hide from the NSA (of your employer, or your abusive spouse, or your parents, or whoever), then you should still do all of this stuff but you should also compartmentalize your secrets on different devices and take way more paranoid approaches.
> One thing that is great about Google Play (and the iOS App Store) is that all apps are codesigned. So if you try to download Signal from the Play Store and somehow a network attacker manages to swap the .apk with a malicious version, your phone will refuse to install it because the cryptographic signature won’t verify. This isn’t true if you just download a .apk from an https website.
The unfortunate thing about APK code signing which uses jarsigner underneath is that it uses broken cryptography: DSA with SHA1 or RSA with MD5. There’s no strong signing algorithm (e.g. Ed25519) or strong hash function (e.g. Skein) available. If NSA can break the weak signing algorithm or create a collision in MD5 or SHA1 then they can swap out the real APK for a backdoored one to anyone downloading it.
The main problem however is that regular users have no way of knowing the original developer’s true signing certificate. Only Google knows that. That means Google is acting as the middle man for all apps downloaded from the app store. Signing is only useful for Google to know that it came from the original developer. Google can however be convinced (voluntarily via PRISM or forcefully via NSL) to build the app again from publicly available sources, sign that with a completely different certificate (which is also signed by Google and trusted by all devices) and release that to everyone instead. Thus anyone downloading the app from day one is compromised.
Even if the code of the locally installed Google Play store on devices had some mechanism in it to reject apps that were signed with a different certificate than to what was installed on the device originally, this is easily defeated. The Google Play Store Source code is not published for starters. It’s a closed source binary. So you have to trust whatever Google have written. Secondly, auto updates to the Google Play store app itself can remove this protection at any time to allow apps to be installed which were signed with a different certificate. Maybe Google is not “evil” as per their motto and would not do that voluntarily, but there are however NSLs and large fines for non compliance. At the end of the day, you can’t trust anything from the Google Play store for secure communications.
NSA is not the only adversary. What if state-sponsored attackers from a non-US government were trying to get you to install a malicious app by attacking your Google Play download? Then Google’s code-signing certainly will stop that, even if the attackers have access to a trusted CA of their own. (I guess unless they’re able to attack the hash algorithm — I wasn’t aware that jarsigner only supported weak hashes.)
But even if NSA does have a trusted codesigning key that they can use to attack apps downloaded from the Play Store (which I haven’t seen any evidence of, although it’s certainly possible because they can compel Google), this does not mean that “anyone downloading the app from day one is compromised” — all it means it is that the NSA has the capability to do targeted attacks on people downloading apps. They very likely would only do this for surveillance targets and not for everyone, because that sort of attack is entirely detectable. You can extract the apk from your phone and compare it with one you build from source, and even though it’s not 100% reproducible you can still fairly easily reverse java binaries to find backdoors.
But like I said, you can’t just install Signal from Google Play and think that you’re secure from NSA:
@Micah – you seem to make an assumption that the only reason to not want compromised apps, or to use Google Products at all, is because the citizenry has something to hide-as your self-quote above indicates. This is not a reasonable assumption.
I would like to make two points. First, the “I have nothing to hide” philosophy is not pertinent to the discussion unless you are of a similar mindset to the intelligence agencies who use this rhetoric to justify sweeping intrusions into US Citizens private lives. The right-to-privacy is just that, a right. It requires no defense no more than the right of free speech or right to practice one’s religion. Should Buddhists need to defend why they are Buddhists to skeptical Christians? I don’t believe they do.
Second, many, if not most citizens do have something to hide. Something they would find embarrassing if it were made public. These things are necessarily wrong morally, ethically or even legally. They are just private. And against they wrong type of faction, these things could be painted if a pejorative light to suit the government’s ends-whether it is local law enforcement or the DA’s office to sway a jury, or the cause negative perceptions in the court of public opinion through negative press and character destruction. There are reasons why we do not live in glass houses and make everything we do visible to the public.
Once we begin to forfeit our privacy, thinking it serves some greater purpose, the slippery slope towards a security state begins.
I am grateful to JMD for his input. He seems to have a pretty clear understanding of the size and scale of the problem. I look forward to reading through more of your posts. I am also grateful to you Micah for putting these concerns up front and center, but would like to respectfully suggest to you that your trust of Google and promoting products under their direct control may be naive. What confounds me is that someone as technically savvy as yourself, and others in the security field, holds fast to these beliefs.
Many of us, perhaps a saddingly very small minority, don’t just want to feel secure against the NSA. But let’s not forget the oft overlooked FBI and local law enforcement agencies who are compelled to intrude on our daily lives through mass surveillance devices (e.g. IMSI catchers), and anyone else who wants to intrude on the private details of our lives for “imminent” exploitation (three-letter agency definition implied).
What we do want are real solutions that work. We also need to trust the people who recommend these products. A personal note to any up-and-coming privacy tech company-if you push Google apps or iStore as a distribution channel, don’t. It tells us you don’t understand how extensive and powerful the tools are that are being used and calls into question your entire product and how serious you are about it.
>What if state-sponsored attackers from a non-US government were trying to
> get you to install a malicious app by attacking your Google Play download?
> Then Google’s code-signing certainly will stop that, even if the attackers
> have access to a trusted CA of their own.
Please don’t be so hasty to say “will stop”. The much easier way to proceed is to develop a human asset inside the Google code-signing office. Such an agent could then create signatures on altered executable. Code-signing as practiced today should all be considered to have single points of administrative failure.
Code signing by distributors (store operators such as Google, Apple, now Microsoft) should be considered an interim measure until a public facility for verifying the integrity of widely-distributed software is available.
Most people should know that even if they’re using something like BlackPhone (or any other kind of mobile phone) their baseband is almost certainly closed source and almost definitely either backdoored or exploitable.
Blackphone might be slightly better than Android but don’t confuse it with ‘secure from a nationstate’ or even ‘secure from a targeting interested attacker’.
Just FYI.
While I don’t have a great concern about surveillance on my communications, this is a very valuable and practical article. Great job!
Of course there are demented trolls commenting here, all echoing the current FBI line that encryption, etc. are merely tools for the “bad guys” and thus securing your privacy is some boon to “terrorists.” Nonsense and absurd.
There are many Old School ways of plain text/talk encryption using coded language, etc. Masking the raw data is just another layer. Given what Ed Snowden has told us about the pervasive NSA-GHQ spying on everyone, it would appear that this 1984 style mass spying does little to stop actual bad actors. So this is a red herring type of claim, that protecting your own privacy is akin to “helping terrorists.”
Or do the trolls want a always-on telescreen installed in their bedrooms and living spaces? I doubt it.
Promoting privacy of communications as a cause of bad behavior is like arguing that free speech is responsible for bad ideas. False and dangerous.
The truth is that the read bad guys aren’t stupid. They are careful, as you would be. When they aren’t (probably a lot) they get droned to death.
The trolls are always welcome to move to N. Korea if so much privacy worries them.
Islamic State Muslims say “thank you”:
https://pbs.twimg.com/media/CT2zFYdWcAA9mtB.jpg
You’re welcome Louise.
Idiot
Hey, Snowdon. How does it feel to be one of the main reasons why so many died in Paris? The blood of those kids is on your hands. Welcome to the new world of Edward Snowdon: Where philosophy triumphs over intelligence and realism.
The terrorists who attacked Paris communicated, at least in part, using PlayStations, which as far I can tell don’t offer any end-to-end encryption: http://www.forbes.com/sites/insertcoin/2015/11/14/why-the-paris-isis-terrorists-used-ps4-to-plan-attacks/
So… ban console systems! Also they probably used the internet, and most likely they used cars. ISPs and car manufacturers should be held accountable! Nevermind that these things are useful and important for non-terrorists.
