Submit a link Features Reviews Podcasts Video Forums More ▾

Vi Hart: cramming G+ into YouTube has made comments even worse, I'm leaving

Google has changed the commenting system on YouTube so that you need to be a Google Plus user to post; the new system uses algorithms to promote some comments above others, and has the perverse effect of making trolls more visible. Vi Hart, the incomparable math-vlogger (and a regular favorite around here) describes how Google's decision to double down on its flagging Facebook-alike G+ service by ramming YouTube users into it has made her lose faith in the service: now her regular, good commenters comments hover at the bottom of the pile, while hateful trolls whose messages generate a lot of replies are judged "good" by G+ and promoted to the top.

The promise of G+ in the beginning was that making people use their real names would incentivize them to behave themselves. It's abundantly clear now that there are more than enough people who are willing to be jerks under their real names. In the meantime, people who have good reason not to post under their own names -- vulnerable people, whistleblowers, others -- are now fully on display to those sociopaths who are only too happy to press the attack with or without anonymity.

Read the rest

Anti-Tor malware reported back to the NSA


More information on the malicious software that infected Tor Browser through Freedom Hosting's servers, which were then seized by law-enforcement: it turns out that infected browsers called home to the NSA. Or, at least, to an IP block permanently assigned to the NSA.

Read the rest

Anonymous Web-host shut down, owner arrested; Tor users compromised by Javascript exploit

FreedomWeb, an Irish company known for providing hosting for Tor "hidden services" -- services reached over the Tor anonymized/encrypted network -- has shut down after its owner, Eric Eoin Marques, was arrested over allegations that he had facilitated the spread of child pornography. Users of Tor hidden services report that their copies of "Tor Browser" (a modified, locked-down version of Firefox that uses Tor by default) were infected with malicious Javascript that de-anonymized them, and speculate that this may have originated with with FBI. Tor Browser formerly came with Javascript disabled by default, but it was switched back on again recently to make the browser more generally useful. Some are predicting an imminent Bitcoin crash precipitated by the shutdown.

Read the rest

Anonymizing is really hard really, so why is the EU acting like it's easy?

My latest Guardian column is "Data protection in the EU: the certainty of uncertainty," a look at the absurdity of having privacy rules that describes some data-sets as "anonymous" and others as "pseudonymous," while computer scientists in the real world are happily re-identifying "anonymous" data-sets with techniques that grow more sophisticated every day. The EU is being lobbied as never before on its new data protection rules, mostly by US IT giants, and the new rules have huge loopholes for "anonymous" and "pseudonymous" data that are violently disconnected from the best modern computer science theories. Either the people proposing these categories don't really care about privacy, or they don't know enough about it to be making up the rules -- either way, it's a bad scene.

Since the mid-noughties, de-anonymising has become a kind of full-contact sport for computer scientists, who keep blowing anonymisation schemes out of the water with clever re-identifying tricks. A recent paper in Nature Scientific Reports showed how the "anonymised" data from a European phone company (likely one in Belgium) could be re-identified with 95% accuracy, given only four points of data about each person (with only two data-points, more than half the users in the set could be re-identified).

Some will say this doesn't matter. They'll say that privacy is dead, or irrelevant, or unimportant. If you agree, remember this: the reason anonymisation and pseudonymisation are being contemplated in the General Data Protection Regulation is because its authors say that privacy is important, and worth preserving. They are talking about anonymising data-sets because they believe that anonymisation will protect privacy – and that means that they're saying, implicitly, privacy is worth preserving. If that's policy's goal, then the policy should pursue it in ways that conform to reality as we understand it.

Indeed, the whole premise of "Big Data" is at odds with the idea that data can be anonymised. After all, Big Data promises that with very large data-sets, subtle relationships can be teased out. In the world of re-identifying, they talk about "sparse data" approaches to de-anonymisation. Though most of your personal traits are shared with many others, there are some things about you that are less commonly represented in the set – maybe the confluence of your reading habits and your address; maybe your city of birth in combination with your choice of cars.

