Poll: Will you be changing how you manage your data after the NSA scandal?

https://news.ycombinator.com/item?id=5846564

by lemming • 13 years ago

68 82 13 years ago

news.ycombinator.com

waterphone• 13 years ago

I'm likely going to use a mix of several of the above options. A combination of client-side encryption and my own services, and maybe non-US companies as well, but I don't trust the governments of other countries much either.

rasterizer• 13 years ago

For those now lauding non-US companies: keep in mind that you can not be certain that they aren't under any local intelligence orders and if/when they plan to enter the massive US market they will probably be tapped as well.

pilsetnieks• 13 years ago

Frankly, in my opinion, while EU-based companies with their privacy laws may have some high ground to stand on, of the others, the common web startup with, say, the .ly domain name certainly invites at least as much worry as anything else hosted in the US.

At least, hopefully, this debacle would cause some realistic assessment of the situation with regards to privacy, legality, and data retention instead of, for example, purposefully routing data through third-world totalitarian regimes just because their TLDs sound cool. (I know how DNS works; and it doesn't matter that your servers are elsewhere.)

icebraining6• 13 years ago

If you know how DNS works, why do you say that data is being routed through totalitarian regimes? Not even the DNS replies have to be.

mvkel• 13 years ago

Define: after

We're at the very beginning of the scandal. It largely remains speculation. Until some actual facts come to light, it doesn't make a lot of sense to change.

javert2• 13 years ago

My opinion is that it didn't make any sense to assume total surveillance _wasn't_ already happening, _before_ the scandal broke.

mikeash2• 13 years ago

By far the most surprising thing about this stuff is that everyone is surprised by it.

acqq• 13 years ago

An interesting question especially considering the line from the leaked materials "Dropbox -- coming soon"

ah-• 13 years ago

I already host most things like email myself and I don't plan to change that in the future. I might have to think about how to deal with my google account though.

john_w_t_b• 13 years ago

I have a shared hosting account for $5 per month. It's great for email, web hosting, personal files etc. plus I get to own my data and only share what I want.

yamalight• 13 years ago

well, the rule is as simple as it was for years - if it's online, it's not private anymore. be it hackers or governments - someone potentially can get hands on any of your stuff online.

wilfra2• 13 years ago

Need an option for 'I'm not changing anything because I already assumed all of my data was being monitored anyway'.

That's very different from 'I'm ok with it'.

Wilya• 13 years ago

I'm in the same case. I never assumed that any US company would side with me against the US government, so I already worked under the assumption that the US government (in a very broad sense) could access my Google/Facebook/AWS data if they wanted to, even without a strong justification for it.

lemming3• 13 years ago

Done, thanks.

Dylan168072• 13 years ago

How is it different? If you don't care enough about it to even want to do something then that sounds like the definition of 'ok with it'. Even if you theoretically dislike it.

(If you do in fact want to do something then pick the 'too difficult' option.)

icebraining6• 13 years ago

Maybe we already did?

QUFB• 13 years ago

For IM needs at least, there have been privacy workarounds for some time.

1. Use a client that supports OTR (http://www.cypherpunks.ca/otr/) to get end-to-end encryption.

2. Use your client with Tor (https://www.torproject.org/) to protect anonymity.

3. Use a public (http://xmpp.net/) XMPP server or setup your own server outside of US. Note that the XMPP server operator will have your roster list, so caveat emptor.

msrpotus• 13 years ago

Not okay with it but I suspect that the NSA (and other governmental agencies) would be able to access it no matter what I do. I'm also more concerned about people I know getting their hands on things than about the government doing so.

SeanKilleen• 13 years ago

I'll be trying to change the way the NSA manages my data. :)

DrZen• 13 years ago

I'm moving a couple of servers off AWS and onto servers in Canada as we speak.

Earlier this morning, I moved all my Dropbox and Google Drive data onto a self-hosted server, migrated off Google Reader to a native RSS reader app, and will deal with Email, DNS, etc... over the next few days.

Mind you, the NSA scandal wasn't the prime motivation in all cases... ie. Google Reader being shutdown next month, AWS getting a bit pricey and bureaucratic, etc... but it did give me the kick in the ass.

decasteve• 13 years ago

As a Canadian I'll be "repatriating" my services to Canada. I think anyone using US-based services from a non-US location should do the same.

finkin12• 13 years ago

My entire startup is run using Google services. I have such a love/hate relationship with Google. Their services are great, but I'm very far from being OK with how they use my data. This whole scandal has definitely made me think more about it. I'll be discussing it more with my co-workers to see what it would take to move our data elsewhere.