Welcome to the new world of Matt Pa where we quiver in fear and turn over keys and secrets to any inquisitive entity… you know for protection. Nothing bad ever happens if we just let cops do anything. Nothing. Ever.
those who compromise their liberty in the name of security deserve neither… kindly remember those sage words.
So many? Intelligence? Realism? What a fuck-wit.
How does it feel being a borderline-Nazi surveillance state bootlick?
May there be many more Snowdens, and may all creatures like you drop dead.
You can easily, and in a physically effective way, sandbox persistence by using toram option on a live DVD such as knoppix or Debian Live. Heck! You would not even need a hard disk drive to boot your device! You can even use it on a Windows box without Windows even noticing, which is why people use Linux live DVDs to ‘fix’, hack Windows (including its passwords and security)
You may not even know the dangers you may be exposing yourself to by getting anxious about that cyborg dressed as a window shelf maniqui with a nice butt (which they will log in your profile and use to blackmail you in the future if necessary)
RCL
It’s remarkable that the State Dept can give themselves the right to revoke a native citizen’s passport without any kind of due process whatsoever.
“Technically”, even if you pay for it this is a legal U.S. document USG owns and at least they let you know very explicitly as part of the application. They do revoke your passport for (in some people’s eyes, not mine) way less than what our friend did. Just for not paying child support you may find yourself stranded overseas without being able to come back home.
Notice I am not saying it is right or not. I am just talking about the legal “technicalities” of it.
RCL
Got to reclaim our liberty first, Ed.
Thanks for trying so hard for us. I fear it is now too late. The killings in France will send everyone into a murderous frenzy.
You, and Josh Fox and Chelsea Manning are true Heroes of our terrible age, Ed. Would love to buy you a beer when this is all over. You are welcome any time in Thailand! Peace unto you always.
ISIS would like to send a sincere thank you to Edward Snowden for helping them keep their communication private. It has 120+ bodies to show for it. Congratulations!
I knew that was coming rather sooner than later. I am surprised it took so long!
RCL
Lucas watched 10 mins of cnn today and thinks he knows what’s up. Good job researching Lucas! I’m sad so many folks will drink what all the cops on cnn keep saying: “encryption helps the bad guys, so encryption is wrong” … sad. They come on tv and say it so often too.
I am not computer savvy but I trust Edward Snowden and thank him and the rest of the team for there sacrifice and courage.
as the motto of the Royal Society goes: “Nullius in verba” (Latin for “on the word of no one” or “Take nobody’s word for it”)
RCL
Micah, Ed,
I’m extremely disappointed that you and other people are recommending Signal for privacy against the NSA, GCHQ etc without mentioning the huge caveats that come with it. It’s almost a JTRIG operation to convince everyone to blindly install it and hope they’ll have privacy. Not everything works like magic. In fact it’s dangerous to just blindly use this program and hope you are secure.
1. If you want to use Signal you have to install it via the Google Play store or Apple iOS store. That’s the only option Open Whisper Systems offer. Have you heard of IRRITANT HORN? You must have, The Intercept posted an article on it (theintercept.com/2015/05/21/nsa-five-eyes-google-samsung-app-stores-spyware/). Also Google and Apple are PRISM partners. How can you possibly recommend to millions of readers that they install Signal without giving any warning about this? The majority will just install it from the app stores and get infected with malware. I guarantee every install of this privacy app from an app store is infected with NSA malware. It’s a prime target for it. Everyone interested in privacy so everyone downloading it gets lulled into a false sense of security by installing it.
If you want real security you HAVE to compile Signal from source and load it manually onto your device. Then I hope you’re running a custom ROM of Android that you also compiled from source and hardened it afterwards with a firewall and restricted app permissions. I won’t go into closed design baseband processors (fsf.org/blogs/community/replicant-developers-find-and-close-samsung-galaxy-backdoor) or phone hardware issues in this post but I will summarize and say you can’t have any meaningful security against an intelligence agency using a current smartphone device. Period.
If you need ideas for a useful article about secure phone communications, figure out how to compile Signal from source and how to install it manually. Write up a guide on how people can do this. I wish companies like Open Whisper Systems would compile reproducible builds and make them available for download as Android Package Files. Then sign those builds and the source code with GPG. They should then publish their GPG key ID and fingerprint in the blockchain using Namecoin and Onename.
2. If you’re going to do end-to-end crypto properly you need to cryptographically verify who you’re talking to. That means meeting in person and comparing public key fingerprints. Last time I used Signal with a programming colleague of mine that also works on cryptographic software we found the UI for this in Signal to be unusable. It forced us to install some third party app to scan QR codes. Then we had to try figure out how to scan the other persons code and view your own fingerprint / code to compare it. It was all very confusing. At any rate I guarantee 99% of people using Signal are vulnerable to MITM attack because a) they don’t know that they should be doing this verification and b) this verification system is horribly unusable. They could honestly make it more usable by ditching the QR code nonsense or coming up with a logical verification flow just showing the fingerprints as hexadecimal symbols.
3. The encryption and protocol used in Signal is just the bog standard stuff from NIST that the NSA obviously wants everyone to use so they can secretly surveil them. Everyone missed the Der Spiegel memo where they mention they have in-house attacks against AES (spiegel.de/international/germany/bild-1010361-793640.html). Research more into the special relationship between NIST and NSA. Who really had the final say in the selection of the winning algorithms in the AES or SHA3 competitions? I’ll give you a hint, it wasn’t an open, auditable, public vote. You might have noted Blackphone now has a standard non-NIST cipher suite of Curve3617, Twofish and Skein (cdn.arstechnica.net/wp-content/uploads/2015/09/Screenshot_2015-09-25-12-21-56-980×1742.png). This trumps whatever is in Signal by a country mile. Although the real state of the art these days is cascade ciphers. Only real anti-surveillance programs offer cascade ciphers, for example TrueCrypt. That was so good the government found the developers and forced them to shut it down.
To sum up, Signal is probably good enough for stopping the average Joe from reading your messages. It does absolutely nothing to stop Five Eyes surveillance.
I wish The Intercept would stop redacting important stuff in their documents. Let’s see which cryptographic algorithms are actually safe. If Ed didn’t have access to that information, put a call out for a whistleblower from inside the senior cryptanalysis team at NSA to come forward and leak documents (ECI information) to The Intercept. The world needs to know which ciphers are actually safe in order to be safe. Do they actually have a quantum computer already? Then we will know for sure and can create real security to counteract their actual capability. At the moment it’s all unknown. For now don’t trust any one algorithm on its own. Use programs which offer a cipher cascade. Even consider exchanging symmetric keys personally to chat with someone. You can’t trust public key algorithms these days. The main ones are vulnerable to quantum computers and the quantum safe ones are unproven and unstudied.
Thank you Micah, Ed and JMD.
Noobs opinion: I agree.
It might provide some degree of privacy for the average Jack and Jill who don’t annoy spying patriots by making things a little more troublesome for petty criminals. But as a programmer who does not have decades, even one of them, of advanced knowledge of cryptography through expereience, and who does annoy spies, I know I will never have privacy. Anywhere or any time. I cannot see how any app downloaded onto my NSA owned iOS devices will ever function as advertised.
It would be nice to see some helpful advice for those who are up against the stasi-state.
Thank you very much, JMD
I totally agree with you. You will have to “chop your own wood” and actually own your device from your BIOS and OS to compiling from sources if you want to get things right, which I don’t think is that hard, People can, must be educated in order for them to be able to be “free”
RCL
if you peruse Micah Lee’s posts you will notice that many more times than rationally necessary tech savvy people have been pointing out to him his very one-sided obsession with the particulars of encryption; in one occasion someone using the name “Richard Stallman” and pointing to Richard Stallman’s site’s posts with thorough analysis debasing that silly idea that you can build encryption on top of a compromised basis.
