For Hackers, Anonymity Was Once Critical. That’s Changing

https://www.nytimes.com/2018/09/22/technology/defcon-hackers-privacy-anonymity.html

by extarial • 8 years ago

144 81 8 years ago

nytimes.com

qrbLPHiKpiux• 8 years ago

It's just career progression. New blood needs to fill those shoes who move to corporate.

praptak• 8 years ago

Blood that fills shoes is a metaphor that carries some unintended meaning.

p1mrx• 8 years ago

Are you saying that filling shoes with blood sounds gross, or does that metaphor refer to something more specific?

stareatgoats• 8 years ago

We'll surely have the option to stay anonymous for a many decades to come, while a real name policy becomes more established as well. The two serve different purposes and only in edge cases is it really unavoidable to create a link between them.

What is still lacking AFAIK are services that can guarantee anonymity for the average user without jumping through a ludicrous number of hoops that ultimately looks suspicious.

swaggyBoatswain• 8 years ago

Haven't been to defcon personally, but I use to go to hackerspaces in LA all the time.

I never knew what the meetup organizer's name was. Everyone always referred him with his userhandle and they did not know either.

This reminds me of "malwaretech" from wannacry

https://www.reddit.com/r/IAmA/comments/6cmmdf/iama_the_accid...

hannasanarion• 8 years ago

I would be happy for anonymity to stay an option at least. It's not as important as it was, sure, but it's still very useful.

Anonymity is great for side projects that amount to practice, that you don't expect them to turn out well, or things you might be embarrassed of in the future, like comments on Reddit and hackernews.

Tharkun• 8 years ago

If anything, now that the internet has effectively become mankind's long-term memory, anonymity feels more important than ever. If you got into a regrettable flame war on some mailing list back in 2001, it's still out there, waiting to be used against you, out of context and in a different era.

People need to be able to make mistakes - or voice uncomfortable truths, blow whistles etc - without having to worry about repurcussions in some unknown future.

munin• 8 years ago

It's hard to blow the whistle anonymously, people seem to react poorly to anonymous accusations. There is even an amendment in the US constitution that mentions this. And even today on the Internet, if there is reporting of anonymous accusations against someone or a company for wrongdoing, people will ask (on this very message board) "oh if it was real, why won't the accusers come forward and be named?"

nobrains• 8 years ago

Because then there is no way to verify if the accusation is true?

sparkie2• 8 years ago

Uh, that's completely the opposite scenario that I've seen over the past several years, where any accusation made against a white male are met by hoards of keyboard warriors quickly pointing the finger on social media, handing out a metaphorical death sentence before any trial has occurred.

The need to ask for somebody to go public before investigating their claims is so that you can attempt to discredit their claim by discrediting their person.

AnthonyMouse• 8 years ago

And even today on the Internet, if there is reporting of anonymous accusations against someone or a company for wrongdoing, people will ask (on this very message board) "oh if it was real, why won't the accusers come forward and be named?"

An anonymous accusation has no weight. But that's not what they're for. They're a suggestion to investigate something. Because if it's real then there should be other evidence -- third party witnesses, documents, phone records, surveillance footage, a pattern of behavior where a more recent incident can actually be proven, etc.

No one should take them seriously as evidence but journalists should take them seriously as tips. And if the journalists following the lead actually find something that can stand on its own, it's only then (and not before) that you have a real story instead of an unsubstantiated anonymous accusation.

Anonymous tips are not worthless -- they're actually really important -- they're just not evidence.

smsm428• 8 years ago

People react badly to anonymous accusation that rely solely on the word of the accuser. Because, indeed, it's impossible to evaluate this situation without knowing how trustworthy the accuser is. However, if the accusation is backed by the documents, nobody cares that the accuser is anonymous. Deep Throat has been anonymous for 31 years, and still his information has immense value. If you say "I heard X say Y" then maybe you're lying, maybe not - we shall see who you are and whether we could trust you. If you say "I've got a recording of X saying Y, made in a way that makes it extremely hard to fake" - nobody cares much who you are anymore, everybody cares about the recording now.