Data protection in the EU: the certainty of uncertainty

My books on a Tor hidden service

Part of the plot in Homeland revolves around "hidden services" on the Tor network. Now, a fan of mine in Norway called Tor Inge Røttum has set up a hidden service and stashed copies of all my books there. He writes:

A hidden service in Tor is a server, it can be any server, a web server, chat server, etc. A hidden service can only be accessed through Tor. When accessing a hidden service you don't need an exit node, which means that they are more secure than accessing the "clearnet" or the normal Internet (if you want). Because then the exit nodes can't snoop up what you are browsing. Hidden services are hard to locate as most of them aren't even connected to the clearnet.

I don't have any servers or computers that I can run 24/7 to host a hidden service, but fortunately there is a free webhost that is hosting websites on Tor: http://torhostg5s7pa2sn.onion.to

After creating the domain I wrote a dirty bash script to download most of Cory's books and create a HTML file linking to them. It's available on pastebin: http://pastebin.com/3YR6j8zJ

How cool is that?

Using Silk Road: game theory, economics, dope and anonymity


Gwern's "Using Silk Road" is a riveting, fantastically detailed account of the theory and practice of Silk Road, a Tor-anonymized drugs-and-other-stuff marketplace where transactions are generally conducted with BitCoins. Gwern explains in clear language how the service solves many of the collective action problems inherent to running illicit marketplaces without exposing the buyers and sellers to legal repercussions and simultaneously minimizing ripoffs from either side. It's a tale of remix-servers, escrows, economics, and rational risk calculus -- and dope.

But as any kidnapper knows, you can communicate your demands easily enough, but how do you drop off the victim and grab the suitcase of cash without being nabbed? This has been a severe security problem forever. And bitcoins go a long way towards resolving it. So the additional security from use of Bitcoin is nontrivial. As it happened, I already had some bitcoins. (Typically, one buys bitcoins on an exchange like Mt.Gox; the era of easy profitable "mining" passed long ago.) Tor was a little more tricky, but on my Debian system, it required simply following the official install guide: apt-get install the Tor and Polipo programs, stick in the proper config file, and then install the Torbutton. Alternately, one could use the Tor browser bundle which packages up the Tor daemon, proxy, and a web browser all configured to work together; I’ve never used it but I have heard it is convenient. (I also usually set my Tor installation to be a Tor server as well - this gives me both more anonymity, speeds up my connections since the first hop/connection is unnecessary, and helps the Tor network & community by donating bandwidth.)

Using Silk Road (via O'Reilly Radar)

EFF Pioneer Award winners announced

Rebecca from EFF sez, "EFF is proud to announce the winners of this year's Pioneer Awards: hardware hacker Andrew (bunnie) Huang, anti-ACTA activist Jérémie Zimmermann, and the Tor Project -- the organization behind the groundbreaking anonymity tool Tor. These winners have all done truly important work to protect our digital rights. Join us at the award ceremony on September 20 in San Francisco. Cory

The Dictator's Practical Guide to Internet Power Retention, Global Edition

The Dictator's Practical Guide to Internet Power Retention, Global Edition is a wry little 45-page booklet that is, superfically, a book of practical advice for totalitarian, autocratic and theocratic dictators who are looking for advice on how to shape their countries' Internet policy to ensure that the network doesn't loosen their grip on power.

Really, though, this is Laurier Rochon's very good critique of the state of Internet liberation technologies -- a critical analysis of what works, what needs work, and what doesn't work in the world of networked technologies that hope to serve as a force for democratization and self-determination.

It's also a literal playbook for using technology, policy, economics and propaganda to diffuse political dissent, neutralize opposition movements, and distract and de-politicize national populations. Rochon's device is an admirably compact and efficient means of setting out the similarities (and dissimilarities) in the Internet control programs used by Singapore, Iran, China, Azerbaijan, and other non-democratic states -- and the programs set in place by America and other "democratic" states in the name of fighting Wikileaks and piracy. Building on the work of such fierce and smart critics as Rebecca McKinnon (see my review of her book Consent of the Networked), The Dictator's Guide is a short, sharp look at the present and future of networked liberation.

