Gräßlin: FLOSS after Prism: Privacy by Default

If the policy is not privacy by default then any private communications will stand out and draw suspicion. Moreover, once something is made public there is no way to take it back. Unless you've specifically indicated that you want something to be shared, it's safer to assume that it's supposed to remain private.

Actually I would vastly prefer private by default and then public only when it matters.

> I want privacy where it matters and then I want it well thought out and working. Privacy is hard, not even the Tor guys got it right...

I think that maybe privacy and anonymity are being conflated here? Tor is aiming at approximating both, which is going to be very hard.

I mean I can have a private life and have privacy in my house due to the barriers I have created to prevent observation by others (ie: walls and window blinds), but a great deal of people know I am me and were I live and such things. So I have privacy even though I am no anonymous in my comings and goings. It would be much more difficult to live my life in complete anonymity.

And like that it's very easy to encrypt stuff so that the only you and the server (and by extension the people running the server) really knows what was set. But it's virtually impossible for me to hide the fact that I was communicating with the server.

I think therefore the KDE guy said stuff that was pretty common sense, even though its easy to nitpick specific things he said and idioms he used. It's important to be able to decide what gets sent out and what does not. The only way to maintain privacy on the internet is to simply not send data out over it and if you do need to communicate to have everything properly authenticated, encrypted, and identify accurately who you are communicating with.

c=m xor KDF(key), where KDF is a key derivation function that expands key the length of m, has already been proposed. One advantage of using xor is that the same code, or discrete logic, can be used for both encryption and decryption. The security of this construction is usually limited by the key size.

The main problem that the TXOR solves is to allow a one-time pad like algorithm to be used without having to treat strings as bitstreams. Writing code that translates decrypted bitstreams back to strings takes considerable amount of labour and the only, or at least the main, benefit of the TXOR is to allow to skip the writing of the function decrypted_bitstream_2_programminglanguage_specific_string(..).

It seems to be a trend that the UTF-8 is the preferred format at server side, including databases, and UTF-16 is the default version in JavaScript. The UTF-8 and the UTF-16 are different binary formats that both use varying amounts of bytes for encoding Unicode characters. Part of the computational efficiency of the TXOR comes from the avoidance of the encoding format specific book-keeping that would be run within the decrypted_bitstream_2_programminglanguage_specific_string(..).

Given the task of writing the code that converts decrypted bitstreams back to strings that have the programming language specific/supported encoding, one might also say that the main benefit of the TXOR is to allow a one-time pad like algorithm to be used in situations, where the amount of available software development resources is very limited. Big corporations and NSA do not benefit from the TXOR that much, because they have loads of resources to write practically any extensive software that they please, but small software shops have to achieve the same result with considerably smaller amount of resources.

Thank You all again for
Your answers, questions and
for reading my comment. :-)

If FLOSS people really love anonymity, why don't they try this idea in FOSS communities first?

Why LWN commenting requires an ID?
Why bug reporting requires registration and E-mail address?
Why mailing lists requires an E-mail address?
Why IRC channels requires a nick, sometimes even a registered one?
...

On the other hand, FOSS communication's archive is generally public accessible, isn't this a major source of privacy leaking?

I think you will find some of your ideas covered :-)

I think those are one in the same, data collected by private companies is available to the government spooks and the problems with collecting this data are just as bad if private companies do it as when the government does it.

It's not a matter of opting out of modern living, like some sort of electronic Amish, its a matter of having clearly articulated standards of behaviour (laws) and then enforcing those standards with oversight (regulation). This can be accomplished if the populace is willing to work the levers of power (democracy) to make it happen, otherwise whoever else is working the levers of power (plutocrats) will have their way and no useful standard of behaviour will be enforced.

Personally I'd like to see privacy laws such that it would be illegal to hold personally identifying information from say web server logs for more than two weeks. You could anonymize your stats and roll it up into reports but not keep the full resolution data. Same for phone companies, do they even need to record call history for billing purposes any more, many plans are flat rate, unlimited calling, so we could require that call history not be recorded at all, or be destroyed at the end of the billing period and not be shared with outside parties or used for any other purpose.

> I might (with reservations) be perfectly happy to trust Facebook

Without transparency and oversight that "trust" is blind and very asymmetric, they can make a lot of informed guesses about you as a person but you have no idea how they are judging you.

> Also we need a solution for *routing*. I don't know how this could be done... for example, how do I make a DNS request without the DNS server's administrator knowing; or how do I send an email to a friend without leaking the metadata of the fact of that communication: who spoke to whom and when. [Has this been solved in any of the bit-torrent protocols?]

I don't think is the path to go down, at best it might be useful for those people who have a high tolerance for operational security but it's probably fundamentally impossible to communicate the way we normally do without leaving a lot of metadata for traffic analysis.

> In my view, what we need now is leadership and co-ordination. While I'd like to hope we can defeat the NSA at the ballot box, we will probably have to do it in source-code: not just for ourselves, but for our less-technical friends and family, even those in the Windows world.

I think that if you don't fix this stuff at the ballot box then, while you might have a few cypherpunks patting themselves on the back about how clever they are, the rest of the population is just going to be herded into the wood chipper, metaphorically speaking. Hopefully just metaphorically, the tools the NSA wields and the data that Google and Facebook have, should not be handed on a silver platter to the next Stalin, as if that kind of great evil can't happen again or can't happen here.

The only way to keep data safe is to not have it at all.