Benjamin_Dobell• 8 years ago

In the circumstances you've described, I feel as though anonymity is just a work-around for a larger flaw of mankind. The underlying issue is that humans tend to lack empathy, are too judgemental and just generally overly critical of others.

It's 2018, but we're still quick to grab the pitchforks and torch the place - metaphorically speaking.

whatshisface• 8 years ago

Changing the environment is a whole lot easier than changing human nature. "Hanging them by a word," goes back as far as recorded political history. If a plan for a better society involves replacing the people that live in it with better people, it probably won't work.

smudgymcscmudge• 8 years ago

“Humans lack empathy”. Compared to what?

NeedMoreTea2• 8 years ago

People are unlikely to fix that any time soon so we'd better keep that workaround as long as possible. Just look how fast racist attacks come after a news or political event. Or the succession of attacks on the innocent because some thug mistook paediatrician for paedophile.

In older days if you escaped the actual pitchforks you could move 20 miles away and start over. Now every moment of teen foolishness, those naive political beliefs at university, and that joint you smoked but "did not inhale" are either photographed or documented in perpetuity against your real name.

That seems a massively foolish gift to everyone with a pitchfork, or looking to spend an amusing hour assembling a lynch mob, or even a short sighted potential employer. God help you if you want to run for office 30 years after your foolish teen excesses.

throwaway88792• 8 years ago

2018 isn't that far from ~200k years ago. People have always grabbed pitchforks and it is unreasonable to expect them not to. Only the comforts of civilized living gives us enough room to think about morality and act on it. If these comforts disappeared, it would take humanity less than a generation to go back to a time when people paid money to buy the best seat at a public torture/execution.

thomastjeffery• 8 years ago

That issue is nearly impossible to solve, because of the scale. You are talking about a significant change in each individual of a significant portion of the population of humanity.

Anonymity and privacy, on the other hand, are scalable solutions.

mindslight2• 8 years ago

Empathy, which is effectively modeling another person, requires effort which is proportional to how different they are from you. Furthermore, to be willing to expend that effort requires a belief of good faith. Empathy is not, and could never possibly be, "Internet scale".

coldtea2• 8 years ago

In the circumstances you've described, I feel as though anonymity is just a work-around for a larger flaw of mankind. The underlying issue is that humans tend to lack empathy, are too judgemental and just generally overly critical of others.

Yes, but evolutionary flaws of mankind can't be wished away (and even if they could, they might have other side-benefits that we'd loose, as they co-evolved in very complex mechanisms. Perhaps having too much empathy can make you easy to be wiped out).

Anonymity, however, can be achieved with technical means.

kzrdude• 8 years ago

Multiple things are happening, and while we have more mob rule and witch hunts on social media, I think empathy is also being curated more than before. Empathy for those that are not close to you, to be specific.

class4behavior• 8 years ago

(Pseudo-)anonymity is a psychological need and by no means merely a remedy for a flaw of ours.

MisterTea• 8 years ago

That's because we don't have equality. If everyone were living in a singular utopia then we'd all be pretty cool with each other. But we're not. We're always looking at what the other guy's got. And we want it.

api• 8 years ago

The problem is that anonymous information is worthless unless it can somehow be verified. There is already so much fake propaganda that I'm starting to disregard anything without verifiable provenance.

simongr3dal• 8 years ago

The same can be said about information that is not anonymous, it is also worthless unless it can somehow be verified.

joewee• 8 years ago

Luckily search engines don’t seem to value the content of mailing list. Or Usenet postings. I’m guessing certain types of content will become less prominent in the future if it’s not easily structured to whatever the current advertising medium.

RickJWagner• 8 years ago

I've always adapted a policy of using my real name as a moniker on social sites.

It prevents me from writing harsh things. I figure that anonymity is temporary, that real identities can always be determined if someone digs hard enough. I don't want something I say in the heat of the moment to come back to haunt me years later.

It's not for everybody. I've probably made some secret enemies that know my name. But for me, it seems to be the best way.

tjr2252• 8 years ago

I think this is super healthy and a really sensible approach - but it does seem unorthodox in today's internet.

People see it as a right to say whatever they want to whomever they want, but really should we be able to do that without consequence?

