"Authentication" vs Privacy

[TWP]

The post, linked below, speaks directly to one of my fears.  I've been online for decades and dealt with user security in my chosen work of web design and system administration.  I point this out to say that I'm not without experience in the field.

Please note that most of this forum is visible to only the 21 30 or so people who have migrated from the Meetup site, and it requires registration to view.  This is acceptable security and does NOT violate our privacy.   

Among the many possible things that we prep for, this topic was never terribly high on my list of possible causes for concern.  After reading this post, I have raised this topic to near the top of my list of worries.  It is only exceeded by my concern for the pending economic crisis.  If I have your attention now, please read the post on James Wesley, Rawles Survival Blog:

http://survivalblog.com/the-long-good-bye-by-captnswife/

I would certainly welcome a discussion about this topic, if not here, then at our group meeting.

[Jerry D Young]

It is here and is going to stay here. I am not sure if there is much way around it. My plans have been, for a long time, to deal with the world as it is, maintain my identity for the public record, and continue to be who I am. I have been on the government radar for a very long time. Trying to disappear from that would only trigger something that I prefer not to happen at the moment.

I simply do not think that a person can go fully underground successfully. Cut themselves off from all the technology and requirements that the government, big business, and NGOs have put into place and live without the government being aware of them. So I live with it the way it is.

However, that is not to say that I believe it is impossible to slip under the radar for a time, if necessary. Not that I would, of course. Gotta keep that plausible deniability.

Just my opinion.

[TWP]

Jerry, I appreciate your position and public image.  It is a fine line to have to walk.

  While it isn't really possible to entirely remove oneself from the public "radar" without triggering even greater scrutiny, I would like to hope that there remains some right to personal privacy.  However, the means to remain private seem to be fewer, lately.

  It feels like society has crossed the line into Orwell's "1984"...  Look a Venezuela as an example of how quickly things can fall apart.

  For those who know the phrase; "being a grey man" applies just as much now as after society falls over the cliff.
I apologize to any who feel this is paranoia speaking, but I watch the traffic to avoid being run over by the obvious.

[TWP]

I'm adding to my original thread with this link to a reply on Survival Blog.

http://survivalblog.com/letter-the-internet/

While I must admit to not "liking" the truth of the poster's statement, I non-the-less agree with what is said: the internet is not now, nor has been for some years, private.

Solution:  Don't say anything on the net that you don't want made public.

Corollary: You have no control over what your "friends" may post relating to you...  OPSEC is important.

Case in point: I don't use my real name on the net, ever, but it is still available with some searching.  I don't like that, but I see no way to fix it.

I suppose I could use a couple of empty cans and a Long piece of paracord for more secure communications, but...

[redrocker]

It seems like you (TWP) and Jerry are coming close to the answers that have been developed over the centuries (going back to at least 1650) for maintaining some measure of freedom beneath an oppressive surveillance state.  Specifically, Jerry raises the difference between trying to be clandestine (invisible in all things) and covert (visible in almost all things except the things that really matter).

Large corporations want personal authentication of accounts because they don't want to lose money through fraud.  Losing money through fraud was all okay by large corporations as long as the losses could be passed through to the honest folk (that is why merchant fees on credit card purchases and credit card interest rates are usuriously high).  But with the advent of cryptocurrencies, there is no way to spread the losses from the dishonest to the honest people, and so authentication (that is, stopping fraud before it begins) is essential to business survival.

We all know why the government wants authentication, of course.  Suppression of dissent is essential to large government.  Uppity populations pose an existential threat to those in power, just ask Mussolini and his wife.  (Well, you can't -- they aren't talking a lot lately).

Often overlooked is the grasping, clutching nature of all governments.  Those who run them lose sleep at night trying to find ways to milk more money out of the populace.  A huge gold mine of potential tax dollars lies hidden in the shadow (cash) economy.  If the government cannot eliminate cash altogether, their hope is that they can force all persons doing cash transactions to reveal themselves.  This is the primary motivation for most bureaucrats, in all likelihood.

If you have ever wondered why Google and Obama have held an average of 230 face-to-face meetings each year, the above three paragraphs should explain it.

The battle between the use of technology to enforce tyranny and the use of technology to evade or disrupt those same tyrannies was one of the subjects addressed at length in the book "The Sovereign Individual," written when the Internet was still very young and ecommerce had really not come into being.  It was written by two London economists, James Dale Davidson and Lord Rhys-Mogg.  It is still in print, and I recommend reading it to see to what extent you still agree with their conclusions.

