Security quotes of the week [LWN.net]

Those of us who have used VPNs in China know that it is at best a haphazard solution, with VPN users often plagued by spotty service and slow internet connections.

This problem was also demonstrated by Fang [Binxing, architect of the China's infamous Great Firewall], with his internet connection cutting out twice while trying to access Facebook and Google. The problem was so bad that he ended up resorting to using Baidu to find a screenshot of a Google homepage.

The incident was so embarrassing that Fang ended up ducking out of a planned Q and A session that was supposed to take place after the speech, though not before exhorting his listeners to do he said and not as he did.

— Stanley Yu in Shanghaiist

But wherever information gathers and flows, two predators follow closely behind it: censorship and surveillance. The case of digital money is no exception. Where money becomes a series of signals, it can be censored; where money becomes information, it will inform on you.

— Sarah Jeong in The Atlantic

The ride-sharing company [Uber] said that between July and December 2015, it had provided information on more than 12 million riders and drivers to various U.S. regulators and on 469 users to state and federal law agencies.

The privately held company, valued at more than $60 billion, said the agencies requested information on trips, trip requests, pickup and dropoff areas, fares, vehicles, and drivers.

— Narottam Medhora for Reuters

to post comments

Security quotes of the week

Posted Apr 15, 2016 0:36 UTC (Fri) by dlang (guest, #313) [Link] (3 responses)

with such a high volume of requests being processed by a company, how can anyone be sure that the requests are actually legitimate? I'm very sure that copies of requests have made it into the hands of the bad guys, how hard is it for them to forge such requests themselves?

Security quotes of the week

Posted Apr 15, 2016 9:47 UTC (Fri) by robbe (guest, #16131) [Link] (1 responses)

(I’m assuming you’re commenting the third quote about Uber.)

In typical bad reporting-style Huffington does not link to the actual source, even though its online at https://transparencyreport.uber.com/

I don’t think a rate of 2-3 requests per day is all that high. But I’m with you that there is no big incentive for Uber to inspect requests very closely, and that bad apples may get through. Their official position (from the linked report) is:

> Our dedicated team of experts, who are trained to manage these
> requests, ensures that any disclosure of information is
> consistent with our internal policies and applicable law.

Assuming their team consist of more then one person, checking a few requests per day for legitimacy is not too hard. Whether they are really diligent – who knows?

Security quotes of the week

Posted Apr 15, 2016 22:52 UTC (Fri) by dlang (guest, #313) [Link]

I didn't follow through to the main article in this case, but Microsoft's lawsuit against the government where they say that they've received millions of requests made me start thinking along these lines and prompted me to comment on the issue.

When you have hundreds of thousands of law enforcement agencies around the US, and thousands of different FBI offices, it becomes impossible for someone receiving a demand for information that is combined with a demand that they can't talk to ANYONE about the fact that they received the demand (I expect that legally the demand is issued to the company, so people within the company can talk about it, but the way these things can be worded....) makes this a perfect situation for bad guys to start sneaking in and demanding information.

Security quotes of the week

Posted Apr 15, 2016 20:15 UTC (Fri) by esemwy (guest, #83963) [Link]

I'm not sure there's any pretense of legitimacy any more in federal regulation and surveilance. There's absolutely no way providing the 12 million subscribers could be so.

Security quotes of the week

Posted Apr 16, 2016 22:10 UTC (Sat) by gerdesj (subscriber, #5446) [Link] (1 responses)

"This problem was also demonstrated by Fang [Binxing, architect of the China's infamous Great Firewall], with his internet connection cutting out twice"

"As ye sow, so ye shall reap" seems somehow appropriate.

Security quotes of the week

Posted Apr 18, 2016 10:28 UTC (Mon) by biergaizi (guest, #92498) [Link]

The ridiculous point is, parts of his speech was about the necessarily of Internet censorship for "security", and he used regulations in Korea as an example, however when he tried to demonstrate a Korean webpage...

BTW, Chinese government's definition of "Internet Security" includes "ideological security", and Fang contributed to much of this idea.