Anyway, I love this idea - it just sucks that I can tend to have what some would consider politically extreme ideas that some employers may or may not find off putting. I inevitably create "alt" accounts on sites like Reddit to voice these views.

WilliamEdward2• 8 years ago

As someone who uses their real name, I have faith that in the future no one will care what you wrote on the internet because virtually everyone has said something dumb or incendiary.

Also, as a rule I only use this name on sites that are clean and professional, ie: github, where I know I will only post sophisticated things that could benefit my career, unlike reddit where i just want to fuck around.

tenpies• 8 years ago

My biggest worry would not be about today or even next year, but rather ten years from now.

In 2010, I could have said "women do not have a penis" and faced zero criticism. But if I say the same thing today in the ultra SJW woke society of 2018, it's grounds for instant allegations of transphobia, sexism, and a whole bunch of accusations that result in social and professional ostracizing without any sort of verification or context. All it takes for this is one person who dislikes me enough to dig through $age years of online history and finds that one statement that does not hold to this instant's ultra progressive intersectional social justice standards.

Put simply: I do not trust society at large to remain rational enough to want to attach my real name to anything but the most mundane of statements.

expected_line• 8 years ago

But 'to be able to talk (and write) about everything - is just the beginning'... Some years ago, before the polarization-outrolling started countrywide (in Real Life -and of cos in my personal view of what happen ^^) this seems to be the 'Motto'. Jet one takeaway seems that censoring added the need for even censoring more, and for the country's digital-agenda (away from industry-production for environment protection to the production of more virtual 'goods') there seem to be shiny low-hanging-money in, while the disturbed people seem to reject regulation with much impulsive behavior as a result. And so the saga of action reaction effect continues...

Plugins please, maybe tor-browser run out of the text-based-web-speeder 'request policy'-plugin -and no, 'ublock' is not an option (-;

qubax• 8 years ago

I've always adapted a policy of using my real name as a moniker on social sites.

That's a terrible policy. Anyone can create a username as you then and post offensive things and you'd be screwed.

WilliamEdward2• 8 years ago

If this was as big of a problem as you say, political figures and public personalities would be screwed. Spoiler: it's not, because people tend to understand that a username is not always a person.

Also some names are super common and therefore cannot be proven to be just one person. Just google Rick J Wagner and tell me if you only find one of them.

bayesian_horse• 8 years ago

Now it's critical for everyone.

mindslight2• 8 years ago

This larger narrative is disingenuous, as it's still rooted in this tired mischaracterization of using an "alternate name" as "anonymity". Presumably because anonymity == scary and non-birth-given non-state-registered name also == scary.

From a technical perspective, using an additional long-standing nym isn't much different from just using a single one! The people they're profiling (!) are essentially microcelebrities - notable in their circles, presenting in meatspace, being photographed, etc. I'm sure their [stated] nyms are still serving many purposes, but preserving privacy they aren't!

Meanwhile (and this is why I take issue) there most certainly is a type of "working" anonymity that all kinds of people rely on, which is in the process of being involuntarily destroyed. It's almost inherently impossible to report on without resorting to indirect narratives, primarily based on some kind of disempowerment. But I think what they all really boil down to is our individual self-determination over the scope of our own relationships.

It's a parallel je ne sais quoi to dragnet surveillance. I personally don't have anything to hide, and if a government agent wanted to get up in every aspect my life I would be powerless to prevent it. BUT we all benefit from keeping the unnotable generally unnoted, rather than cataloged, characterized, and used to presume to know us removed from our personal context.

(I know I haven't done a great job describing this - it's awfully tough to describe the indescribable/unenumerable. But someone is going to have to, in some very persuasive universally-appealing words, if we're to retain any of it).

endominus2• 8 years ago

If you give me six lines written by the hand of the most honest of men, I will find something in them which will hang him. - Cardinal De Richelieu.

Regarding your latter point, re. self-determination, I'll try a stab at making it more relatable. Let me know if this approaches that ineffable problem.

Our presentation of ourselves is essentially plastic; with few exceptions, changing social or temporal variables change our self-expression. We do not act around our family as we would around our colleagues or around our close friends. We did not act as a child as we did as a teenager, or young adult, or elder. It is socially acceptable and even expected to modify "who you are" to fit the situation you are in.