I'd love to see a comprehensive writeup about how to get off Google services as a startup. I imagine someone has already written it...and my first impulse is to Google it. (facepalm!)

stephengillie• 13 years ago

You could search for it with DuckDuckGo, a search engine that doesn't track.

icebraining6• 13 years ago

a search engine that doesn't track

Yeah, I register that fact in the same bag as "Saddam was planning to use WMDs" and "software patents are encouraging innovation".

finkin12• 13 years ago

I've been trying to transition into using startpage. Is duckduckgo better?

aragot• 13 years ago

Hope to see European start ups, preferrably in Sweden, do that. They can start with some open source like AtMail or Wordpress and build.

Note that a .com domain places the company under US laws. There has been an example of a UK teenager with a UK hosted website be trialled in US for piracy, because of his .com domain. Probably same for .net, .org and probably .perso. So criteria: - European company - Ideally with a very minority of US funds - Not .com, preferably .se or .de.

Who's up ;) ?

dkoston• 13 years ago

Cloud services provide great help but blindly relying on their security doesn't make sense. If you built the system ground up, you'd take time on security so you should do so with your data no matter where its located. Tools like BoxCryptor (or encfs for us diy folks) make quick work of securing remote files. If you store trade secrets or pass sensitive information through cloud services, you should consider the risk/reward of choosing those over a solution you can have more control over (and consider if there's an option to secure your data). While remotely hosted applications can make life easier, you need to always consider that security and convenience are at odds.

mullingitover• 13 years ago

I'm not going to change how I manage my data, but I'm no longer voting for either of the factions of our one-party government anymore. That being said--

I'm just waiting for the news to come out in the next few decades that the CIA/NSA have been rigging election results in the US. Given their track record and their machiavellian nature, I would be shocked if they weren't doing this.

endtime• 13 years ago

Would be pretty hard for Nate Silver to predict all 50 states of a rigged election with public poll data...

akiselev• 13 years ago

How accurate was he down to individual districts though? I think most of our elections are rigged on a higher level than an individual agency's actions but there have been close elections where a few well thought out placements of CIA rigging ops could have (or maybe did :)) changed the outcome of major elections.

AnthonyMouse• 13 years ago

I'm just waiting for the news to come out in the next few decades that the CIA/NSA have been rigging election results in the US.

They don't rig elections in the way you think they do. People vote, the votes get counted. They rig elections by gerrymandering the districts. The result is a large number of single party districts whose members therefore serve forever, since there is no primary for an incumbent's party and the district is drawn so that the opposing party has no chance. Then you throw in the seniority rules that give the most important committee assignments to the people who have been in Washington the longest (i.e. the ones with gerrymandered districts), and have the national party throw a few million bucks behind the primary campaign of "their" candidate whenever one of those incumbents retires, and you have the respective major parties' national committees acting as the kingmaker whenever the outcomes in the few remaining swing districts shift the majority their way.

The failure of the whole thing is that people don't care about meta. Lessig said this in one of this talks. It isn't that his issue (i.e. campaign finance) is more important than your issue whatever it may be, it's that fixing Democracy is a prerequisite to fixing anything else. But people want jobs and low taxes and whatever else that directly affects their lives, they don't care about things like Congressional district lines. The trouble is Congressional district lines and committee assignments and campaign finance are the primary determinants of what policies are adopted in Washington, so if you want politicians to do the right thing first you have to fix the way we elect politicians.

nostrademons• 13 years ago

I've long thought that if there was one law you could pass that would fix the most about what's wrong in Washington today, it would be to require that representatives live in their districts full-time, and conduct congressional business electronically via web or videoconference.

Think of the implications:

It's a psychological fact that people tend to develop the strongest loyalties to those that they spend the most time with. If you spend the year in your home district, you develop attachments to your constituents. They are your neighbors, your friends, your kids' playmates' parents. Betraying them for some big corporation becomes much more emotionally difficult.

Lobbying becomes virtually impossible. Lobbying works today because you can hire one lobbyist in Washington who has time to hobnob with dozens of congressional reps. That facetime is what makes the congressman takes the lobbyist seriously. If the congressman was required to reside in his own district, then any company wishing to pass legislation in their interest needs to hire 200+ lobbyists, one for each of the districts that must vote their way. Suddenly it's a lot less economical to buy Congress.

