Re: [perpass] perens-perpass-appropriate-response-01

[Jacob Appelbaum <[e-mail]>]

Bruce Perens:
> On 12/04/2013 03:47 PM, Jacob Appelbaum wrote:
>> So basically, you were just blowing smoke?
> No. The organization is charged to protect us. 

Us? Are you including the Dutch, German, Brazilian, Canadian, British
and Swedes on the list? Or just 'us' Americans?

It sounds to me like you're blowing smoke - specifically because they
aren't actually protecting us in the ways that they assert. Global
domination through criminal activity that results in hegemony? Sounds
solidly protectionist but not in a way where we've consented!

> However poorly or well it's 
> actually working, and I assume that I do not have the whole story either way. 
> They need reform, sure. Not elimination.

Ah, I see, you think we need spies outside the rule of law - that pretty
much sums up the problem. We either have the rule of law or we have this
- that is how we found ourselves here. The fact that you're not entitled
to know the whole story should tip you off that you might not want to
give them the benefit of the doubt regarding reform.

What is technically possible is effectively shown to be inevitable when
the economics line up for the NSA and friends.  Eliminate the NSA,
they're (mass) criminals; the DNI lies to Congress. The NSA gives full
feeds of their spying data to other nations. The examples are as
boundless as BOUNDLESSINFORMANT and beyond.

To boot they're hurting average Americans who write software. The taint
of the NSA is like the Chinese state security all over Huawei gear. I
think it is sadly deserved for many companies and their products.

> 
> Throwing deliberate hurdles in their way is like spreading nails in the path of 
> a police car. Cops have more than enough abuses, but most people accept that 
> they do good stuff too, and nobody sensible suggests getting rid of them.

I see that in your spare time, you're also a straw man factory; could
you knock it off Bruce? It is surprisingly annoying and a total derailment.

But while we're making funny jokes, I'll see you and raise you a muppet
video:

  https://www.youtube.com/watch?v=CjMLZuuXDRQ

Perhaps the discourse might be improved by not muddling intelligence
services and police? ;-)

>> Good luck with a Man-On-The-Side attack on .se. domains that are properly configured.
> OK. But I'm horrified that .se is the best demo you can cite.

DNSSEC has issues - a lack of query privacy for example - but what do
you want? A full list of every DNSSEC enabled domain where someone has
to steal keys to begin to perform such an attack?

Here is some code by the way to implement QI:

 http://github.com/stealth/QI

>> What political solution do you envision exactly?
> Given the choice, I would roll increases in executive authority related to the 
> pursuit of war or espionage back to what we had before the PATRIOT act. This is 
> something we can state in one sentence and that makes sense. IMO it is a 
> workable campaign and one you should join.

How do you propose that this will ensure we won't return here? And how
will your political successes impact your safety when it is another
government taking these actions?

>>   I'm really curious to
>> hear how you're going to defend your computer or from attackers with
>> nation state capabilities (or less) with a political solution.
> How else can I defend my computer? I do not decieve myself that they are stopped 
> by any technical measure that you or I are capable of. They can break down the 
> door and water-board me if they want to. I am completely helpless before them 
> except for what I can achieve politically.

Ah, I see. You're seriously wrong and pretty much provably so!

The documents released by Snowden clearly state it - as an example in
the Guardian Tor story, they specifically said that they can't
deanonymize everyone all the time - it forces them to target and to
target for memory corruption related exploitation specifically:


http://www.theguardian.com/world/2013/oct/04/nsa-gchq-attack-tor-network-encryption

http://www.theguardian.com/world/2013/oct/04/tor-attacks-nsa-users-online-anonymity

http://www.theguardian.com/world/interactive/2013/oct/04/tor-stinks-nsa-presentation-document

http://www.theguardian.com/world/interactive/2013/oct/04/tor-high-secure-internet-anonymity

Technical counter measures causes NSA dragnet surveillance to fail and
it reduces them to specific targeting of individuals. If you are
targeted, as I am no doubt targeted, you're right - you're probably not
up for the task. Seriously though - I would encourage you not to mistake
your inability with a general inability. I have computers where the NSA
would be foolish to touch them because the moment that they do, I'll
drop their technique, their payloads and everything related on the front
page of a major news paper. A political and a technical solution all in
one, as it should be, I might add.

Properly implemented cryptography works wonders and it will help reduce
a lot of suffering if we deploy it widely. I'm not sure why you refuse
to acknowledge this fact.

All the best,
Jacob