How can one exercise freedom of speech when in 21st century nearly all speech is digital, over this or that walled garden?

You had to exercise your freedom to put yourself into the walled garden. By default, everyone's speech starts out free and they do things to put limitations on themselves. Don't do that. Or reverse your earlier decision to stop being free.

Even if you're required to use Facebook for work or something like that, it's not like anybody makes you use Facebook for your own actual speech.

It takes a lot of work and inconvenience to keep yourself from being free. Just don't go to all that extra trouble, and you ought to be fine.

As a point of comparison: it's considered cheating in most first and third person shooting games multiplayer to increase your FoV beyond certain limit.

An attitude which I never understood. Games designed to enforce a 90 degree FOV fail to take into account that on average, our peripheral vision encompasses about 150-160 degrees for most people.

This is so because it gives you vastly superior awareness of your surroundings, making it much harder to surprise you with flanking.

Well, that's sort of the point of peripheral vision, isn't it? There's an easy test that I was taught in junior high that quickly demonstrates this. Hold your arms out in front of you, thumbs up. Move them to the edges of your vision on both sides until you can just see them. Stop, and take a quick look left and right. If you're like most people, you'll find that you're arms are now almost straight out from your sides.

Games which take into account this awareness tend to to do one or both of two things. The first is to allow an FOV up to some arbitrary limit somewhat greater than 90 degrees, say 110 or 120 degrees. Anything after that tends to get so distorted as to be useless on a single monitor anyhow.

The second option is to show some sort of indicators on the side of your monitor and/or allow a quick free look around of just your head. The best implementation of this model belongs to an FPS series that emphasizes realism in its player model to an extent that I've seen nowhere else. I'm speaking of course of the Operation Flashpoint/ArmA I-III series. This game series has been working on this basic model since, what? 1998? The ArmA branch of that series has also provided native support for multiple monitors and TrackIR since the first iteration.

If a FPS this fanatically dedicated to realism (OK, as long as you forget the brain dead AI and concentrate on everything else!) thinks this is OK, then why can't other games at least acknowledge the issue?

This isn't the only way or even the main way that the NSA exploits systems.

Things we know:
1) The NSA collects SSL keys.
2) The NSA can generate fake SSL keys.
3) The NSA has performed MiTM attacks against Google and Microsoft.
4) We know where many of the places are that the splice into the undersea cables.
5) US embassies often have Echelon hardware for tracking satellite communication.
6) The GCHQ stores three days of internet traffic (not metadata but everything).
7) The NSA collects metadata from everything. Email. Phone. Letters. Facebook.
8) The NSA planted spies in large corporations.
9) The NSA have influenced/degraded encryption standards.
10) The US government and Israel created stuxnet.
11) The NSA monitors all credit card transactions outside of the US.

We don't know the specifics though. We don't know:
1) If there is a backdoor in Windows or Linux or libssl.
2) If hardware random number generators have been backdoored.
3) If there are backdoors on the motherboard or in the ethernet firmware.
4) How they are tracking in other ways, via license plate readers or sensing your various personal radio devices.
5) How are spy satellites used for domestic surveillance?
6) Just how much information is shared between the agencies to avoid fourth amendment rules. We know that the NSA and the GCHQ share an office. We know that the NSA gave unfiltered data on non-criminals to Israel.

http://www.schlockmercenary.com/2005-11-06

That same logic could be applied to anything. "You were mugged on the way to work? That's what muggers do. Boring."

This is interesting because it shows:
1) How the internet changes spy craft.
2) How dangerous it is to aggregate data.

It raises interesting questions:
1) Have other countries infiltrated VISA as well?
2) Has VISA been infiltrated by organized crime as well? Would that be profitable?
3) What personal information is there?
4) Has the private data been used for black mail people in interesting ways?

This revalation requires some actions in response:
1) VISA can't just allow their private data to leak.
2) Other countries where this is illegal might consider a response.
3) The IT industry must take more action to prevent this kind of attack.

There are also legal issues:
1) If this hurts VISA, then can the NSA be sued for the loss in business?

The timeline from now looks like:
1) Next six months: More NSA activity will be uncovered. NSA front companies will be exposed. Techniques will be analyzed.
2) Next few years: Changes to the IT industry such as updated encryption. Finding fixes/replacement for SSL since it has failed completely.
3) Next decade: Countries and corporations will have to update their IT budgets and what tech they buy.

This assumes that Snowden does not leak the 400Gb of data in his insurance file. If that happens then much of the web will have to be shut down for a couple weeks. The stock market will collapse. Government officials in many countries will have to step down as we learn more about their private life.

ARM chip designers view hardware as disposable. Why worry about software security updates when you are just going to replace the phone every 18 months?

Cursing about it on LKML is useless though. Linus should start a change.org petition to address this issue.

Remember that the reason they're your ISP, is that you gave power to the government, who made a deal with them to forcefully prevent competitors, grant easements, and other favors that most people don't get, and that no business would never have in a free market.

The terms of that deal are negotiable. Since we now know that some ISPs have caps, "no caps" should be in all future terms.

But in all practicality, how do you seize back control from the likes of the three-letter agencies?

You don't need to take back control, you just have to stop continuously ceding control to them.

Let me phrase this as ridiculously as possible, to make it easier to see how comically awful our decisions are:

The next time someone tells you to not install gpg, to not generate a key, and not cross-sign with people you know, tell them "no, I'm going to do those things."

The next time someone suggests you use webmail instead of a mail client that can encrypt and decrypt messages on a computer that you control, tell them, "no, I'd rather use my common sense instead of doing something obviously stupid."