Lee hasn’t been that convincing (or honest I would add) about TI tracking its users for that “analytics system” without disclosing what that “analytics system” is all about. Read the questions he doesn’t answer below.
RCL
Some people confuse the difference between an eavesdropper on the wire (for which encryption was designed) and an attacker actually owning you/your hardware. I don’t think it is Lee’s case.
RCL
Signal for Android permissions require your contacts, identity, access to read and write your SIM card, read phone log files, read your calendar, know your location, read your storage and photos, we your camera and mic, and basically everything else worrisome on the phone. This is not the app for your personal phone, maybe a burner phone.
I’d like to see you find a messaging app that does not require these permissions. Want to send you friend a photo? The app needs access to storage. Do you want to message your contacts without manually entering their phone # every time? The app needs access to contacts, which are also saved on the SIM card.
The fact that an app needs direct access to those devices, locations & data is a security deficiency in Android; other phone operating systems don’t have this problem (see e.g. how Ubuntu Phone/Touch solves this).
I think everyone in Australia should be reading Snowden’s suggestions. Law was recently passed which requires all ISPs in Australia to retain the metadata of all users for at least two years. There’s no onus on any of the agencies who have access to this data to delete it after it’s used. And the cost of this is being passed on to the end user.
Seems to me that Ed isn’t doing to well, at least in the photo, he looks like he’s lost some weight and is in need of some sunshine. I use a VPN, Tor, a Mac with extra firewall and such but I know the only way to be safe is to just unplug. A VM machine? an air-gap machine? Faraday Cages? geez, to go to those extremes seems to me a bit over-board for the regular user…suppression leads to oppression…I write to my members of congress and ask how I can help them address certain issues, I really would like to help them, they need it, jokes on me right? but pushing the envelope is a good thing…I think old Pat Henry said it best all those years ago…if I disappear or whatever at least I know I tried…in some cases I have lots to hide, so I throw the door wide open, in doing so most think I’m just some cracked pot…2015 sure is fun ain’t it?
A very old American Stasi ploy: insist those who act upon their conscience and are subsequently exiled by Stasi aparatchiks — you — must live in misery, for the purpose of reinforcing the US populations’ civil cowardice and threatening the pitifully few decent citizens still residing in your totalitarian house of horrors.
Then you suggest writing ‘your’ politicians instead of taking precautionary measures to protect themselves from degenerate criminals like you. What a stupid thing to say.
Weak.
Ed looked like that when he was LIVING IN HAWAII “ownedman”.
He’s a self described “indoor cat” and in sunny tropical Russia I expect that’s the predominate feline disposition.
read Herbert Marcus
CNN “former CIA operative Robert Baer” dropped a line insinuating Snowden ‘ s revelations were possibly the cause. Baer is the only one I heard using Ed Snowden’s name, but I only caught all this on CNN.
NBC nightly news “terror analyst” floats the possibility that encryption might be the reason officials “missed” the Paris attacks.
uhm… everyone is saying it. cnn blurbed this idea at least twice while i was randomly watching tv these days. They’ll just repeat “cops are awesome, technology helps terrorists, can’t we please spy on you with your kinect cams already????” until enough folks start to think like the two misguided posters above. yea snowden has blood on his hands… smh.
I see two options here: (1) inside help; (2) incompetence. I apply the same logic to the three towers that were demolished a few years ago. (Don’t forget that little one that decided to die on its own because of….. fire!)
Encryption is only part of the answer. To be private you must get off the Web. Use your smartphone as a server, bypassing Web servers. ShazzleMail is a free email app that does just this – turns your phone into your own mail server. The email is encrypted as well, as the belt and suspenders to the security.
Shazzle will soon have an IM app, and is working with Jing LLC who will launch a private internet payment service that will allow you to buy and sell on the internet with no audit trail.
Smartphone as your personal server is the way to go to restore privacy.
Ha. My personal threat model evaluation suggests I should probably just still wait a while, perhaps even until Big Brother is no longer – always the cat.
A side note concerning Nov 27, 2015:
Just 2 weeks until my 3rd annual SnowMann (Whistleblowers) Day alternative Thanksgiving and I’ve recently started calling the original Black Thursday.
Ed and Chelsea’s bravery reminded there’s still plenty to be thankful for, though we’re not a religious family, and that thanks now goes directly to any whistleblowers moved by concern for humanity’s future and rights. OUR country owes them a debt of gratitude and I plan to make sure my family and granddaughter knows I feel that way – while I’m alive, anyway.
Thank you for your bravery, too, Mr. Micah. Please sir, I want some more!
Does SIgnal work if the people you’re texting don’t use it?
no
Signal also functions as a normal texting app, but when the receiver isn’t using Signal, the text will be unencrypted.
I recommend SMSsecure as an alternative. While not private, it is secure. SMSsecure simply encrypts SMS end-to-end. It also let’s you encrypt your local SMS storage.
Forgive me for lack of relevance but I want to just say this someplace where somebody might hear it:
So, yeah, I was trying to post some comments on Salon. ( I know, why? right? I have an old account from back in the day (when GG used to be a columnist there, and I find their coverage of the Democratic race for president especially egregious, and find their audience even more annoying….yes, I was trying to pick a fight).
So I discovered empirically this amazingly unethical thing Salon.com is doing, and I want to share it here.
After I sign in to my old account (not using Facebook for example), supposedly all is well. I post comments on two different threads. As far as I can tell, they are appearing right in the middle of the thread conversations.
I checked into Salon a bit later on another computer WITHOUT logging in, and guess what? My comments are nowhere.
Going back to the earlier computer, I log in, and there my comments are — ha ha, no. Nobody likes them, but nobody argues with them either, or acknowledges them.
Because they aren’t there. What I find so funny about this is that Salon wants me to think I am posting things to their site, but they don’t actually put them up. I suppose you will have to try this for yourself to see if it is true, but it might not work for various reasons — SOMEBODY is able to post there, rather obviously.
I thought it was a perfect metaphor for a kind of Fantasy Island bubble, where an internet commenter merrily types away, imagining others somewhere are reading the comments……but nobody is.
Anyway. cheers all, keep up the good work Intercept!
I had the same experience on another website. Completely freaked out. In a refresh-melee hell. Cursing the obvious new-era I had just entered, of uber “A/B Testing” run amok. A dark world where the default online user experience is filled with unseen dendrite hierarchy of user-classes, with obscured privileged rights of passage and systemic marginalization. (Just like back in High School.)
Turns out, it was simply a toggled view interface. Like here. One user may have [Threads] view, and in another browser [Latest]. I was only momentarily relieved, for the darkness is coming.
That’s a good story. I forgot, before I posted this, that Facebook, which I quit years ago, does this trick to a large extent already —-Facebook gives the impression to users that they are communicating with all their “friends”, but in fact friends may or may not be seeing it (they started filtering results and not sharing everything with everybody, and kinda sorta told us they were doing that too). No doubt occasionally lack of response causes people to think their friends are ignoring them, probably leading to further social insecurity to exploit.
most likely that was not salon, but some other party that wants for you to think it is them
RCL
paging William of Occam…
You think maybe that’s kind of a lot of work for some other entity to do just to suppress little old me & my little old comments, Ricardo? Or am I missing some good sarcasm?
but Occam’s razor
https://en.wikipedia.org/wiki/Occam's_razor
http://plato.stanford.edu/entries/simplicity/
does not apply to matters relating to politicians and police.
Again here you are being rational and, most probably, illusively thinking and/or hoping they are.