Gerrymandering becomes residentially undesirable. Are you going to add a poor black neighborhood just to gain some Democratic votes if you have to live there? Do you add the fundamentalist Christian neighborhood to pick up Republican votes even though you can't stand the folks there? Add a law that the congressman must meet with his constituents regularly, and the idea of gerrymandering districts becomes even less attractive, as suddenly you have to drive a long distance for dinners & events and stuff.

Direct citizen participation in government becomes possible again, as it becomes possible to meet directly with your congressperson and raise a pressing issue.

Representatives will be much more clued into the "pulse" of their district, and aware of how the choices they make in government affect ordinary citizens of this country.

mesozoic• 13 years ago

Why would they need to rig elections in a one-party system. They win, whoever wins.

alex_doom• 13 years ago

I'm not sure what worse about all of this.

A) The amount of a data they are getting and able to see.

B) Having to listen to annoying conspiracy theorist and/or stoner friends tell me about "the internet"

pyvek• 13 years ago

At the least, I'm going to take my data away from Dropbox and switch to a self hosted alternative. And also change email and chat providers (currently gmail and gtalk).

cranefly2• 13 years ago

Just use boxcryptor inside dropbox

eightyone• 13 years ago

I plan on setting up a cloud system using BitTorrent Sync, Owncloud, and a Raspberry Pi. There's a great article on it, if you're interested. [1]

[1] http://blog.bittorrent.com/2013/05/23/how-i-created-my-own-p...;

anona• 13 years ago

For those who said they are using services from non-US companies, what alternatives are you using for dropbox, gmail, search, etc?

utunga2• 13 years ago

Please don't be under the impression that things are any different outside the US. In fact, if anything NSA surveillance (with the help of various allies) is even more pervasive. In particular the UK, Australian, Canadian, and NZ equivalents to the NSA are very closely tied in (effectively organisationally integrated) as part of the Echelon progam revealed/described by Nicky Hager way back in 2000 http://www.nickyhager.info/echelon-a-story-about-how-informa.... Things only escalated since 2001 of course. Similar programs exist in Germany, NATO countries and generally, around the world, this being the official and legal mission of NSA (to monitor foreign communications).

When I was interviewed for a job at the GCSB (NZ equivalent of NSA) they described how each member of the alliance, being hamstrung by the legislation that did not allow them to monitor their own citizens had formed an integrated program (he didnt use the word ECHELON) where they arranged for each ally to monitor the communications of their 'foreign' allies and then to share information. He said this in a job interview so not exactly a secret! I guess after a while the NSA felt they could no longer rely on foreign services to do a good enough job. Since the funding for NSA is so incredibly massive (larger than FBI and CIA combined) what did you think they were spending all that money on?

Perhaps one of the few places your cloud services be free of NSA monitoring would be in China. But then... ;-)

lemming3• 13 years ago

I'd assumed that moving back to NZ might be a solution, sadly that seems to not be the case. Fortunately it's a nice place to be anyway.

It seems like the only option is to live in a country that's so insignificant that no-one cares about it, and whose government is too incompetent to implement something like this :-)

utunga2• 13 years ago

I think we qualify under the last two criteria ;-) unfortunately our GCSB get's lots of help from our big brother across the lake. We actually had our own wee 'Oh noes they are spying on our local citizens' scandal the other day.. the response of which was for the government to pass legislation making it retroactively legal. Yay. http://www.scoop.co.nz/stories/HL1305/S00043/gordon-campbell...

moultano• 13 years ago

So far we have nontechnical reporters attempting to interpret a PowerPoint slide vs the heads of every big tech company and the NSA flatly contradicting without ambiguity the conclusions they are coming to. I think your poll is making a lot of assumptions about what is actually happening.

JacobHenner2• 13 years ago

I've always used PGP and OTR for messaging, and client-side encryption for cloud storage. I don't think I'll be changing much.

dublinben• 13 years ago

How have you convinced your contacts to use PGP and OTR to talk to you? I've always been interested in using these, but then I would never be able to talk to anyone.

JacobHenner2• 13 years ago

I don't use the tools for every conversation, but for anything I wouldn't want overheard, I help the person I'm speaking with configure Pidgin or Adium. PGP is more of a rarity.

icebraining6• 13 years ago

I'm a little surprised that there are so many people here changing behaviors. While I certainly didn't know the details, I thought it was common knowledge among tech people that they had the capability and certainly the will to do so. I mean, the EP report on ECHELON was before 9/11!