As a member of The Borg myself for 35 years, rumors of the demise of privacy on the Internet are grossly exaggerated.  You can create an avatar for yourself on the Internet that is totally anonymous, as long as your avatar is limited to things like political advocacy.  The instant your avatar makes an online purchase, however, the risk is high that your veil of secrecy will be pierced.  Your avatar will inhabit a clandestine world, and it is very, very hard to maintain cover -- but it can be done.  You only have to make one INFOSEC or OPSEC slip-up, however, to be discovered.  You must be perfect everytime.  The evildoers must be lucky only once.  It really, truly CAN be done, however, using well-publicised techniques.  If you all are still unfamiliar with those, let me know and I will give you some references.

As a former professional evildoer myself, I can only tell you that it was an enormously frustrating job.  Most high-interest targets were untraceable and their communications undecipherable.  People uneducated in mathematics and the sciences speculate endlessly on the ability to break encryption, for example.  Properly constructed and with good OPSEC procedures, encryption is unbreakable within the life of the universe -- and even if a message WERE to be breakable within the life of the universe, add just one character to the key length underlying the cryptography, and it will now take 256 lives-of-the-universe to break the code.  As I always like to say, "The universe loves entropy.  You can rely on it."

[David-Audrey]

While not strictly the same topic...technology and loss of privacy is about to take a little known leap in health care.

Not many are in favor of "Obamacare."  But there is a larger looming issue that only a VERY few are discussing.  A few years ago Doctors and Hospitals were told they HAVE to place all patients’ records on a digital system that the government can access.  Many or most people have been told this is to make access to your records between health care providers and your insurance providers easier.  But here is what you don't hear...here's what I've had three well known doctors share with me.

1.  Security of the data is tenuous at best.  We have Anthem Blue Cross Blue Shield.  They were the first huge health provider that was successful hacked.  Our data, medical history, social security etc. is now out there.  They are paying a year’s coverage from LifeLoc but what happens after a year?

2. The purpose of Obamacare when coupled with the electronic records act.  I've been told by doctors that where this is headed is tele-medicine.  Shortly, they will ask you to get on your computer or cell phone and electronically meet with your doctor.  He will have a split screen.  On one side he will see you.  On the other he will see your records AND once he plugs your symptoms into his computer, the "authorized" treatment according to our Government.  Naturally, emergency and trauma cases will be handled differently, but the doctor’s role will be reduced to something approaching a data entry person.

Privacy and security.  Among the many things that have changed in my lifetime these two words have changed to the point I'm not sure I recognize them.

The problem for me with the "Authentication" discussed in the above links is that even if you’re off the grid, they will control access to whatever they want to control.  There will be no way (cash will eventually be tracked as well) to secure resources.  Fortunately, I don't think things will get this bad in my lifetime, but IT COULD HAPPEN.

[redrocker]

Total control of the medical system was an important tool of the Soviet state.  Political and economic repression were more easily implemented by declaring a person mentally ill than any other means of removing them from society.

I am presently reading Marcellinus, a Roman military commander during the time of the wars against the Allemeni, who wrote a history of the decline of the Roman empire in 390 AD.  Every possible tool, within the available technology, was used for political and economic repression of those not in favor with the Emperor.  The surveillance state embedded so many spies within the households of the affluent that Marcellinus reported no-one would say anything bad about the Emperor's family even to themselves in a closed, empty room.  This was the origin of the phrase, "The walls have ears."

The pattern repeated without flaw every time:  A populist leader rises to power and while in power commits a minor crime.  Being unpunished, these crimes lead to bigger crimes, and there comes a point in time where the leader must become a dictator in order to hang onto power for life, because the minute he leaves office, he will be prosecuted for the crimes committed while in office.  The dictatorship then leads to tyranny.  Tyranny leads to the marginalization of all but the great leader's most-adoring fans, marginalization leads to demonization, demonization leads to persecution, and persecution leads to extermination.  Peaceful outcomes are possible, but rare.

With respect to health care, I was made aware just this past week of the growing network of doctors who are willing to falsify medical records in order to save a patient from being ostracised by government regulators.  There is sure to be a growing passive-aggressive response to the new medical surveillance state.  People with conditions that might cause them to be labeled an enemy of the state will not seek medical help.