The next time someone tells you that using a single high-stature central faceless corporation as the sole trusted introducer to authenticate a public key, tell them "that's insane on the face of it, and even 20 years ago, before HTTPS was invented, everybody knew that, which is why PGP was based on the opposite idea."

The joke, of course, is that (almost) nobody is ever there, really telling us to do things that we already know are insecure. We do those insecure things for other reasons, and usually those reasons have jack shit to do with governments pointing guns at our faces, telling us to be insecure. Democrats and Republicans aren't causing our problem here (though our underlying problem may be why we keep electing Democrats and Republicans). We do it because we don't give a fuck. If you start giving a fuck, many options become easier to see.

Bruce Schneier is putting his name on the line with everything he publicly does and says.

Or somebody is putting his name on the line. Did you check the fingerprint? ;-)

There mere fact that you're being investigated already means they're convinced you're hiding something. Even before they find out you're using TrueCrypt, you have already lost and they've already decided to torture/terrorize/imprison/expensively_annoy you.

The tech is irrelevant in cases like this. Imagine the same scenario, where you're not using TrueCrypt, and you simply don't have the data that they want. Same exact outcome.

For instance, rather than one signing authority, you could use three and then use three levels of public key encryption.

This is, in fact, The Best way to make PKI work. But it's not that there are multiple "levels" of PK encryption. It's that there are multiple attestations ("that key belongs to that person") in parallel, chosen by the users (and the details of their choice not strictly known to the attacker, though assuming they use gpg's defaults are a pretty decent bet), and for the output to be wrong, all the certs have to be consistently wrong.

The strength of a good WoT connection is that it requires the attacker to develop a wide conspiracy (and those are hard to keep secret) rather than coercing central authorities (which can be kept secret, though amusingly, we've learned it doesn't even have to be a secret in order to work). It multiplies defection probability estimates, quickly turning it into a pretty small number. (The downside is that the chaining does the opposite, so you've really gotta get out there and build up a lot of links. And yet, at least chaining is better than nothin'.)

Verisign can keep a NSL secret. The dozen people that you know, all of which signed a government's or criminal's replacement key for the guy that you're trying to talk to, can't keep the NSL secret.

Open source is just one more whole that they can insert malicious code into. They can still go up to the head of the open source organization and says "you must include this back-door in your program, or go to jail"

But then they also have to persuade all the users to adopt that fork. "Use crappy software or go to jail," didn't even work for the MPAA, so why does the NSA think they have a chance? ;-)

gpg in javascript is something that you download from an untrustable server, before every time you use it. And then you throw it away when you're done, so if that one copy on that one day was different, you'll probably never know.

gpg in machine code, you get once, possibly before you ever became a specific person of interest to your adversary, or they even knew who was downloading it since your apt-get's curl or wget command probably didn't send a fucking email address saying "I'm so and so, and I want some software that I'm going to tell my passphrase to," and your package manager probably has a checksum for it, so if it was different than "normal" (wheat millions of other e.g. Ubuntu users are using), your chances are much better that you might notice. And if it's the same and everyone's is compromised, maybe someone noticed.

The who situations are incomparable. Ubuntu's copy of gpg probably isn't comrpomised. We know for sure (this isn't speculation) that some web mail servers have served compromised crypto code (though it was java, not javascript, in the hushmail case) for purposes of getting the private key.

Is this all, really not obvious and not common knowledge to everyone? That would be disappointing. Fortunately, I refuse to believe that.

Paypal is scum, yadda yadda yadda. Not arguing that. In this situation, though, they might be doing the world a favor.

What this project is doing, looks like some kind of snakeoil thing. GPG and webmail? How can than possibly not be (putting it meanly) stupid and broken or (putting it nicely) a technological step backwards from 1990s email security tech?

If the server is sending plaintext to the relatively "OpenPGP-stupid" web browser, and assuming plenty of people will be hosting on VPSes not under their physical control, then the private keys are going to be extremely vulnerable. If the server is sending the ciphertext, then it must also be sending "gpg-written-in-javascript" to the browser, so that the browser can work with openpgp data, so that will be the attack point.

There's just no way webmail will be securable, until either:

1) browsers come with built in OpenPGP support, or make shell calls to GPG to do it, or something like that. And if that ever happens, then you might as well just add IMAP support to the browser too, and maybe call the browser "Navigator" instead of "Firefox." There's no reason to use webmail if you have a browser that capable.

or 2) people really self-host; i.e. you're going to trust the server to have your private keys, so it's at home, or better yet, the server is in your pocket (and is probably the same machine you're running the web browser on, once again raising the "why webmail?" question), not in some datacenter.

There are already tons of very capable email clients that have excellent GPG integration, and it sure as hell doesn't anywhere near a hundred thousand dollars to get them. Use one of them instead of some webmail horseshit, and fund whatever improvements you want. Not only will you get something vastly more secure, it'll be cheaper too.

I don't really like being a negative nellie asshole on this one. The mailpile team strikes me as not-stupid people with good intentions. That makes it all the more mystifying that they would try to get webmail to work; they're got to already know that the idea itself is flawed, no matter how good a job they do on it. But then I thought the same thing about Silent Circle, another obviously-dumb idea who anyone could see was vulnerable to server coercion. (and lavabit too, though I didn't even know they existed until they didn't exist.) Silent Circle was particularly disappointing, given who was behind it.

I'm not saying the classical (but secure!!) approach doesn't have difficulties for novice users, but anyone who tries to handwave those problems away by relying on trusting servers, should not be considered to be really working on the problem.