They say having a good sense of humor is a sign of having a healthy brain, but I use sarcasm exclusively when I talk about politicians and such matters. Also, I am not taking about Philosophy and “possible worlds”. They constantly do the same thing to me:
https://ipsoscustodes.wordpress.com/2015/05/27/zersetzung-made-in-u-s-a/
They use your google searches and adds to push their sh!t on you thinking they will make you think in certain ways, influence you reality …
RCL
Overpaid lizards with nothing better to do have interfered with every digital medium I use as well as every type of daily activity. Anyone who exposes the slightest independence of thought should assume the compliance police will react.
It’s real easy to poo poo these suggestions if you’ve never had any serious threats or attacks to your system or networks. In 2013 I was attacked with weaponized malware for six months that followed me from computer to computer. It took a years and a half to defeat it and regain access and control of my systems and accounts and damn near ruined my life. I suspect the culprits to be a corporate/government alliance.
Did you keep a log of your experiences? Would you share it?
RCL
The diseased minds of the mind control torture sub -humans go into a frantic panic as soon as I visit this site. The planes just revved up decibel levels of their sonic systems in an attempt to harass and terrorize.
A month ago, I posted a comment on Mr. Bamford’s story. As soon as I left the library, they remotely paralyzed my diaphragm while simultaneously forcing gastric acid up the eosophagus for maximal insult.
While I coughed violently from the burning acid, I also could not breathe due to the unresponsive diaphragm. The lungs simply had no way of expanding to fill up with air. It was horrifying to listen to my own desperate gasps for air.
Just before passing out, they released the hold on my diaphragm and I took a deep breath.
The point here is that these ops are imbecilic. I had no intention of writing about torture here today, but they had to blanket the space with incredible harassment and terrorizing aerial sounds just for coming here, leaving me with no choice but to be bold and expose their filth. Cowardice is a non-choice for me.
What I wanted to know was this: where does Micah buy his Faraday bag?
ES, there is nothing like home I know, but if you ever come back, they will saturate your body with nanodevices which they will use to manipulate your entire physiology with, creating painfull spasm of every smooth and skeletal muscle.
They will vibrate the devices all over your head and face in patterns that simulate nematode and small insect locomotions. They will access every major nerve and inflict unspeakable pain directly on it. They will relax sphincter muscles at will so that you urinate or defecate on yourself without the ability to control any of it. They will deliver electric shocks remotely to your genitals. And they will do everything possible to ruin your closest relationships with your loved ones so as to compound the psychogjcal pain.
And that will just be the beginning…
Please do not willingly subject yourself to this by ever coming back.
I suggest that you see a psychiatrist. He may be able to help you with your malady.
The sub- humans who torture their fellow Americans with advanced electromagnetic weapons systems, 24/7, year after year, infli cting unimaginable pain and ruining their health, livelihood and reputations, inflict exponentially higher levels of injury and damage to everything that America is founded upon and stands for , and they do so to an extent that America’s external enemies could never dream of, let alone achieve.
Who really needs psychiatric help then? To suggest the answer would be insultive of the intelligence of all reading this.
I forgot to mention an important footprint: barking interrogation-style phrases that appear programmed into the nanodevices the whole time you writhe in pain.
Remotely implemented enhanced interrogation for ya.
Meanwhile, reality boils to the surface making Pat B’s version of it look like Barnum’s Boxcar for the Circus insane..
quote:
Director Colby: The dangerous thing on NSA is whether they can pick up conversations between Americans.”unquote
quote”Secretary Kissinger: My wory is not that they will find illegalities in NSA, but that in the process of finding out about illegalities they will unravel NSA activities. In the process of giving us a clean bill of health he could destroy us.” unquote
http://nsarchive.gwu.edu/NSAEBB/NSAEBB522-Church-Committee-Faced-White-House-Attempts-to-Curb-CIA-Probe/Documents/Document%201-%2000126.pdf
When you probe the library of USG insanity you will surely find things that make Pat B look like a raving dolt.
Fantastic, thank you very much!
This is why I like apps like ShazzleMail, because they’re low friction. It doesn’t require you to re-order your life. It doesn’t require you to change your method of communications. You can use it right now to talk to your friends. ShazzleMail is a free private email service that turns your phone into your server. Sen all emails privately with no password required! If you are looking for a business encrypted option the use ShazzlePRO, its $7 a month and its safe, fast and secured!
I love Shazzlemail too. Its so nice to know that when you send any emails they are private and you don’t have to worry about government spying.
How are users supposed to protect their smart phones or computer against bulk CNE, bulk equipment interference as it’s labelled in the recent British IP bill?
Micah, I know trick to be sure about the starring stained windows watcher. You can wear sunglasses also and look away to the opposite side, you will get reflection on the inside of your glasses. Although might not work when in shady lighting conditions.
Last night I realized I lost my sunglasses and my hammer. Grrrrr, really wanted to make somebody pay. Too bad it was 3 a.m, now am doing O.K At least got sunshine.
Nice to meet you Ed, it’s a honor to be on the same page.
They can use your car keys to locate you. I am a victim of MK Ultra.
Isn’t Edward Snowden lying about how to regain privacy?
Knowing about the higher tech methods I know Snowden is doing psyops and lying to the world about this. You keep buying his shit because you want to make money and fame and don’t give a rats ass.
What about the air gap. How do you shield from signals leakage, eminations, and active interferometry scans. Isn’t #Snowden telling us lies? Don’t we need super conducting magnet shields around our bodies, homes, brains, and equipment to stop them from being able to see, listen, and intercept our various communications? http://www.DrRobertDuncan.com http://www.ObamasWeapon.com
Todd Giffen
503 967 5203
What about the air gap. How do you shield from signals leakage, eminations, and active interferometry scans. Isn’t #Snowden telling us lies? Don’t we need super conducting magnet shields around our bodies, homes, brains, and equipment to stop them from being able to see, listen, and intercept our various communications? http://www.DrRobertDuncan.com http://www.ObamasWeapon.com
Thanks for this detailed interview. It’s good advice for people not yet interested in privacy.
Could you also share your opinion on encrypted email like https://tutanota.com ?
I know I should be using pgp, but most of my friends don’t…
Schneier On Security yesterday.
“I have recently come to the conclusion that e-mail is fundamentally unsecurable. The things we want out of e-mail, and an e-mail system, are not readily compatible with encryption. I advise people who want communications security to not use e-mail, but instead use an encrypted message client like OTR or Signal.
Personally I use ProtonMail for my easy encrypted email with non-technical folk, OpenPGP with people who understand that. I’m a bit behind the (elliptical) curve though so when both Snowden and Schneier are recommending Cypherpunks and Whispersystems, then they’ll know better than me.
The second paragraph was me, I missed out an ”
Micah, how about improving this box with at least a preview function? Maybe even a ten-minute edit function like The Register has?
Hi Micah, Ed et al,
I’ve a bit of problem with blindly recommending Signal in the current form. Currently OpenWhisper only provides it through the Google Play store. I know they’ve a good reason for it (security updates through a controlled channel), but that requires everyone to have a Google Account. I don’t have one and I don’t want one. Plus I’m a user of a Google free Android phone. Google already has too much tracking data about me. While I don’t think that Google cares about me personally, they still collect the data and as we know they were a fruitful target.
The other point is of course the userbase in your peer group. Of course we can only start to convince others by going ahead. But that takes time. In the meantime I’m happy that we’ve a rather big userbase of Threema in Europe.
Threema is closed source which makes it fundamentally untrustable. There are alternative implementations of signal that you can get through the f-droid app store. To install without google play store do the following things.
1). In your secutiry settings check “allow unknown sources” so you can install apps from the internet.
2). Go to f-droid.org and install the f-droid app store.