The internet and mass surveillance has crystallized that plastic nature. You are not just the person you are now, but also the person you were ten years ago. You are not just the person in front of your employer or parent, but also whoever you are to your friends or romantic partners. You are no longer allowed to pick and choose how to represent yourself to another person; your entire history is available for their perusal. The best representatives for the downside of this, I think, are teens. Everyone can remember stupid things they said or did as a teenager, and for the first time, none of that history will ever be erased. The words you spoke at one of the most irresponsible and impulsive parts of your life will forever be a Sword of Damocles hanging above your head.

(Oddly enough, I think this is not, fundamentally, an awful thing, but for the fact that social understanding has not advanced past the monkey-brain thinking that the perusing in front of you will act according to the sum of information you have about them. In the old days, you would see that they were a decent enough worker and that would be it. But now you know they like to, I don't know, drink a lot or smoke weed in their own time and that colors everything else about them in your eyes. I can't help but feel that within a few generations the old way of thinking will die out, by necessity if nothing else, but agree that for the present it represents a significant problem)

smsm428• 8 years ago

Cardinal De Richelieu.

They key here is that the Cardinal can hang virtually anybody just by willing to do so. The justification is secondary, just for appearances' sake - if the Cardinal wants somebody hanged, they'll hang (unless they find a more powerful ally, of course), and "finding something" is just a formality, like signing the documents in proper places with proper name. Wielding this power is the key, and that key would decide whether your past words would be your doom or a justifiable youthful digression. If you look at how it happens, you can see the power currents of the society the same way you can see the magnetic field lines by watching metal dust affected by it.

clubm83• 8 years ago

Maybe psudoanonymity - using a single handle for years and years and building up an identity is dying off... but anonymity certainly isn't.

I registered this handle via Tor. I don't use it on any other sites. I'll probably ditch it after a year or two, since on a long enough timeline little bits of info slip out when making substantive comments. An astute observer can suss out what times I post, what topics I comment on, and make educated guesses about my identity.

I have a "real" identity - a public persona. It has a cutesy nickname, a twitter handle, and all the other online presence. But it's all incredibly carefully curated, since as the article points out, one slip up and you're done. The feeling when posting with it is so suffocating I rarely do.

deytempo• 8 years ago

If you use one anonymous handle long enough, a neural net will eventually be able to connect your subconscious mannerisms to posts made by your true identity.

clubm83• 8 years ago

This assumes you post the same way on your true identity.

The language I use in work related emails is very different than the language I use socially online.

repolfx• 8 years ago

Maybe. But that's supposition today.

chii• 8 years ago

public persona

i keep my public internet persona as public as it needs to be - but i do not want it to be connectable to my physical persona. I want people to take what i say for what it is, rather than who i am in real life.

But, i do want people to judge what i have said in the past as my public internet persona, because this will give me incentive to not be hypocritical, and also to ensure i project a single, unified point of view throughout my history.

Being _too_ anonymous means you don't consider what you say, nor what the effects might be. It may lead to detrimental results for large systems, and i won't be part of that.

opaque• 8 years ago

Pretty strong selection bias here. Hackers that have showed up at an IRL conference are probably not on the more paranoid end of the spectrum.

Meanwhile pseudonym hacking continues (e.g. Phineas Fisher) and interesting data dumps make their way to journalists ( https://en.wikipedia.org/wiki/Paradise_Papers)

clubm83• 8 years ago

Hackers that have showed up at an IRL conference are probably not on the more paranoid end of the spectrum.

If you are able to think critically about risks, going to Defcon isn't very risky.

Mass surveillance means that "the man" probably knows[1] you have an interest in security whether you attend or not.

Hackers of many skill levels attend Defcon... merely showing up isn't going to suddenly make the FBI start bugging you.

[1] https://thehackernews.com/2014/07/beware-of-nsa-if-you-are-p...

drasticmeasures• 8 years ago

Just commenting on this thread is enough.

The NSA / MI# / [Military Intel of Country X] know me. I know them. I don't do shit. They don't do shit beyond some pranks and exchanging banter. What are people so paranoid about?

