270

Privacy. Being able to link every user account to a natural person would be the end of anonymity on the Internet. Maybe you have nothing to hide, so that's of no concern for you. But as Edward Snowden said: "Arguing that you don't care about the right to privacy because you have nothing to hide is no different than saying you don't care about free speech ...


112

Tor is used to circumvent censorship! No, not directly. Tor is about anonymity, not about availability. Tor alone does not help its users access blocked content. Tor helps by making it hard to link clients with site visits, so that people can publish or read content without being identified. It's used to avoid being caught in relation to banned content, not ...


109

In order to block Tor all that has to be done is have the current list of Tor nodes which can be found at the following link: http://torstatus.blutmagie.de/ip_list_all.php/Tor_ip_list_ALL.csv and then block them bidirectionally via the Routers or Firewalls. That said there will be numerous ways around such efforts, people can still use VPN's to connect ...


88

If your adversary is a powerful nation-state threat actor, web PKI will not protect you. Nothing is preventing them from issuing their own certificate. In fact, many governments run their own certificate authorities, such as the US FPKI and affiliates. See a list of CAs currently trusted by Firefox: Government of France Government of Hong Kong (SAR), ...


83

You can't: have multiple, separate accounts (e.g. separate professional and personal accounts, or a separate parody account) have a truly anonymous account have an account if you're a stateless person, or from a country that doesn't have a national ID, or too young or otherwise ineligible to have a national ID allow the national ID scheme(s) to ever change (...


58

It's extremely easy to fake email. If someone did fake this, I don't see how the agency would know about it. The concern is that the link they sent you was the attack itself. For example, this could be a CSRF attack: With a little help of social engineering (such as sending a link via email or chat), an attacker may trick the users of a web ...


55

In some countries, it is simply forbidden to use the most important unique IDs in other databases than those for which it was originally meant for. For example, you would get an ID for the state-run health insurance system, which the tax office is not allowed to use and vice versa. All this to ensure privacy and make it more difficult to cross-reference ...


51

My opinion (and I am a cryptographer -- I have a shiny diploma which says so) is that: We cannot speculate on unknown algorithms, because they are, well, unknown. NSA is like all secret services in the World, they really love secrecy and will practice it for the sake of it. So the fact that their algorithms are not published is in no way indicative of some ...


51

Despite the media hype, the key thing here is not that the FBI/NSA/US Government was intercepting all phone calls, but that it was collecting all phone 'metadata' records which includes: Originating Phone Number Terminating Phone NUmber IMSI Number IMEI Number Trunk Identifier (which relates to the location) Telephone Calling Card numbers Time of the call ...


48

It is likely that the from header has been forged. I get emails from fake .govs quite often, mostly they end up in my spam filter. The hyperlink within is either unique, allowing tracking, or just delivers malware. Most of the time I just ignore these. If you believe that the header is not forged then you can typically contact the agency by Googling their ...


47

I see two possible uses of such information from a government perspective. None of them involves the password or actually using your WiFi access. Forensic analysis: connected devices store an history of access points they were connected to, sometimes associated with "last seen" dates. Using this history, it is therefore possible to know where someone was ...


47

While I cannot speak for every government agency everywhere, in highly secure environments, what I have seen [unable to disclose] is: sandbox email attachments no attachments but authorised, attributable file upload tools In each instance, the attachment is inspected and run in an isolated sandbox. The recipient only interacts with the file through this ...


46

Wiretapping case in Greece 2004–05: officially mandated but disabled interface for tapping into talks was used by unknown entity to listen to talks by high-profile politicians. Juniper VPN Backdoor: use of NSA mandated insecure random generator together with the modifications added by an unknown party allowed decryption of VPN traffic by third parties by ...


37

The Internet at large is designed to resist nuclear blasts. At least, it was a design goal of its immediate predecessor, ARPANET. There is no secret: to survive loss of components, you must have redundancy. In the context of nuclear blasts, this means that there must exist several paths for data between any two machines, and the paths should be as ...