Firstly, the country you rule must be somewhat "stable" politically. Understandably "stable" can be defined differently in different contexts. It is essential that the last few years (at least) have not seen too many demonstrations, protests questioning your legitimacy, unrest, political dissidence, etc. If it is the case, trying to exploit the internet to your advantage can quickly backfire, especially if you can't fully trust your fellow party officials (this is linked to condition #3). Many examples of relatively stable single-leader states exist if in need of inspiration, Fidel Castro's Cuba for example. Castro successfully reigned over the country for decades, effectively protecting his people from counter-revolutionary individuals. He appointed his brother as the commander in chief of Cuba's army and managed his regime using elaborate surveillance and strict dissuasive mechanisms against enemies of the state.[49] As is always the case, political incidents will occur and test your regime's resilience (the Bay of Pigs invasion or the missile crisis, for example), but even massive states have managed to uphold a single-party model and have adapted beautifully to the digital age - in China's case, despite close to 87 000 protests in 2005.[2] Follow these states' example and seek stability, no matter what your regime type is. Without it, you are jeopardizing the two next prerequisites and annihilating your chances to rule with the internet at your side. If you are in the midst of an important political transformation, busy chasing counter-revolutionary dissidents or sending your military to the streets in order to educate protesters, you will need to tame these fires first and come back to this guide afterwards.

The Dictator's Practical Guide to Internet Power Retention, Global Edition

Google execs: our technology can be used to fight narcoviolence in Mexico

In a Washington Post op-ed, Google's executive chairman (and former CEO) Eric Schmidt and Google Ideas director Jared Cohen argue the case for technology as a tool to aid citizen activists in places like Juarez, Mexico. Schmidt and Cohen recently visited the drug-war-wracked border town, and describe the climate of violence there as "surreal."

In Juarez, we saw fearful human beings — sources — who need to get their information into the right hands. With our packet-switching mind-set, we realized that there may be a technological workaround to the fear: Sources don’t need to physically turn to corrupt authorities, distant journalists or diffuse nonprofits, and rely on their hope that the possible benefit is worth the risk of exposing themselves.

Technology can help intermediate this exchange, like servers passing packets on the Internet. Sources don’t need to pierce their anonymity. They don’t need to trust a single person or institution. Why can’t they simply throw encrypted packets into the network and let the tools move information to the right destinations?

In a sense, we are talking about dual crowdsourcing: Citizens crowdsource incident awareness up, and responders crowdsource justice down, nearly in real time. The trick is that anonymity is provided to everyone, although such a system would know a unique ID for every user to maintain records and provide rewards. This bare-bones model could take many forms: official and nonprofit first responders, investigative journalists, whistleblowers, neighborhood watches.

I'll be interested to hear what people in Juarez, and throughout Mexico, think of the editorial. The notion that crypto, Tor, or other anonymity-aiding online tools might help peaceful observers is not a new one, and not one that activists in Mexico need outsiders to teach them about. There are plenty of smart geeks in Mexico who are well aware of the need for, and usefulness of, such tools. But Google execs speaking directly to the conflict, and how widely-available free tools might help, is a new and notable thing. Red the rest here. (thanks, @martinxhodgson)

Tor anonymity developers tell all

Runa from the Tor anonymity project sez, "Karen and I will be answering questions on Reddit today. Feel free to ask us anything you'd like relating to Tor and the Tor Project!" Cory

A fatal lack of accountability

As long as secrecy and anonymity reign, public sector bureaucracies will be the hiding places for the incompetent, lazy and corrupt. Failures will be rewarded and successes stifled. It’s easier to lie when no one knows your name. It’s easier to do all sorts of unethical, if not criminal, things when you are promised anonymity.

Read the rest

Anodyne Anonymity

When we think of journalists’ anonymous sources, we think of the proverbial whistleblower. Company insiders, or civil servants, ready to violate their nondisclosure agreements to expose some wrongdoing, or perhaps to settle some score. On the other, sleazier, end of the scale, we might think of tipsters: a cash-strapped waiter at a restaurant who sells the story of a celebrity food-fight to a tabloid, a blabby nurse at a plastic surgery clinic who spills the beans on some captain of industry’s chin-augmentation.