When you get to meet the boogeymen, they have amazing tech developed by someone else, but the people who use it are stupid, incompetent, paranoid military average joes who more often than not shoot themselves on the foot or cause the problem they were trying to prevent because they never de-escalate.

Secrecy, violence and a carefully-built media reputation just hides how ineffective they are despite mass surveillance and infiltration of all public online communities.

badrabbit• 8 years ago

Story time: I've hanged around hacker/infosec circles for quite a few years. I have a terrible personality where I can't get close to anyone or open up(not a joiner),that meant I couldn't be part of any inner circles. Eventually, over the course of many years I discovered all the ways my IRL identity could be correlated with my online activity. I also discovered groups of hackers(not the nice kind) make a hobby out of deanonymizing people,especially anyone that has remotely anything to do with infosec. I also realized many (not all) of these people had real jobs and that they could affect my life in very real ways.

For example,I am using a VPN now and my browser has strong privacy protections configured. I am very confident that my identity could still be revealed by analyzing my writing style and correlating other behavorial metadata. Although I am not certain,I assume anyone in infosec that is interested in my off-work activity is monitoring my hn posts.

Ways I've screwes up over the years:

* Forgot to sanitize my whois

* Used my regular email when consulting about IT work with IT/infosec people I did not know

* Reused passwords for many years.

* Didn't change reused password after inadvertently posting it on a public forum/chat.

* Didn't use a VPN or Tor for many many years.

* Assumed for a long time that 0days were used by an elite few and that nobody would burn one on a boring person like myself.

* Assumed IT coworkers/bosses would never actively stalk me off-work because I assumed only a serious psycopath would do that to a human they see everyday.

* Assumed my home computers' security without considering how easy it is for anyone to literally break into my place (has happened).

* much more

All in all, acheiving a reasonable level of security and privacy is a very difficult task for an individual.

One of the reasons I got into security is because I kept thinking "I do IT for a living. What about all the normal unsuspecting people? What about my family members,heck pretty much anyone." It feels too much like a one-sided war against the 99% of people who are not tech-savvy. I want to help protect people who don't know how to protect themselves. Interestingly,the most diffult part is making people understand that they are under attack by extremely hostile parties.

Fortunately there are many pros that share my view. @evacide on twitter for example helps women who have had their devices hacked by a stalker/hacker.

For someone who does not work in IT, being monitored by a hacker practically drives them into extreme paranoia. It causes real mental harm. IMO,it should be treated as assault.

I realize most of what I said is about hackers deanonymizing people and not the other way around like the article. I just thought it was important to note how many hackers are part of the problem and that we should consider how much more non-hackers need anonymity,pseudonymity and privacy in general.

Lastly, I'd like to say this to anyone who tracks or monitors people(analytics count): consent is key. Imagine someone looking at you bare naked,this is fine if and only if they have your consent.

mythrwy• 8 years ago

For Hacker News, NYT having 2 articles on front page every day was not critical. That's changing.

jymbo• 8 years ago

This shit is propoganda. Ain't no hackers giving up anonymity.

amelius• 8 years ago

More and more hackers are using Facebook, Chrome and Google.

If even hackers don't care about privacy anymore, how can we expect it from the general population?

smsm428• 8 years ago

I think this is confusing anonymity with pseudonymity. Anonymous hackers don't want anybody knowing about them, pseudonymous ones do want it very much, they just don't want everybody to know their legal name and address and so on, but very much want to know their handles and what they do. These are different modes of operation.

I also think there's a bit of survivor bias here - yes, many old-times hackers came out of the shadows of anonymity or pseudonymity, either voluntarily or involuntarily, either because they grew up and got a family and a business and a personal brand, or because they're not into shady stuff that requires hiding anymore, or because whatever they have been doing became so successful one can't be anonymous anymore, etc. That doesn't mean others still don't have anonymity, just NYT did't got to talk to them - because they're anonymous and don't want to talk to NYT either...

kyboren• 8 years ago

A better title might be, "For Some Hackers, Anonymity Was Once Critical. Now, They're Corporate Sellouts."

For Hackers, Anonymity Was Once Critical. That’s Changing

Related Stories