Personally, I'm going to do what I've been doing. I run my email, RSS reader and other services on EU hosted VPSs, my online data storage service is a Raspberry Pi in my house (with encrypted backups offsite), but I still use Google Search†, Youtube and etc.

I also think the idea that we in the EU are much better is wishful thinking. We're all living in Amerika, and that applies to Internet spying as well. I think the CIA unlawful detentions and plane transfers[1] shows well how the American TLAs can just do whatever they want without any real consequences.

† Yes, even logged in. I think the idea that you're any safer because you clicked the log out button is incompatible with understanding how the web works.

[1] https://en.wikipedia.org/wiki/Black_site

LowKarmaAccount2• 13 years ago

Yes, even logged in. I think the idea that you're any safer because you clicked the log out button is incompatible with understanding how the web works.

If you don't share an internet connection with anyone else, or have a unique browser fingerprint, then logging out won't do much. If you do share an internet connection with other people, or use a coffee shop wi-fi access point and have a non unique browser fingerprint, then logging out makes it harder to determine who you are.

icebraining6• 13 years ago

Logging out is just an UI action. It doesn't, for example, delete the cookies put there by Google, so you're just as trackable.

sreitshamer2• 13 years ago

I've been working on a Dropbox-style system that does client-side encryption and runs in my own AWS account for a while now. It's almost ready for beta. Recent events help validate the effort for me.

kybernetikos• 13 years ago

Have you considered spideroak or jungledisk?

The biggest worry with such a setup would be losing the key.

There are a couple of options for client side encryption cloud services, but so far I've struggled to find one that I can run headless on a lightweight debian on arm that does full folder syncing (rather than one way) with remote servers efficiently.

sreitshamer2• 13 years ago

I don't understand Spideroak. The first thing you do with Spideroak is type your password into their web site to get started. How is that "trust no one" security?

geekam• 13 years ago

What are my options if I want to use my own email service on my own domain? Currently, I use Google's app services for the email on my domain.

cscurmudgeon• 13 years ago

"I'm going to try to use services from non-US companies hosted outside the US. "

I am curios about this. Is there any nation which has a better record that the US?

As far as I know, the US seems to be doing this for preventing cataclysmic events like dirty nukes, but other nations seem to be doing it for almost anything.

Zigurd3• 13 years ago

I am curios about this. Is there any nation which has a better record that the US?

The US is middle-of-the-pack compared to other industrialized nations at lots of other things like http://www.economist.com/media/pdf/QUALITY_OF_LIFE.pdf. I would be surprised to find fewer than 10 places with better privacy protections.

eksith2• 13 years ago

"I'd like to do something but it's too difficult to avoid using cloud services."

In Cloud We Trust, eh?

Oh dear. The fact that this is edging ahead is a worry indeed. This presumes a significant number of people (in a reasonably tech-savvy crowd) decided to build their infrastructure on VMs vs. proper iron (hired or otherwise).

I hate to sound like a broken record, but Stallman was right.

From 2008 :

http://www.guardian.co.uk/technology/2008/sep/29/cloud.compu...

  "One reason you should not use web applications to do your computing is 
  that you lose control," he said. "It's just as bad as using a proprietary 
  program. Do your own computing on your own computer with your copy of 
  a freedom-respecting program. If you use a proprietary program or 
  somebody else's web server, you're defenceless. You're putty in the 
  hands of whoever developed that software."

I'm not above absolved though. I use Gmail too.

u23282• 13 years ago

So what do we do? What does Stallman do? Do I run my own postfix box in my closet? I'm suppose I'm technically literate enough to pull it off, but what about friends and family?

eksith2• 13 years ago

Speaking of friends and family...

Once upon a time a friend of mine did this for me on his FreeBSD box. My username at his domain.com worked pretty well, but I couldn't send big attachments (this was on his dinky little 400Mhz box with a massive 40Gb WD drive).

It's terribly inconvenient, but if plenty of other people begin to do that already, I'm sure some nifty startup will create tools to automate the tedious bits.

Add a site too, and you have something a bit like a "presence-in-a-box" package, if you will, that you can run over your home cable/DSL/FiOS connection.

icebraining6• 13 years ago

The FreedomBox Foundation[1], headed by Eben Moglen[2], is trying to build a plug computer based on Free Software so that "anybody, regardless of technical skill, can easily enjoy secure, private, even anonymous communication".

