Who Has Your Back? Government Data Requests 2015(eff.org)
eff.org
Who Has Your Back? Government Data Requests 2015
https://www.eff.org/who-has-your-back-government-data-requests-2015
9 comments
The only ones that actually have your back are those that use encryption to make data collecting impossible.
This is about requests for stored data and then the encryption is moot, that mostly affects data in-flight or seized computers if the data is stored. In the latter case you will probably be forced to cough up the decryption keys.
Hence cperciva's "Playing chicken with cat.jpg": http://www.daemonology.net/blog/2012-01-19-playing-chicken-w...
When we're talking about protection against government data requests, only companies that make sure they have access to the absolute minimum client information they possible can do truly have our backs. Everyone else just has good intentions.
When we're talking about protection against government data requests, only companies that make sure they have access to the absolute minimum client information they possible can do truly have our backs. Everyone else just has good intentions.
Colin has it right. If you don't want to ever compromise your clients data make sure you can't read any of it. It's that simple. Anything else simply won't do.
That's why I keep recommending tarsnap to customers.
That's why I keep recommending tarsnap to customers.
Or you could.. you know... recommend an appropriate client-side encryption tool so they can then store the archive/backup data on the storage provider of their choice...
The advantage of having client-side encryption built into tarsnap is that it encrypts only after data deduplication and compression.
Obviously there could be a tarsnap option to stream the data to be uploaded through an encryption program of your choice, but doing it just as you suggest would nerf a few of tarsnap's prime advantages.
Obviously there could be a tarsnap option to stream the data to be uploaded through an encryption program of your choice, but doing it just as you suggest would nerf a few of tarsnap's prime advantages.
I think you've misunderstood me.
Tarsnap is a combination client-side application and remote service.
I am suggesting instead to use/recommend one of the existing client-side tools that work similar to the tarsnap client does, but don't lock the user into a single service provider.
By using a client-side tool that just generates archives (and isn't tied to a single storage service provider), you can store them anywhere - AWS, iCloud, Google Drive, Rsync.net, a rented VPS, a friends computer, an external hard drive, all of the above. You name it.
Tarsnap is a combination client-side application and remote service.
I am suggesting instead to use/recommend one of the existing client-side tools that work similar to the tarsnap client does, but don't lock the user into a single service provider.
By using a client-side tool that just generates archives (and isn't tied to a single storage service provider), you can store them anywhere - AWS, iCloud, Google Drive, Rsync.net, a rented VPS, a friends computer, an external hard drive, all of the above. You name it.
I understood what you said, I just didn't know that there were tools in existence that are as good as or better than tarsnap at the archiving part which allow you to specify the storage location.
Edit: I used 'specify the storage location' very loosely. I.e., I realise it could mean simply piping the archive data to yet another program in the shell.
Edit: I used 'specify the storage location' very loosely. I.e., I realise it could mean simply piping the archive data to yet another program in the shell.
Mostly these tools would expect a local storage location and you'd schedule scp/rsync/whatever to copy to the destination of your choice.
Cool, could you please give me a few examples?
I use EncFS with Dropbox.
It's an almost completely transparent user-space filesystem. Basically you store your files in a given folder, and it automatically stores a parallel encrypted copy in a different folder.
http://www.howtogeek.com/121737/how-to-encrypt-cloud-storage...
It's an almost completely transparent user-space filesystem. Basically you store your files in a given folder, and it automatically stores a parallel encrypted copy in a different folder.
http://www.howtogeek.com/121737/how-to-encrypt-cloud-storage...
Does it do data deduplication? Doesn't sound like it to me from skimming that article.
Edit: sounds like EncFS has some significant security issues: http://sourceforge.net/p/encfs/mailman/message/31849549/. No recent information in that discussion, so I don't know whether it's all been resolved. Here's an HN discussion of the audit: https://news.ycombinator.com/item?id=7384730
Edit: sounds like EncFS has some significant security issues: http://sourceforge.net/p/encfs/mailman/message/31849549/. No recent information in that discussion, so I don't know whether it's all been resolved. Here's an HN discussion of the audit: https://news.ycombinator.com/item?id=7384730
I've never used it, but I've seen people on HN recommend Attic. It dedups and encrypts. https://attic-backup.org
Personally, I use git-annex, which isn't exactly a backup tool but a general distributed file manager which can, among other things, automatically make encrypted copies of the files to various places (SSH servers, S3, Google Drive, etc).
Personally, I use git-annex, which isn't exactly a backup tool but a general distributed file manager which can, among other things, automatically make encrypted copies of the files to various places (SSH servers, S3, Google Drive, etc).
