tinfoil hats inadequate

For discussions about security.
Post Reply
Message
Author
User avatar
prehistoric
Posts: 1744
Joined: Tue 23 Oct 2007, 17:34

#16 Post by prehistoric »

@8Geee,

Browsers are now the size of operating systems, and duplicate many functions. Flash player alone is larger than a minimal system. Considering the rate at which security patches emerge now I don't think anyone really understands what these programs are doing part of the time. This is the basis for all kinds of nonsense. Using technology which has been deliberately obfuscated is like relying on black magic without a pentagram. You have no idea just what you are invoking, and should not be surprised if it disembowels you, and eats your soul.

The problem with security is the idea that it is O.K. for "us" to exploit users, because we're the good guys, and people wouldn't use our products if they did not give us permission to exploit them.

Aside: the idea that users give any sort of informed consent is meaningless when they are deluged, as I have been this month, with a series of legal documents allegedly explaining the situation, each the size of a novella. Professors at law schools aren't sure what these mean. It hardly matters, since the terms can be changed at will.

These hidden hooks and backdoors then become entry points for others, who are labeled criminals, based on distinctions that would be hard to make on any objective basis tied to behavior without knowing which side was which to begin with. This is a big reason I object to the way W10 collects data, and constantly phones home. It takes a great deal of effort to analyze traffic, and decide that a system is compromised (by someone other than M$). You can no longer just look at the blinking lights on routers to decide a machine is doing something when it shouldn't be.

Companies are only interested in protecting users from exploitation by other companies and interlopers, who have not paid them. Pay them enough and you can learn just about anything. They sign non-disclosure agreements with other companies to share information, secure in the knowledge no one will be able to figure out exactly what information leaked where, and prove it in court. They don't have to pass individual data if they pass system loopholes enabling exploitation. Security companies are prime recipients of such information. They aren't going to do anything to hurt their primary meal ticket at that company, but this doesn't stop them from passing useful tidbits to shadowy others. (Where would you guess this bunch lives?)

"Anonymized" personal data can be passed without violating privacy policies, yet still reveal everything to sophisticated data mining. Here's an example. Or how about a full list of prescriptions?

What becomes clear after reading a few such cases is that the goal of anonymization is not protecting individuals whose data is at risk, it is protecting those collecting and using data from litigation.

Once national governments become involved things get even dicier. It is typically a crime even to acknowledge that a nation state has requested such data. Nations can then trade such information like poker chips in a very high-stakes game. This results in such anomalies as detailed personal data on people with U.S. security clearances ending up in the hands of leaders of the PRC, and even the DPRK.

Within a single government there will be insiders and outsiders. After a while you end up with "double government", where the most important activities are not subject to any oversight. In Russia this has led to the peculiar term "siloviki", which is hard to translate compactly. Those "siloviki" are the insiders who hold real power over essentially every citizen. Everyone knows that public proclamations, laws, trials and elections are simply for show, while the real business of governing takes place behind the scenes.

China has a similar system of its own, with some unique features. Most things are done "via the backdoor", in a social sense. (The word Guanxi is important here.) Chinese language hasn't had time to digest the term for a software backdoor into the common language, but the idea is quite natural for them.

Many European governments have had experience with double government courtesy of Nazis, Facists, Falangists or Communists. The drug of unlimited access to citizen's personal information is so addictive that no government which has used this is likely to give it up.

Post Reply