Now there's nothing stopping the PATRIOT Act allowing the FBI to slurp web-browsing histories without a warrant An amendment that would require the FBI get a warrant before they access Americans’ web-browsing history failed to pass by a single vote in the US Senate on Wednesday. The bi-partisan push to install the privacy protection mechanism was led by Senators Ron Wyden (D-OR) and Steve Daines (R-MT), and came following the news a …
This just goes to show that our government (U.S.A.) is more dysfunctional that that of the U.K. This is a toe know to the FBI, and with the NSA's help, to expand warrantless surveillance of the American people. These people should be ashamed of themselves for violating our civil rights. It's bad enough that the corporations do it.
Doesn't do much good with the mandatory ME and PSP snooping in on you on nearly all PCs and laptops (save a few exotic ones like RISC-V or Power), and the cell modem for every mobile. A false sense of security is worse than no security, at least the feeling of (digital) nakedness with no security tends to invoke a second thought before criticizing the government etc. (chilling effects).
...and if you're dumb enough to think a VPN does anything useful when using Windows 10, you should just accept your new overlords and not even try!
At least the machine that I have doesn't have a back door in the CPU. Still though, nobody really knows what is really in the CPUs of these newer machines except the CPU manufacturers themselves. Even then, the different groups of computer engineers don't really talk to each other. These capabilities have been marketed as a system management ability. So the intent is that if you have commodity hardware in a data center, you can remote manage the machine even if it's powered off. I have a Sun Server here which has that capability. I can turn the machine on and off by connecting to the ALOM and giving it commands.
I am usually dubious about anything on Medium, but you might want to do a web search for
NordVPN Disney
Among the folks singing the praises of being able to avoid the geoblocks is a disturbing Medium article about how they might be able to do this by using your computer as an exit node (if you live in a non-blocked area), without your consent or knowledge.
Again, I do _NOT_ endorse this position. I have no idea of its veracity. It does raise some questions. And it just might be more serious to have someone browsing kiddie porn or Jihadist beheading videos than Little Mermaid.
It doesn't matter what _I_ find horrific. In the U.S. today, if some plod thinks you _might_ have viewed either (based on "your" VPN provider using your computer as an exit node for someone else), you are in for a world of hurt. I chose those examples because they frequently come up in court cases.
In some cases, viewing Disney I.P. is sufficient to at least make your life suck for a while, and that is the purported _point_ (per the article, I have no direct knowledge) of this process.
Again:
1) I have no idea if the accusations in the article are true, although in this day and age they are plausible.
2) The offensiveness of any content is determined by the legal system, as the owner of the computer involved almost certainly was unaware it was ever viewed, let alone view it themselves.
But there are fake VPNs, government corrupted VPNs, and liar VPNs amidst the crowd.
PureVPN is an example of a liar VPN. They said thet didn't keep logs of user data. Except they do and they turned that data over to the FBI upon request.
Any VPN within the Five Eyes nations is obliged to turn over user data, if they keep any, upon request. Five Eyes consists of the USA, UK, Australia, Canada and New Zealand. Recently Five Eyes has been expanding. The last I heard, there are 14 Eyes nations. Be wary.
There are nations that have no data sharing treaties with other nations. Research the current situation and use VPNs from nations not cooperating with world surveillance of the Internet.
Then there's China. Any and every VPN in China must legally fork over all user data, which by law must be kept, upon government request. As such, don't use Chinese VPNs, including those in Hong Kong and Taiwan, sad to say.
Could happen. I can foresee a world, pretty soon now, where countries are divided in two groups: those that try to control and contain Covid-19, and those that rely on "herd immunity" and don't even try to trace cases. There will need to be very tight controls on traffic between the two groups.
I think most of Europe will eventually scrape into group 1, and the US will clearly dominate group 2.
That would actually fulfil Trump's dream of "a wall" with the foreigners paying for it. #MAGA!