3). In the f-droid app store tape the menu button>repositories>+ then paste t he following “https://eutopia.cz/experimental/fdroid/repo” into the repository address field (but without the quotation marks). You can also add the fingerprint which is A0E4D1D912D8B81809AB18F5B7CF562CD1A10533ED4F7B25E595ABC8D862AD87.
4). Search for libresignal and install!
I should mention. Moxie Marlinspike, the creator of signal, doesn’t approve of installing apps from sources outside of google play. He thinks it weakens security for the average user. Libresignal is an unapproved fork of signal.
Rap Video about the Surveillance State.
http://www.youtube.com/watch?v=o8NY-SCbF_Y
Snowden Approved
Good, solid information. Endless thanks to Mr. Snowden, the greatest hero of our time. I hope he’s doing well. And thank you too, Mr. Lee.
Thanks Micah. And pls thank ES on behalf of all as well.
What privacy protective measures do they use in Russia, I am curious?
And I am going to say again: please write a book on this stuff. Collaborate with ES and incorporate in it measures that other nations have come with.
How’s he doing, Micah? Is life treating well? (As good as can be expected?)
One thing most browser users don’t understand is that any website you navigate to can collect the URL of the website you came from. That information is passed along and available from all current browsers by default, as I understand it.
So, I’m on someone else’s machine, using Firefox that is completely locked-down with Java turned off, Ghostery, Ad-Blocker, HTTPS Everywhere (each open source), and all unnecessary Ad-ons and extensions removed, or I’m using Tails, and Tor as well – across a VPN no less. I’m doing all the right things.
BUT, I’m presently looking at the website “www.gay-gay-gaygay-GAY” You know, either baring my soul or having a curious laugh. From that website I type into the URL box “ConservativePride” and hit ctrl-enter. Conservative Pride, who I have a persistent login relationship with, (or Gmail/Outlook/Hotmail/Yahoo, etc.) now has in the logs that I visited a gay website just prior, and can use that information in any way they chose – in perpetuity. It may have been a fluke. It may have happened many times over the life of my User_ID. It is entirely up to them to decide what that personal information means.
It seems to me not many people understand this persistent, systematic, leakage of information, not even some hardened pros, unless they’ve worked in online analytics where that information is used en masse every day, albeit generally the thicker end of the long-tail.
How many people habitually create a new tab before going to a new website? I’m not even sure if that sufficiently stops the broadcast of prior website information. Are regularly updated Google/MS/Yahoo search plugins open source, and can they surreptitiously transmit historic information sourced across tabs?
You’re talking about referrer headers. But they actually aren’t quite as insidious as that. Your browser only passes the URL of the previous web page to the next web page if you click a link on that page. So if you’re on http://www.gay-gay-gaygay-GAY and you click a link to facebook.com, then your http request to facebook.com will include the URL of the previous page you were just on. However if you’re on http://www.gay-gay-gaygay-GAY and you just type facebook.com in the URL bar and press enter, no referrer header will be sent. It’s obviously still a privacy issue, but it’s just not quite as bad as you described.
> One thing most browser users don’t understand is that any website you navigate to can collect the URL of the website you came from.
People should also worry about the referrer headers sent to 3rd parties embedded on a web page.
For instance, by visiting this page here, rather ubiquitous gravatar.com can add yet another entry to the browsing habits of a visitor’s IP address — that the article here was visited at such time by such IP.
Same for all web pages where gravatar.com is used as a 3rd party, same for whatever ubiquitous 3rd-party servers are put to work when visiting a web page.
That’s why 3rd parties should always be kept to a minimum[1], and the reason why I block gravatar.com globally by default.
[1] Even if using Tor browser, as it helps reduce bandwidth.
This is not directly security related, but it is a cool use of technology that Snowden and Lee might like – Text detective can unmask the secret influencers behind US laws
Surveillance “reforms” are treating the symptoms, not the disease. The disease is ambiguity in the law governing private information. Smith v. Maryland, a decision from the 70’s, is still being used as precedent even though it’s hopelessly outdated and the “third party doctrine” is being blown completely out of proportion to the case and decision.
We need comprehensive privacy legislation that defines private information and restores probable cause standards, and groups like the FPF, EFF, and ACLU should work together and try to build public support.
Edward Snodwen; do not return to usa_naziland. Someone has been paid to off you so we’d like (world citizens) you too live a long a fruitful life in comparative freedom from death. The eventual downfall of america is not your fault it has been an engineered plan by occultist groups for decades. It’s great that you’ve took time out to help TIC site with your further truthful activism.
It’s been rumored that Tor has been compromised. http://arstechnica.com/tech-policy/2015/11/tor-director-fbi-paid-carnegie-mellon-1m-to-break-tor-hand-over-ips/ While I love Tor and think it is a worthy project there is a large probability that its also been broken. http://www.techradar.com/us/news/internet/web/tor-anonymity-compromised-by-researchers-1300922
Both of the links you posted are about a specific incident that, as soon as Tor learned details of, immediately released a patch, which in this case was in the end of July 2014. There’s an on-going arms race where Tor is concerned, and as long as it continues to keep people anonymous, there always will be. Tor is doing a great job at playing the defensive role in this arms race.
More info:
https://blog.torproject.org/blog/did-fbi-pay-university-attack-tor-users
https://blog.torproject.org/blog/tor-security-advisory-relay-early-traffic-confirmation-attack/
What’s a large probability?
You can’t rely on Tor with your life if you are up against GCHQ or the NSA, but that’s mainly because they can do other things to subvert your device. You can rely on those Advanced Persistent Threat agencies not revealing that they’ve compromised Tor in open court. You can reply on it to stop the all the petty wannaba spies like the police and council and website admins and the mafia and your neighbours kid listing the websites you’ve visited.
If TOR is compromised, then the all the international intelligence agencies (you know them) and others are screwed because they all use it like everyone else does – for the same reasons too. Break TOR, you cripple the intelligence community. Period. They will not do that, and there is evidence whoever said that is FOS. Think about it.
That’s not how that threat model works. That’s not even how things were deanonymized that one time (and not the first time) and there are multiple possible deanonymization attacks on Tor that are possible — it’s a matter of owning a percentage of the network, in some cases, which can be remarkably cheap — and if done gradually, it’s not noticed (unlike the current instance). There’s also traffic shaping and other ways to deanonymize. Tor is good for privacy from friends, coffee shops, random strangers, and you being random stranger. It might even be okay for a one-off with a nationstate if you’ve taken very careful precautions. But it’s not going to withstand a concerted attack from an intelligence community that OWNS THE BACKBONE. It just won’t. It will, however, help people often access sites that might be blacklisted by national firewalls and the like, because that’s not *targeted*.
Regardless, tor has weaknesses and strengths — like many tools. But ‘breaking’ tor isn’t what was done; deanonymizing a large set of users WAS done, and that doesn’t cripple the intelligence community at all. Why would it? You seem to assume that all sides have access to the same information and the same technology — and the same deanonymization techniques.
I’d suggest you learn the meaning of the word ‘compromised’. I’d also suggested you learn the meaning of ‘deanonymize’ and realize that over a long enough time span — or just by mere surveillance by foot (look at how they tracked Hammond) they CAN and DO deanonymize tor users if they want to badly enough. And no, using a VPN alone doesn’t prevent that — not if they know where you’re starting out from.
Sorry if I sound rude.
FWIW I consider what CMU did to be rude — and that means I also consider what the feds did to be rude as well. But it does nobody any good to make people think you’re crippling ANYTHING or ANYBODY other than the average user when a nationstate (or its police forces — especially if they’re your country’s police forces, or police forces with the ability to charge and extradite you) is doing the deanonymizing. It hurts EVERY SINGLE USER — EXCEPT for the intelligence community, usually (except it might cost them a bit of money or lost access to the technique in the future).
Also, tor doesn’t even ‘break’ like you think it ‘breaks’.