But the most commonly cited anonymous sources in the news today are the official, on-the-record spokespeople for corporations. And the anonymous speech that is protected by the journalists who quote them is the most bland, anodyne stuff you can imagine.

Read the rest

Screenwipe on anonymous sourcing

In this segment from Charlie Brooker's Newswipe, Heather Brooke highlights the problems of anonymous sources in the UK media, where police spokespersons frequently mislead the public about suspects and investigations. [Video Link]

Read the rest

Fox News whistleblower begins anonymous tell-all series

Gawker has launched a new column written by an anonymous Fox News employee who posts under "The Fox Mole." S/he claims to have been with Fox for "years," and claims that s/he can't find work elsewhere because other news organizations view Fox alumni with suspicion. The Mole's first column describes a particularly nasty piece of work by Fox -- the notorious "Obama's Hip Hop BBQ Didn't Create Jobs" story -- as the breaking point that got her/him interested in exposing wrongdoing at the organization.

The post neatly summed up everything that had been troubling me about my employer: Non sequitur, ad hominem attacks on the president; gleeful race baiting; a willful disregard for facts; and so on. It came close on the heels of the Common controversy, which exhibited a lot of the same ugly traits. (See also: terrorist fist jabs; Fox & Friends madrassa accusations; etc.)

The worst thing about the Hip Hop BBQ incident is that we didn't back away from it. Bill Shine, who is a rather important guy—sort of Roger Ailes' main hatchet man, and the go-between for Ailes and most of the top talent—bafflingly doubled down and defended it. The story still exists on the Fox Nation site, headline and photo montage intact, to this very day.

That was it for me. It wasn't that the one incident was so bad, in and of itself. But it was so galvanizing, and on top of so many other little incidents, that I guess it just finally pushed me over the edge.

Announcing Our Newest Hire: A Current Fox News Channel Employee (Thanks, Fipi Lele!)

Scalable stylometry: can we de-anonymize the Internet by analyzing writing style?

One of the most interesting technical presentations I attended in 2012 was the talk on "adversarial stylometry" given by a Drexel College research team at the 28C3 conference in Berlin. "Stylometry" is the practice of trying to ascribe authorship to an anonymous text by analyzing its writing style; "adversarial stylometry" is the practice of resisting stylometric de-anonymization by using software to remove distinctive characteristics and voice from a text.

Stanford's Arvind Narayanan describes a paper he co-authored on stylometry that has been accepted for the IEEE Symposium on Security and Privacy 2012. In On the Feasibility of Internet-Scale Author Identification (PDF) Narayanan and co-authors show that they can use stylometry to improve the reliability of de-anonymizing blog posts drawn from a large and diverse data-set, using a method that scales well. However, the experimental set was not "adversarial" -- that is, the authors took no countermeasures to disguise their authorship. It would be interesting to see how the approach described in the paper performs against texts that are deliberately anonymized, with and without computer assistance. The summary cites another paper by someone who found that even unaided efforts to disguise one's style makes stylometric analysis much less effective.

We made several innovations that allowed us to achieve the accuracy levels that we did. First, contrary to some previous authors who hypothesized that only relatively straightforward “lazy” classifiers work for this type of problem, we were able to avoid various pitfalls and use more high-powered machinery. Second, we developed new techniques for confidence estimation, including a measure very similar to “eccentricity” used in the Netflix paper. Third, we developed techniques to improve the performance (speed) of our classifiers, detailed in the paper. This is a research contribution by itself, but it also enabled us to rapidly iterate the development of our algorithms and optimize them.

In an earlier article, I noted that we don’t yet have as rigorous an understanding of deanonymization algorithms as we would like. I see this paper as a significant step in that direction. In my series on fingerprinting, I pointed out that in numerous domains, researchers have considered classification/deanonymization problems with tens of classes, with implications for forensics and security-enhancing applications, but that to explore the privacy-infringing/surveillance applications the methods need to be tweaked to be able to deal with a much larger number of classes. Our work shows how to do that, and we believe that insights from our paper will be generally applicable to numerous problems in the privacy space.

Is Writing Style Sufficient to Deanonymize Material Posted Online? (via Hack the Planet)