When a Senator abstains to vote, I think it may have to do with his/her stand on the issue. By supporting or opposing a law that is essentially illegal but modified with conditions won't stop the making of everything wrong into a legal justification.
So something like disaster relief or emergency funding with tacked on riders siphoning funds means you may not get the ability to fight this kind of corruption. Better not to participate and get your own type of bill pushed into place rather than get dragged into the mud.
Tulsi gabbard failed her duty and job as a Senator when she voted 'present' because the job is to vote up or down and not "I don't know" while Bernie or anyone abstaining to vote an essentially unconstitutional law do not fail to do their job by not supporting 'conditions' for it.
Impeachment Yes/No was a job requirement and in the constitution. Passing surveillance laws is not.
Well, maybe the congresscritters voted against the amendment because they just wanted to repeal the "PATRIOT" Act altogether? Right folks? Please?
Don't you just love how our Federal and State governments like to use their "NewSpeak" names for laws that do the complete opposite of what the name says? You know, "PATRIOT Act", "SAFE Act", etc.
"The First Amendment guarantees freedoms concerning religion, expression, assembly, and the right to petition. It forbids Congress from both promoting one religion over others and also restricting an individual’s religious practices. It guarantees freedom of expression by prohibiting Congress from restricting the press or the rights of individuals to speak freely. It also guarantees the right of citizens to assemble peaceably and to petition their government. "
It is unfortunate that those who wrote these laws had no idea that they would last for such a short time...
You can obviously speak freely, you just can't do it on your own terms.
yelling fire in a crowded theater
You are mistaken. Not only have you omitted the word "falsely" from the test, it was later overturned. See https://en.wikipedia.org/wiki/Shouting_fire_in_a_crowded_theater
In particular:
...partially overturned by Brandenburg v. Ohio in 1969, which limited the scope of banned speech to that which would be directed to and likely to incite imminent lawless action (e.g. a riot). [my emphasis]
No, it won't. FBI & C. will simply ask the DoH provider to deliver the data. Nor VPNs will help when the browser or OS itself slurp the data and send them to Microsoft, Google & C.
Encryption is useless when you can't trust the other endpoint.
Also, interesting to see a Democratic senator from Washington State NOT voting against that.
Sigh. I knew if we didn't mention HTTPS and DNS-over-HTTPS, we'll get moaned at, and if we do include HTTPS and DoH, we'll get moaned at.
Sure, if you use Cloudflare or Google for DoH, the Feds can request it. That's obvious. But then someone will say they're using DoH through their custom VPS in Laos over Tor, so nerr-nerr. That's why the article said tunneling and DoH would work "to some degree."
There was a whole part at the end discussing the situation but it started to feel like an article within an article so I cut it. I've added a summary for those who need to know what "to some degree" means.
C.
The problem is the defense can't be technical, can be only legal. There's no way to protect your privacy and freedom as long as the law itself does not protect it. Maybe a wholly decentralized system would make much harder to gather those data when heavily encrypted, but the direction instead is towards a heavy centralization - few services handling most of the user data, most systems in a (relatively) few datacenters controlled by a few companies, most US based - so CLOUD Act subjects - and the competitors being Chinese.
HTTPS does not encrypt the SNI at this time, so a network snoop will still know where you are going.
Stop pushing DNS over HTTPS (a privacy nightmare as others have pointed out) and realize it is actually the worst designed of the options. Literally, DoH results in lower privacy than no encryption at all, because a third party that would never have seen who you are visiting now gets that information in a nice pat log. As I keep reminding people, your ISP knows where you go just from the network traffic -- if they care so much. With that and SNI, they don't need your DNS except for pushing ads.
@LDS
Quote: "Encryption is useless when you can't trust the other endpoint."
*
Really? Then why are two (of three) Beale papers still secret after more than a hundred years?
*
And then there's private ciphers....I know, I know....weak, not to be trusted. So...publish the plain text of the attached, if it's all that easy (and "useless" too)!