Thanks to both Micah Lee and Edward Snowden for this informative and candid discussion; and kudos to THE//INTERCEPT for continuing to raise the bar of quality professonal journalism.
“Work is love made visible.” KG
As Usual,
EA
The effort to block, through legislation, public pressure, court cases, etc, the ability of the FBI and the CIA (and the rest of the alphabet soup of Americans spy and police agencies) to watch Americans, individually and collectively, without going through a series of hoops and safeguards is like putting massive resources and inconveniences into searching and securing the passengers and luggage that goes onto the airplanes while other packages (mail, freight) that go onto the same planes gets little to no scrutiny. The ‘five eyes’ system simply means that instead of the FBI or CIA (etc) being the one doing the collecting and analyzing, then passing the information on to whoever wants it, the RCMP or CSIS does that instead, because, for them, Americans are foreigners who don’t have their privacy safeguarded against Canadian spying, just like Canadians are foreigners without privacy rights under American laws.
REI Stores sell radio-blocking credit card wallets, the same technology also could be used for cell-phones, tablets or any computer.
There is probably a bigger demand for such a product than most of us would think. Today there are blacklisting centers in each and every state called “Fusion Centers” that harass innocent Americans every day using cell-phone tracking, credit card alerts (every time you fill up with gas).
Essentially we have defeated most foreign terrorism but the agencies are still receiving the terrorism dollars – so federal, state and local governments have “mission-creeped” to include people they simply dislike for First Amendment protected exercises – in order to keep the financial gravy-train flowing.
Such a product would help deter these Title 18 “color of law” crimes since there is currently no agency to enforce this law breaking by government officials. In other it gives the victims of government harrassment more control over when they are harassed for non-wrongdoing and non-crimes.
My wallet blocks RFID, and the “faraday bag” I mentioned in the article above is just that. Mine is big enough to fit phones and small tablets, but you can find laptop-sized ones.
It’s worth pointing out that you should test and regularly retest any Faraday cage device, simply by calling that phone or contacting the device inside it. A lot of Faraday cages commonly sold simply don’t work for the frequency range of the devices they are sold for, and they can wear and fail with use.
Thanks for the heads up. I ordered some of these from ebay yesterday. I think they’ll make great xmas gifts this year!
An all-aluminum toolbox is an inexpensive fix also.
Right on RB.
It’s more than simple harassment.
People lives destroyed and are being murdered by FBI no touch STASI crews. Chemically and RF exposure.
COINTELPRO continues.
They do far more than just ‘touch’.
In Brazil and the US I have been physically tortured: in a BR medical facility, a hotel room in CA, and barbershops in both countries. Stabbed with needles, poked in the eye with scissors after a skit performing goon put a straight razor to my throat, hair yanked out by electric shears immediately after a fourty four year old scar was pulled hard to inflict pain, and a sexual assault by US rent-a-goons with their very well known rectal fetish.
All performed with very low-tech tools found in any barbershop or medical lab.
The insistent no-touch claims are lies. But I will not call you out as a liar unless you insist…
Then there was the sleep deprivation, in San Jose, CA. This is recognized as a form of physical torture.
On a whim, in a fumbling effort to be unpredictable, I went to the San Jose police station at 201 West Mission Street to report many crimes and see how they would react. It was a Saturday, noon. Regular business hours. A rental patriot walked by me after I got out of my car to say “cloooosed”. Then I saw they had scribbled a sign on white posterboard saying
9-26-15
CLOSED
and taped it to the door. I have plenty of duplicated photos of the door.
I was stunned to learn I can close a US police station by showing up in their parking lot.
This is an example of the type of radicalization which can take place when two people find a copy of the US Constitution online. They begin talking about unreasonable searches and inalienable rights. The next thing you know, they are using the Tor browser to flaunt their privacy.
Privacy is Piracy – trying to steal back your identity from the government. Everybody has a government issued ID; it doesn’t belong to you.
As stated in Wikipedia,”Radicalization (or radicalisation) is a process by which an individual or group comes to adopt increasingly extreme political, social, or religious ideals and aspirations that (1) reject or undermine the status quo…”. Status quo, for those not familiar with Latin means ‘The U.S. Government’. The status quo demands you be pushed, filed, stamped, indexed, briefed, debriefed, and numbered (h/t The Prisoner). This is all quite reasonable, so pause and reflect before stepping down the slippery path of privacy that leads to radicalization.
quote”Privacy is Piracy “unquote
Well then, you won’t mind installing a net connected cam in every room of your abode, especially your bathroom, hmmm? Now, how bout posting your email addy, and all passwords to your financial, social and kiddy porn sites you visit, hmmm? I expect to see them here today. Otherwise, STFU you hypocritical sack of shit.
Satire
Hellfire knows that, but he’s not a big fan of satire.
The way you describe it, giving up privacy seems like an awful lot of work. When the government does it, the process is quite painless and most people don’t even notice it.
You seem to be amused by it all, living a cushy, safe existence.
How do you do it, amusing man with the get out of torture free cards?
Great article! One concern I have about no-cloud password solutions such as KneePass is what if my computer blows up? Would I have to go to each website I have an account and reset the password? If that’s the case, getting my email back would be a pain as well.
Otherwise thanks again for the article. I read a while back on the Intercept to use Signal and now that its out for Android I hope more people start using it!
You’re welcome to put your KeePassX database in the cloud if you wish, like in Google Drive or Dropbox or SpiderOak. But the choice is yours.
‘Old-fashioned’ backups of your KeePassX database file would fix that problem ;-)
That backup can be stored on a thumbdrive or another offline storage device or as Micah said somewhere online.
That was a very excellent and interesting interview, thanks. There’s a lot of good tips in there that I’ll probably end up having to employ in my life on account of being a member of the political opposition here in the US (ie, the Libertarian and Green Parties especially; I’m a Green).
Free Snowden, Free Manning, Free Assange. Free everyone.
And now I’m in a revolutionary spirit; here’s a link to some appropriate music (some people may note the irony of this piece in this context):
https://www.youtube.com/watch?v=6oRx-IOUzKg
I just installed signal for my android mobile. It seems to be working well. But, unless I am reading it wrong, wikipedia seems to be saying that signal no longer delivers encrypted messages. Is this right?
This is partially correct. They no longer transmit SMS messages. They convert them to MMS and send them as raw data. This gets around SMS’s requirement that you have an unencrypted header and addresses.
Thank you for very interesting and informative article, Micah; I hope there are more to follow from your time with Mr. Snowden.
Thank you, Edward, for all that you have done and sacrificed, and for the insight you continue to pass along.
Thank you for all the tips Edward. And thank you for the article Micah! An old bastard like me can get kind of rusty keeping up with the security issues of the day after being six feet under for a couple of centuries.
One appalling other this I must comment on is; when I ask a young person (under 40) who Edward Snowden is, nearly 90 % don’t know!?! Considering how much these whippersnappers use Facebook, emails, the internet, etc… Amazing!
when everybody uses Ad-blockers – who will pay the bill? so far its mostly the ad-business which pays for most of the free online-content or its platforms (e.g. theguardian or twitter or facebook rely havily on the advertising industry). anyone a solution?
The ad industry needs to figure out how to profitably advertise without violating people’s privacy. It’s a hard problem, because the more intrusive the tracking the more valuable it is to these companies. But people have a right to privacy, to control how they use and what they install on their own computers, and to protect themselves from shady stuff online — and blocking ads does all of these.
Wikipedia has tons of value and doesn’t have third-party ads or trackers. The majority of the time that people spend engaging with most websites would actually be better spent at Wikipedia… because the majority of websites are crap, propaganda, and/or distractions from things that matter.