[TWP]

I appreciate the comments from all of you.

Going back to my posts, below, my primary concern remains the loss of my privacy attached to the use of the internet.   Going forward, there is a very real danger that everything we say or do online will be used against us.

Paranoia?  Yes.  Justfied? I think time will tell, but the evidence so far gives me reason to be cautious...

I search for any suggestions on what we can do to protect our privacy now. 

1)  Yes, we can use the TOR browser for some degree of anonymity, but that requires some serious study and
a conscious effort to use it correctly.  It is technical and the majority of internet users will fail to use it properly, which means they might as well not use it at all...

2)  Encrypting ALL of email is a good first step, but this only works if both ends of the conversation are using encryption, and they must BOTH use a strong encryption method.
Obviously this will fail the test when used for responses to services like Facebook (I don't use social media services, period).  Sending unencrypted email to anyone means the email can be read at some future time.

What are you doing to protect your online privacy?  Can you tell me without breaking that protection? 

[redrocker]

Here is a reference to the well-written document on security recommendations for activists and news reporters in hostile environments:  http://files.meetup.com/16042992/encryption_works.pdf

It was written by Micah Lee, the Chief Technology Officer of the Freedom Foundation.

Whatever you do, be aware of every step in the security chain, how it might be vulnerable, and how to mitigate the threat.  For example, all communication must be decrypted before you can read it.  If you have taken great precautions to send and receive encrypted email, but your correspondent stores unencrypted versions of email on his or her computer, then you really haven't accomplished anything.  Trust chains usually become vulnerable because of the poor practices of the humans, not the technology.

In reality, I take the attitude that all this security for people like those on this -- or probably almost any other prepper forum -- is for practice, training and mostly for fun.  There is a very, very small liklihood that any of us are doing anything illegal or otherwise so irritating to the government that they would bother spending five cents to track us, interfere with our email, or anything else.  To use the words from a famous spy movie, "We aren't worth the candle."

I only run TAILS from a DVD, never a thumb drive.  Here's why:

Chinese hacker group among first to target networks isolated from Internet
By Jeremy Kirk

IDG News Service | Apr 12, 2015 6:05 PM PT

An otherwise unremarkable hacking group likely aligned with China appears to be one of the first to have targeted so-called air-gapped networks that are not directly connected to the Internet, according to FireEye.

The computer security firm released a 69-page technical report on Sunday on the group, which it calls APT (Advanced Persistent Threat) 30, which targeted organizations in southeast Asia and India.

APT 30 has operated since at least 2005. It has targeted people through spear phishing, or sending emails containing malicious attachments or harmful links.

The group has consistently updated its malware, but the tools it uses are generally not that sophisticated, and it has used some of the same command-and-control infrastructure for years on end.

 “It seems to be they’ve been successful in being good enough,” Weedon said Sunday.

The organizations targeted may have had lax security postures, which made them easy for APT 30 to infiltrate without needing to resort to more advanced or sophisticated attack methods, she said.

The countries primarily targeted were India, South Korea, Malaysia, Vietnam, Thailand, Saudi Arabia and the U.S. Other countries likely to have been targeted are Nepal, Bhutan, the Philippines, Singapore, Indonesia, Brunei, Myanmar, Laos, Cambodia and Japan, FireEye said.

The group has a particular interest in the relationship between China and India, including border issues, FireEye’s report said. APT 30’s focus on those particular subjects make it likely that it is sponsored by China.

What’s most interesting about APT 30 is that it developed tools that are designed to move from systems connected to the Internet to those that aren’t connected. Governments use such “air-gapped” networks to reduce the chance an external attack will be successful.

The group designed malware components with worm-like capabilities that can infect removable drives such as USB sticks and hard drives. Those devices can transfer the malware if connected to a device on an air-gapped network.
FireEye said it has seen many groups develop this capability, but APT 30 appears to have “made this a consideration at the very beginning of their development efforts in 2005, significantly earlier than many other advanced groups we track.”

Over the years, FireEye has written many reports on groups it has linked to China. This group, however, doesn’t appear to be linked to any of the other ones and operated in relative isolation.

APT has its own development resources, and doesn’t share attack infrastructure with other groups, Weedon said.
“This group seems pretty insular,” she added.