*
1K6S0JAr16fV0AcM0zg50xx71fXW1MYO0s6g0VlK
1OMP1BrH0BF21QrJ1RBh0KEl0bdk0cgn0ckj0c=e
1Mtx0F4F1e5U076W0Lkq0dXj1Hgs00zp0Ccx0URz
1DdU0lRh103Q1Xgp03LB0EZC1kdu0Yzh1XgQ1bhB
0MFw1Mr01A0207Si0zKX1QXc1Zdd0X5X0xRZ015X
0QD50fFC1hak0C6G1kkx0b0P02Dh0hER1lNT0H0K
1GSE0kK=0GEv0BTk1XoZ1GhI1Hwv1mNw1bqt0ZF7
0VDX0JHL1QOz1Ab816Ba
*
I don’t think you’ve understood what is meant by “trusting the other endpoint”. Yes, it is hard to impossible to decrypt the message without knowing the cypher key. Once it is decrypted however it becomes vulnerable to theft, and if the recipient has a leaky system then you’ve lost all protection.
@Steve_Todd
1. Problem with "endpoint". Do the spooks know who is reading the cipher text in El Reg? Do the spooks know who sent the cipher message? So....about those "endpoints"?
2. Given item #1, perhaps "useless" needs a bit more explanation for someone who hasn't "understood".
*
Or perhaps you are trying (elliptically) to imply that the spooks have access to every "endpoint" in the universe. I think we should be told!
For tracking web histories, end points are known. It's the DNS queries, HTTP traffic, web browsers and the OS themselves. Encryption means Eve can't know the message as long as Alice and Bob themselves don't tell her, and Eve has no way to force them. It's clear that if Eve can seduce, bribe, jail or torture Bob, the best encryption and strongest key is useless.
If Cloudflare has your DoH queries - it needs the plaintext to resolve the address - and the the FBI has the power to ask those data, DoH is useless to protect you from this specific threat.
Your provider will still see what IP you access even if the traffic payload is protected by HTTPS and the DNS query by DoH (it can't tamper with the DNS query, though).
A VPN would solve it (as long as the FBI can't ask them too), but if your Chrome browser sends your whole browsing history to Google for profiling, any VPN encryption is useless. When Windows 10 does the same, any VPN is again useless. What about Android? What about all the beacons in a web page, i.e. from Facebook? Can you trust your endpoint, and the remote one?
Maybe the spooks don't have access to any endpoint, but Google & C. often does. The spook just need to ask them. You need to be really paranoid and competent to browse without being tracked.
Paranoid? It's not paranoia if they really are out to get you, as the saying goes. Competent, well, as I mention way down the thread, anonymous Linux tools -- TAILS, TENS, Kodachi, a host of "pentest" systems like Kali and Parrot -- have become much easier to use than they were even five years ago. TOR seems faster now, and the privacy-oriented VPNs seem more reliable too.
But you're right, IMHO, in that Windows 10 is insecure by design. Stock Android too, though I haven't explored the successor to ParanoidAndroid (I am doubtful).
Of course, if a nation-state really, really wants to own you, it will. Full stop. If the nation-state lusting after your a** is the one you live in, you're sunk. If it is a foreign power, they may find it harder to use physical means -- breaking and entering to install discreet hardware, for example.
And yes, Intel and AMD chipsets have intrinsic vulnerabilities which potentially defeat any OS-based security. Probably ARM chipsets too, though I haven't researched that.
So for me, the thing is: If you want to minimize surveillance, you do the best you can. Run an amnesiac OS from a thumb drive, use TOR Dns or DNSCrypt, use TOR itself, use a security-oriented VPN, use browser privacy tools (Privacy Badger, Ghostery, CanvasBlocker, and so forth -- too many to list). As it turns out, it doesn't take as much competence as it would seem, because the tools have gotten so much easier to use. Of course, the opposition -- the A-hole Team -- have upped their game as well, I'm sure.