The truth is: we absolutely need better ways to fund important creative work. I’m working on such issues at Snowdrift.coop — but the actual overall impact of the advertising industry on the world is net negative anyway: they promote unhealthy products, proprietary technology, and all sorts of ideas and values that are harmful to the world overall. And for those who have ethical products, the noise of the advertising world just makes it more expensive. Ads can be a zero-sum game. I only have so much attention. Unilateral disarmament doesn’t work here. But everyone blocking ads is *good* for the economy. We can figure out better and more ethical ways to fund valuable work.
HI to Aaron and Micah – and Tom –
Have to agree with both of you… Indeed the ad industry really needs to figure out how to respect folks’ privacy. And Aaron, your description of attention is so apt. For example, commercial time on tv has been constantly expanding; some stations even speed up shows to get more commercials in. I watch too much tv and notice; it seems that ad time is really getting close to 50% .
So Tom, I understand that yes, there’s not a free lunch, but what to do if there’s no lunch left?
I encourage the young and tech savvy to find “shelter from the storm” as they can. Like Mister Snowden I was in Special Forces training and made it through, not tougher just luckier lots of people got hurt. As for me I do much in the open and use my real name. I hope they are watching and wasting their time. If some poor lonely NSA girl has got nothing better to do than checkout my old “stuff” I am ready for my close-up.
Good answer
I want them to know me. I want them to know I know them. I want them to consider how many have taken an oath to protect the Constitution or will in the end game support the rule of Constitutional law. We the people make no declaration to any leader or group or administration, they are suppose to serve us under the rule of law. Ever soldier, every civil servant takes this oath to defend the Constitution. If our corporations and elites and agencies of Government collectively by greed for power and wealth lead us to ruin who will win the day, the rule of law or the people who commented sedition against it. Not real sure of the answer but I know where I and millions of others stand.
ES mentioned stalkers are a real concern. TI might want to follow up with investigations of state-stalker orgs and methods. Thanks, ES.
Super article, but all I understood is that electronically I’m as naked as a jay bird. Other than that none of it made sense to me because I’m just a dummy and the terms and items you discussed are way over my protruding brow. Hang tough Snowden, keep kicking them in the balls.
Hi Croaker –
Nah, you’re not a dummy. But I felt similarly after reading the article. I really don’t know if I’d be up to even a basic encryption or even using Tor. The rest of the stuff was really ‘Greek tech’ to me—— haven’t a clue about using a VPN – and kernel? mixed routing? whatever…
The best note I think Snowden hit was that there should be things we can do very easily; so far, for me, anyway, not much happening…
And I’ve never heard any discussion (of course I may not even understand it) but what are implications for encrypting e- mail when on mailing lists?
Great interview, Micah! I’ve really enjoyed your articles.
If you’re reading this from a Mac, have a look at https://github.com/drduh/OS-X-Security-and-Privacy-Guide for more practical steps to securing your privacy.
It is very funny but the article is completely FAKE and post completely FAKE information. Signal uses your phone number for validation and also has backdoor, TOR is completely 100% intercepted. I think Snowden is trying to help NSA to continue monitoring people with this tricks.
Javier,
First of all, it’s Tor, not TOR. Can you please explain to readers of your comment why you think the Tor network is “100% intercepted”? Please use facts and citations rather than conjecture to support your claim.
Thank you.
There are plenty of articles. GOOGLE them.
Example: http://thehackernews.com/2015/11/fbi-tor-unmask.html
I have read this article and it doesn’t give credence to your claim. I think you’re being overly sensitive and flippant, which is unnecessary. In other words, you’re just spreading FUD – fear, uncertainty and doubt.
Some of us first heard of it as The Onion Ring. And the compromise scenario isn’t that hard to believe if you are familiar with natural selection.
The issue is this: suppose you’re a secret spy agency. How many “volunteers” do you suppose you could afford to have run Tor nodes? One, ten, a thousand, a million? I dare say as many as you want, each with a rock-solid profile to look like an authentic member of the community.
So consider if there are N real volunteers to start with. Well, spy agency puts up 1-5N ‘volunteers’ of its own. Now it doesn’t want to completely make it look like they’ve simply out-stacked the original volunteers, so this is where it gets tricky. They have to go out and twist arms – listen to phone calls, look up criminal records, plant drugs every now and then. Eventually some key operators probably end up in a sort of Jocelyn Elders situation of deciding whether to step aside gracefully (leaving the NSA to take up the burden), or watch their kid, wife, or self sit in jail for the full list price of whatever charge was invented. But a larger number can probably just be intimidated into giving up, or be “singled out as examples” to be shut down, with the false comfort that at least there are lots more volunteers (all NSA…) to carry on the good fight.
Do I know that happened? Hell no – I don’t know anything about Tor volunteers. But how, in this world, could I possibly think it didn’t? We couldn’t get companies or universities to keep open NNTP ports or to throw away their old logging data, but I’m supposed to believe that dedicated idealists risk prosecution for child porn or terrorism day in and day out while shouldering the expense of hauling around other people’s mail? I don’t even believe in Santa Claus on Christmas.
Actually, I thought about the volunteer problem as I was reading the article and I’m no computer whiz. I’d like to see Mr. Snowden, Mr. Lee, or a real expert address this.
And… already I’m right. http://www.washingtontimes.com/news/2015/nov/12/academics-accused-of-helping-fbi-de-anonymize-inte/
As usual, they talk about “child pornography” — horrors, someone might look at a picture of a crime! — and promptly use it to go after everybody who wants privacy, without distinction, looking for anything they can prosecute at all.
Wnt, what you’re describing is a worthwhile piece of fiction. I am myself a Tor exit node operator and know of many volunteers on a personal basis. I can assure you, none of what you say is my experience. Of course, the Tor network is not designed against a global adversary capable of monitoring the majority of traffic, anyway. This does not necessarily “intercepted”, nor compromised for certain use cases.
@Johny Encrypt and Wnt –
I was just reading some of Mr. Snowden’s tweets and retweets— seems that Chris Soghoian (sp) for one it checking this out. Maybe it’s not just fiction? Maybe a real cause for concern… (sigh)
Agreed, the voluntary nature of the Tor network invites NSA moles to assume a member status in the node network.
Any snoop worth his salt would join the secret network in a heartbeat.
Serious question: I’d be curious to see your evidence that Signal is backdoored, or that Tor is 100% intercepted. If Tor traffic is intercepted (plausible), that does not mean that users are easily identifiable.
Thanks for the article. I was just wondering why there was no mention of VPN use. Is there a particular reason? Because from my experience there are fewer easier ways to help protect your privacy than a ‘good’ VPN and ease of use seems to be an important part of this article.
Or is it just because the article is trying to focus only on open source, free services?
VPN are intercepted by NSA for last 10 years
Very little to intercept when used in conjunction with Tor and purchased with bitcoin. You seem a little misguided javier.
The VPN interceptions that the NSA intercepted were VPN “devices” that used older, less secure encryption.
There’s no evidence that current VPN implementations such as OpenVPN have been compromised. Of course, it’s essential to use a VPN service that also protects user anonymity by not keeping logs, staying up-to-date with preventing DNS and WebRTC leaks leaks etc.
I was wondering this too. While not necessarily a protection against state level actors most of us don’t have to worry about those but they seem to be effective against ISP snooping and as a protection when using public wifi. Yes, a better choice would be not to use public wifi but that’s sometimes not a viable option especially if you’re just some person going about your business in the normal course of a day.
(I’ll chime in, as a completely UNauthoritative bystander to provide food for thought.)
Firstly, not all VPNs are created equal. Many do not rigorously protect your privacy, and may even sell your personal data. Ironically, many of the good ones are based in the U.S. where data privacy law can be much better than other first-world nations. The key is to subscribe to one that is acknowledged to have an architecture that does not retain your connection information, so even if they are given a legitimate legal notice to acquire your info (within the hour): ‘No dice – can’t be done’. And one that readily supports OpenVPN as your client.