37

Tor will be actually quite hard to block because of tor bridges: Bridge relays (or "bridges" for short) are Tor relays that aren't listed in the main Tor directory. Since there is no complete public list of them, even if your ISP is filtering connections to all the known Tor relays, they probably won't be able to block all the bridges. To ban Tor ...


34

To add to the answer from @RoryAlsop I'd agree that you probably don't, as an average person, have a lot to worry about in terms of the PRISM/phone tapping by the NSA being used for it's intended purprose (anti-terrorism operations by the US gov.) as people's concept of security/privacy most of the time isn't too great. There are other good reasons to be ...


31

There are a number of reasons why building their "own OS" is not a viable option. 1. Research Cost To built a new OS, from ground up without the use of any existing code would require significant research. Even today, there are only four or five popularly used kernels like Unix , Linux kernel, BSD, XNU and Windows NT. 2. Security through obscurity It's a ...


30

A CERT (Computer Emergency Response Team) task is precisely to watch over the security problems on the actives under their constituency. In the case of national CERTs like CERT-AU, they often care about everything hosted on their country, and if they are made aware of any issue, their task would be to contact with the affected owner so that he can fix the ...


27

Segmentation is the key technique here. You never work with sensitive data and external data at the same time. Depending on the sensitivity, you may use a different device that may be air gapped from the external world, but often just a device with mandatory VPN, or a different virtual machines, or SELinux context (hint: SELinux was developed by NSA). Even ...


27

The problem with such attacks is that neither the attacker nor the defender have any incentives to claim responsibility of the attack. As such attacks can be done with small number of people and the internet also makes it possible to conceal the source of an attack, a well resourced attacker can even make it impossible for the defender to realise that an ...


25

An interesting data point here is the DES s-box constants. Wikipedia NSA Wikipedia DES NSA recommended changes in the S-box constants to make DES resistant to differential analysis, which was unknown in the academic and commercial cryptography world at the time. In that case, they were able to make that improvement in a way that was opaque to the users of ...


24

You should respond to phishing from .gov addresses the same way you respond to any other sort of phishing - you don't. Don't reply to the e-mail, don't click links, don't open attachments, don't do anything the e-mail asks you to do. If you really want to be generous, check the WHOIS records for the domain the message claims to come from. That may have ...


23

Assuming you have a basic level of Cyber Security measures e.g. ecrypted hard drives, decent user name and password rules, encrypted VPN tunnels etc. I would say there are a number of issues to consider. Content on the laptops - is this commercially sensitive, nationally sensitive, any export controls applicable. Effectively who would be interested in the ...


22

As someone who tracks people and their habits for a living, I will share a few observations about the average user. Implications of the phone information collection initiative on the internet: There will be a little more activity online worrying about privacy. The twitterverse will "explode" momentarily, but people will be aware of this as something going ...


20

What's the point of stealing hashed passwords? Let's say I steal a hashed password, I can take a random string, hash it, and see if the hashes match. If they do then I've just cracked your password. For example, assume that under some hash function we get the following hash table: "cat" --> AA "dog" --> AB "elephant" --> AC ... If I steal a ...


20

As well as security, there are also colossal privacy concerns. You probably don’t want Facebook and Pornhub to be able to compare notes and link your Pornhub account to your Facebook account. And of course, someone might want to create two different accounts, but they’ve only got one ID.


17

It is not known how to build an Internet voting system that will be verifiably secure and auditable. Ron Rivest, Turing award winner and the R in RSA, has famously compared Internet voting to drunk driving: something you just can't do safely. (By Internet voting, I mean voting over the Internet from client computers not controlled by election authorities, ...


17

This seems like a bureaucratic way of instilling FUD (Fear, Uncertainty and Doubt) in a population. For example in the old Soviet Union, neighbors would routinely spy on neighbors and agencies collected notes on citizens. But the raw data of those notes were so enormous—and the bureaucracy was/is so inneffecient—that the actual information collected was ...


17

Actually we have a very pertinent case in point as to why this is not a good idea. In the US, we have long had a system of credit reporting that is based on national Id. The (absurd) presumption was that if you know the national Id of some person and their name, birthdate etc., you must be that person. The problem with this is that finding out the the ...


Only top voted, non community-wiki answers of a minimum length are eligible