Your mileage will vary.
Bad for Europe, but of course once the UK becomes a third country there's be nothing to lose anyway (except your browsing history). We may have the "UK GDPR", but Privacy Shield is external to the Regulation and is negotiated between Europe and the USA, so unless some very creative machinations are negotiated the UK will not be party to it.
The protections they are removing are ones only granted to US citizens, there is no limit outside the USA either. It's all backdoored kit and none of it can be trusted outside the US, you have zero protections offered by the Patriot act. The ones they're stripping are not really there either, they can always get a FISA warrant.
Your best bet is to pick the least dangerous surveillance tech and go with that. So I'm very very happy to have a Huawei device without the US spyware on it, and only the Chinese spyware on it. To me that is one less set of spyware.
Betcha the people who Barr watches are mainly FBI staff themselves. He fears the people under him. Too many of them want to follow the law, and he doesn't follow the law, and it leads to a paranoid suspicion of the people under him.
Except the FBI have been audited and have never once actually asked for a FISA warrant. They have just been snooping the NSA database for data on US citizens, whenever they want, without one.
Someone really needs to bring the FBI under some sort of control but good luck getting anyone to do it
The FBI have been known to have their own man-in-the-middle surveillance hubs on the Internet within the USA for at least a decade. They don't have to rely on the NSA's data, seeing as they are known to have their own.
And yes, collection of such data without a warrant is unconstitutional.
Another source of data is every ISP (Internet Service Provider) in the USA. The Congress Republicans shoved through what is called S.J.R. 34 in 2017 that allows all ISPs to collect customer Internet use data to be saved and even SOLD by the ISP. Of course the anti-constitutional surveillance skunks love it.
Surveil me. I'm an actual patriot.
Probably a bit late to address the thumb down but don't trust me...
FBI violating US citizens rights by using the NSA's section 702 collection without a warrant:
https://www.justsecurity.org/69972/odnis-2019-statistical-transparency-report-the-fbi-violates-fisaagain/
https://www.techdirt.com/articles/20200510/20112544471/national-intelligence-report-shows-fbi-never-gets-warrants-backdoor-searches-nsa-collections.shtml
These both link to the original report by the Office of the Director of National Intelligence
This post has been deleted by its author
Let us rouse some suspicion as a test. We'll sent portions of the Voynich Codex amongst us while covertly having an eye out for stranger than normal governmental activities and if these activities start concentrating on long rumored places, we should have a reasonable expectation that we are the usual suspects. Now for us in the USA will get millions by sending portions of the Beale Code and have FBI decode it while we file a Freedom of Information request for our records.
Now for reality: the found information after a period of time seeps into public records and therefore becomes open under Freedom of Information. And to answer another question that which is redacted and the context tells you where to look; think of Philip Nolan and how he filled his map. We must never forget Juvenal either
Qui Custodiet Ipsos Custodos
I'm sick of posting the Fourth and Fifth Amendments. So please look them up yourselves. What they provide is PRIVACY that cannot be taken away from any citizen without a legal court order, and if that doesn't provide the data, then any citizen can refuse to offer up any further data on the grounds that it may incriminate them.
What's going on is the generation of piles of lawsuits over the constitutionality of this infernal nonsense.
"...the more controversial aspects of spying laws introduced after the September 11, 2001 attacks..." <-- And we now clearly know that 9/11 was a federally enabled event on many levels. That the PATRIOT act was created in response to that act of treason is sick and demented.
Known facts of 9/11 so far: Architects and Engineers for 9/11 Truth
Surveil me. I'm an actual patriot.
configs like VPN+TOR+DNSCrypt run from a thumb drive without persistent memory will be made illegal in the USA, I suppose. Though that may be hard to enforce. Meanwhile, in the years I've been fiddling with them, distros like TAILS and Kodachi have gotten much, much easier to set up and use. I'm posting this from Kodachi Linux, which IMHO comes with more preconfigured options than others.
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2025