[1] https://www.freedomboxfoundation.org/learn

[2] https://en.wikipedia.org/wiki/Eben_Moglen

quasque• 13 years ago

On a more positive note, this could be a real boon for future historians, if the data is made available to them hundreds of years from now.

By mass recording a sizeable chunk of the world's electronic communications, they effectively have crystallised human culture at that point in time.

It would be fascinating to see the equivalent from, say, 500 years ago. (Reminds me a bit of the plot of The Light of Other Days [1], where wormhole technology is used to peer anywhere into the past.)

Unfortunately the intelligence community will likely just keep such data secret, and continue to use it for their own suspect ends.

[1] http://en.wikipedia.org/wiki/The_Light_of_Other_Days

u23282• 13 years ago

Well, I'm going to try "only going to use services that allow client side encryption", at least.

incompatible• 13 years ago

I encrypt some data with gpg -c before storing it online (offsite backups are useful after all). However I'm now contemplating whether my password is vulnerable to brute forcing. May need even more bits of entropy, while still being able to remember it in case the backup needs to be restored on a fresh system.

jamesjporter• 13 years ago

just use a long, randomly generated passphrase and write it down on paper. you'd be surprised how quickly muscle memory sets in after you type it a few times, and if you forget you always have the paper backup (keep it in you wallet or desk).

mpyne2• 13 years ago

I'm way more worried about skilled computer crackers w/ organized crime than I am about the government (who I've at least personally verified the incompetence of :).

I'll continue using tarsnap (thanks cperciva!) for stuff I need private and learning not to worry as much about the rest.

krapp2• 13 years ago

You seem to be assuming the government doesn't hire skilled computer crackers or, as need be, the occasional mafioso.

mpyne2• 13 years ago

I make a lot of assumptions about government, but I at least have experience to back those up.

dm2• 13 years ago

Any sensitive material that is uploaded should be encrypted anyways.

Self-hosted email is pointless without both parties doing it. Self-hosted would also probably be less secure, less reliable, and have a higher chance of complete failure verses a well established cloud email service.

Using non-US companies is dumb, the whole point of all of this hoopla is that the NSA isn't suppose to be spying on American citizens. The legal mission is gathering foreign intelligence, how is non-US hosted services going to help? The NSA doesn't have a problem with interception and encryption, they practically invented it.

How could anyone possibly believe that the NSA is not gathering a significant amount of data from US companies and US citizens? Their mission is to gather foreign intelligence, to protect the US security systems, and to maintain information dominance. "This Agency also enables Network Warfare operations to defeat terrorists and their organizations at home and abroad, consistent with U.S. laws and the protection of privacy and civil liberties." They ventured into the grey area regarding "privacy and civil liberties", but is the mass interception of data and computer analysis of that data (without it being touched by humans) for strictly national security protection (no political party bullshit) really that bad?

The real issue is that the NSA is not technically allowed to spy on US citizens, which many would argue is 100% required to protect the United States and its allies. More checks and balances need to be in place so that any gathered data is not abused.

Anyone who parades around on the internet spilling their guts over a non-encrypted connection (not that it matters to the NSA), is naive to think that a government doesn't analyze this data. People argue that terrorists could just use "codes" or obscure language so it's pointless to monitor gmail/facebook/everything, but you're battling the NSA, codebreaking is what they live for.

Yes, 1984 is pretty scary, but the issue is so complicated that there is not necessarily a clear right/wrong answer. How do you gather signals intelligence and ensure that horrible terrorist/criminal acts are not committed within this country of 350 million non-trusted citizens?

The public is just now starting to debate (and strongly oppose) the collection of data by the US government, but do you think the govt employees care? Who is going to tell the NSA to stop collecting/analyzing network communications? They would laugh at you and do their best to ensure that leaks do not happen in the future.

ravisarma• 13 years ago

To make this complete you need "No, because I host all my own services already".

noerps• 13 years ago

The option that somebody already is self hosting and using secure end to end crypto, it may be wise to add that option; it is not really breaking news to the people with the tin-foil-hat.

ef42• 13 years ago

The hassle of hosting your own stuff is really not the relevant barrier. That's merely a technical problem, and it could be solved by plucky startups or open source projects (like FreedomBox).

The real barrier is social. Nothing you do as an individual to host or encrypt your email, or IM, or social media presence, etc, is going to matter unless you can bring your friends and colleagues along with you.

Poll: Will you be changing how you manage your data after the NSA scandal?

Related Stories