As mentioned, there is Attic [1] and Obnam [2].
Both do dedup and encryption, Attic can also store the data remotely via SSH (either with or without installation on the remote end) and Obnam can handle remote storage to an SFTP server.
[1] https://attic-backup.org [2] http://obnam.org
Both do dedup and encryption, Attic can also store the data remotely via SSH (either with or without installation on the remote end) and Obnam can handle remote storage to an SFTP server.
[1] https://attic-backup.org [2] http://obnam.org
To my siblings, thanks for the examples. It's good that there is a more UNIXy alternative approach.
However, until I have reason to dislike tarsnap's archiving or encryption or AWS, it's simply easier to use a single tool.
However, until I have reason to dislike tarsnap's archiving or encryption or AWS, it's simply easier to use a single tool.
>In the latter case you will probably be forced to cough up the decryption keys.
Not if you make the users password the key.
Not if you make the users password the key.
I've always wondered, what do you do in the case of a user forgets their password and has to reset it? Reset it and lose all their data?
Seems like the only way.
Seems like the only way.
If a group planned ahead they could give out some secondary kind of key. Gmail gives out these really long codes I can use to login should I not have the authenticator app.
Sorry, I might be missing something here, but would there be any tangible differences between the service provider having access to a secondary key vs them having access to the primary key if both can be used to access your data?
I'm honestly interested because I'm building a distributed system where only the user has the decryption key, and I've always just assumed that password recovery is a lost cause in such systems.
I'm honestly interested because I'm building a distributed system where only the user has the decryption key, and I've always just assumed that password recovery is a lost cause in such systems.
I would assume the recovery key is not stored in plain-text - it's likely hashed, similar to a password. If you need to use it, you enter the (hopefully safely stored) recovery key you have, they re-hash it and compare to the hashed one they keep.
OS X's whole-disk encryption (FileVault 2) similarly creates a recovery key at encrypt-time.
I believe it is the only way if you truly want a single user to have complete control of decryption. There are other solutions if you don't. I heard of one the other day (from MaidSafe maybe?) where you have a shared secret amongst your "friends" and if a quorum of them agree, it can reset your password. I assume this means your data is duplicated and encrypted via that shared secret as well which could be coerced I suppose.
I'm interested in why the EFF chose these companies to rate. For example, rating AT&T and Verizon but not Sprint and T-Mobile seems odd to me. Rating Snapchat but not Instagram almost makes sense becuase they're rating Facebook, but then they've rated WhatsApp separately.
The ATT/VZW/Sprint/TM differentiation is weird, but Instagram versus Whatsapp doesn't seem strange... Instagram doesn't honestly seem like a hugely valuable target. That's not to say I'm comfortable with them giving up info freely, but I'd be much more concerned about my WhatsApp data being turned over than my Instagram data.
I'd rather lists like these not be polluted by things like that.
I'd rather lists like these not be polluted by things like that.
Usually the EFF does a good job with these reports but you got to wonder with a company like Dropbox.
- Condi Rice is on the Board of directors - an avowed supporter of NSA warantless wiretaps
- Users cannot control thier Keys such that it becomes impossible for them handover data to the Govt. even if they complied to the NSL or whatever other BS demand
And they get 5 stars for "Having our Backs" (!)
- Condi Rice is on the Board of directors - an avowed supporter of NSA warantless wiretaps
- Users cannot control thier Keys such that it becomes impossible for them handover data to the Govt. even if they complied to the NSL or whatever other BS demand
And they get 5 stars for "Having our Backs" (!)
They also scan user files for copyright protection and a few years ago had some clear breaches of trust between users and the company.
The point of this effort is to elicit change from these organizations. If having breaches "a few years ago" means never getting a star, why would a company care?
[deleted]
Why does Google have only 3 stars?
https://www.eff.org/who-has-your-back-government-data-reques...
Edit: (less cheekily)
Inform users about government data demands: "...Google does not commit to providing notice after an emergency has ended or a gag has been lifted"
Disclose data retention policies: "Google publishes some information about log data and deleted data, but it is not complete and representative of all its services and thus does not qualify for a star."
Edit: (less cheekily)
Inform users about government data demands: "...Google does not commit to providing notice after an emergency has ended or a gag has been lifted"
Disclose data retention policies: "Google publishes some information about log data and deleted data, but it is not complete and representative of all its services and thus does not qualify for a star."
Particularly since I recall that Google had six stars last year.
Has Google gotten so much worse in the last year? Or has it perhaps stopped funding the EFF?
Edited to add citation: http://www.theregister.co.uk/2014/10/14/assange_bollocks_goo...