TorrentFreak has various comparative articles to find the right VPN for your needs, with open discussions with the company founders to try and ferret out their commitment to privacy protection. But it is more complex than all that by miles. A worthy VPN is not the end-all. Tunneling in and using a VPNs forward facing IP (that countless others use) is only one piece of one puzzle. If you also have completely unique login information (including a unique one-off email) for every online website used, AND a completely NOT-unique machine-software signature – you’d need to do all that too otherwise an obscured IP may not be effective. To wit: Google is going to collect your personal information if you login to their services, if via your home IP OR a completely discrete VPN – even if using Tor.
(“We are operating on many levels here.” – Ken Kesey)
Snowden blows the whistle on tyrannical over reaching surveillance in the land of the free and the home of the brave and now he has to live in fucking Russia to be safe. How is that for ironic.
Unfortunately Croaker, “the land of the free and home of the brave” is NOT the U.S.! It is the open ocean.
The U.S. is now ‘the land of the surveilanced yellow bellied sheep’ that are now too afraid to speak their mind openly (with the exception of an old white billionaire bigot running for president).
Fantastic interview Micah and Mr. Snowden. I really enjoyed it. I loved that point of evaluating what are the most likely risks we face and address those (putting the others aside) – which for most people doesn’t involve stretching too much.
After this nightmare of reality we’ve been permitted to see that our government (and every other one that can) are doing (surveillance of their citizenry) – it puts you on the foot of what to do and what to have to worry about (i.e. should I use Microsoft’s weakened disk encryption program or not). This interview put a nice floor underneath those wobbly concerns and how to address them.
Hi, since July 2015 the RSS-Feed seems to be broken… to me :-/
I don’t get any Updates via FeedR (Android App). RSSOwl is ok.
Is there any other way to subscribe to the Feed then “https://theintercept.com/feed/?rss”
I think our biggest problem right now is really the timidity amid the ranks of the free speech defenders. Oh, the ACLU and such are great organizations — but how many of them will actually go out there and say that banning child pornography is unconstitutional? Or to point out the stupidity of such a ban when it perpetuates what is said to be a multi-billion dollar market in kidnapping children and photographing them for black market distribution? Or to review the history of “obscenity”, and how the court arbitrarily drew a line beyond which it wouldn’t pass, so that now, kids all over America have to worry that by taking the wrong picture of themselves on their new cell phone, they will get a lifetime brand as a sex offender – even though an adult would not be prosecuted for the same thing?
Because the David Camerons of the world, every one of them USES that bait – uses our condemnation of pedophiles not because of the wrong they do, but out of the purely eugenic notion that what is sick must be exterminated. They expect us to be driven not by compassion for the child harmed but by self-righteous condemnation of the offender for succumbing to urges that we happen luckily not to feel ourselves. They take that and put it up as the reason why criminals should have no safe space to poison minds, by which they mean all your fancy-dancy encryption toys.
And the truth is, the real world is out there riding ahead of the ACLU. The free speech defenders won’t go into court and say that there is child porn that passes the Miller test. But if you go on Wikipedia and look up some ancient pedo like von Gloeden, they actually do display the pictures he took of kids he was screwing, because they have historical and artistic significance. Sanger called in the FBI to investigate them, but they never did anything about it – because they KNOW that a court challenge would force a recognition that that (very flimsy) constitutional protection ought to be expanded.
Now I’m not saying that this one issue would put them entirely out of business, no: after all, they are investing hugely in the idiot industry of lockdowns and evacuations every time some moron on 4chan or YikYak says “Don’t go to school in Antarctica tomorrow, you might get eaten by a walrus.” Nor would we be able to end such a stupid censorship policy without concomitant reforms, such as recognizing that a rapist taking a photo of his victim should expect to forfeit his copyright to the victim at the instant of his crime. (True, I also have a plan to abolish copyright, but I can’t write a book in your comments section) But if we stop believing that the Crusader castles on the hills above us will be there forever, maybe we can dream of a day we don’t live under their guns.
Dreaming of a safe world and fighting for it doggedly are just two important roles – https://www.youtube.com/watch?v=KDpfAC2WRoY
Why does the Intercept use trackers?
If everyone used Tor and or Ad blockers the trackers don’t track.
You rightly say dont allow trackers.
But the question remains , who is pushing the Intercept to use Trackers and why.
All the government need do is get one of those secret letters and the Intercept would be force to hand over that information and it would not be allowed to tell its viewers, it did so.
Who makes the call on the trackers?
The Intercept doesn’t use trackers. What are you referring to? We recently started using a new analytics system, but took great pains to make sure they can’t access reader IP addresses, etc. https://theintercept.com/2015/11/04/what-the-intercepts-new-audience-measurement-system-means-for-reader-privacy/
No tracker, Micah? Then why were we told (in the thread you referenced)to opt out we had to enable do not track me? And it was also said that the only “new” piece of info getting ‘collected’ was how long a reader stayed on a page/article(?) Don’t know why that’s any of TI’s business to begin with.
What trackers? I only see assets and scripts being served from Firstlook CDNs.
The only thing ghostery is reporting for me is Gravatar, which is fine I guess. You have to opt into that and it has to track you across sites to work.
Johny Encrypt & Adam
The intercept wrote a proxy which hides that information from the end user. You can no longer use anti-tracker software like noscript or requestpolicy to block tracking on the Intercept. In fact there is now no way for the end user to know what tracking is being implemented by the Intercept.
Believe it or not, but the excuse put forth for this insanity was “privacy.”
Get used to it. Every panty sniffer on the internet will eventually install a proxy like this to prevent end users from blocking tracking, data collection, and advertising.
It’s good to know the Intercept is leading the way on something.
https://theintercept.com/2015/11/04/what-the-intercepts-new-audience-measurement-system-means-for-reader-privacy/
There’s no way for end users to know what server-side tracking is being implemented by any website, at all. That is the nature of using servers — you can only inspect what’s running in your client, not on the server you’re using.
The proxy makes it so we can still use an analytics service though without having to give them our user’s IPs, and if your browser sends the DNT:1 header then you don’t get included in the analytics.
I think what you are trying to say here is that just because you can’t tell that a server is tracking you doesn’t mean they aren’t. Which was exactly my point.
This faux ignorance from the Intercept techies about how the tracking and spying economy currently works is growing really, really, really tiresome. You understand the exact point I am making. You just don’t like what it says about you and the Intercept–so you are playing possum, but with stupidity instead of death.
Your ranting about IP addresses sounds just like the government’s argument about content vs. metadata.
Do you really think that if google and facebook stopped collecting people’s IPs, then they all of a sudden they wouldn’t be spying on people? This ‘but we aren’t passing on your IP address, so it’s all good’ is a pathetically thin argument.
Also, why in the world is the Intercept using Snowden’s and Greenwald’s overspill credibility to try and come up with ways to make tracking and spying on people acceptable?
You guys should be seriously embarrassed. Even more so if you are being paid to comment here.
Save me the time and effort, and with far more elegance and far less anger. And I have a lot of anger about it, so that’s a good thing.
It’s despicable — the use is despicable, but what’s more despicable to me (as a techie and otherwise) is the willfull or ignorant misrepresentation of what’s going on by the supposed ‘techie writers’ on this site. It’s disrespectful to the users, it’s disingenuous, and it’s actually pretty dangerous if you consider the way the entire network is likely run and set up (including submissions). TI is now just a site I might look at if it has something interesting, and only carefully if that, but not a site I am willing to trust, because it’s not willing to listen to its audience tell it it’s doing things that are untrustworthy. Sad.