Has Google gotten so much worse in the last year? Or has it perhaps stopped funding the EFF?
Edited to add citation: http://www.theregister.co.uk/2014/10/14/assange_bollocks_goo...
This is covered quite well (multiple times) by the article. The categories are not the same as last year.
I agree that the changes are covered, but I disagree that they are covered well.
The following companies have gone from at least one star below Google to at least one star above Google, on a 4-6 star rating system, in the last year: Adobe, LinkedIn, Wickr, Wikimedia, Wordpress.
despite no company materially changing their terms in that time.
How is this a robust or meaningful measure, in that case? The exceptionally large variation is not addressed.
Why has this happened? In my opinion, it's because the 2014 report is bogus (two of the categories are "published a report"), and most probably it was just permitted to be bogus because Google were heavily funding the EFF in 2014.
The following companies have gone from at least one star below Google to at least one star above Google, on a 4-6 star rating system, in the last year: Adobe, LinkedIn, Wickr, Wikimedia, Wordpress.
despite no company materially changing their terms in that time.
How is this a robust or meaningful measure, in that case? The exceptionally large variation is not addressed.
Why has this happened? In my opinion, it's because the 2014 report is bogus (two of the categories are "published a report"), and most probably it was just permitted to be bogus because Google were heavily funding the EFF in 2014.
Three of the stars last year -- "requires a warrant", "publishes transparency reports", and "publishes law enforcement guidelines" -- were merged into a single star "follows industry best practices". According to the report, a company has to do all three of those things to qualify.
It's perfectly reasonable for the EFF to evolve how they're rating companies as the years go on. After all, the privacy landscape changes and they're trying to push companies to making some changes. That explains the drop in stars. According to the EFF, Google is doing things that are now considered standard, and they're no longer on the forefront of defending privacy.
Your accusations of bias because Google isn't funding the EFF are, frankly, ridiculous.
It's perfectly reasonable for the EFF to evolve how they're rating companies as the years go on. After all, the privacy landscape changes and they're trying to push companies to making some changes. That explains the drop in stars. According to the EFF, Google is doing things that are now considered standard, and they're no longer on the forefront of defending privacy.
Your accusations of bias because Google isn't funding the EFF are, frankly, ridiculous.
>Three of the stars last year were merged
If that were the only major difference, Google would still have 4 stars with the 5th undecided. Google now have 3 stars.
>Your accusations of bias because Google isn't funding the EFF are, frankly, ridiculous.
To be clear, I am not accusing EFF of bias against Google.
Other privacy organisations have literally accused the EFF of lobbying for Google. From Wikipedia:
"In 2011, the EFF received $1 million from Google as part of a settlement of a class action related to privacy issues involving Google Buzz. EPIC and seven other privacy-focused nonprofits protested that that the plaintiffs lawyers and Google had, in effect, arranged to give the majority of those funds "to organizations that are currently paid by Google to lobby for or to consult for the company.""
Since then, the EFF spoke up loudly against the right to be forgotten (Google Spain v AEPD and Mario Costeja González), even though this is considered a privacy basic by EU data protection principles.
If that were the only major difference, Google would still have 4 stars with the 5th undecided. Google now have 3 stars.
>Your accusations of bias because Google isn't funding the EFF are, frankly, ridiculous.
To be clear, I am not accusing EFF of bias against Google.
Other privacy organisations have literally accused the EFF of lobbying for Google. From Wikipedia:
"In 2011, the EFF received $1 million from Google as part of a settlement of a class action related to privacy issues involving Google Buzz. EPIC and seven other privacy-focused nonprofits protested that that the plaintiffs lawyers and Google had, in effect, arranged to give the majority of those funds "to organizations that are currently paid by Google to lobby for or to consult for the company.""
Since then, the EFF spoke up loudly against the right to be forgotten (Google Spain v AEPD and Mario Costeja González), even though this is considered a privacy basic by EU data protection principles.
> despite no company materially changing their terms in that time
Yes, because, again, the test criteria themselves changed.
I'd suggest your focus on a two-data-point trend and google (at the exclusion of every other company on this list) may just be revealing your own bias rather than the EFF's.
> it's because the 2014 report is bogus (two of the categories are "published a report")
again, I'd suggest actually reading the report. Several of the categories this year also only require a single line in a privacy policy. That's all this report has ever been -- some disclosures, but in many cases, just flat out statements that something will be done with no actual verification that it will be (since in many cases that's not conclusively possible).
Yes, because, again, the test criteria themselves changed.
I'd suggest your focus on a two-data-point trend and google (at the exclusion of every other company on this list) may just be revealing your own bias rather than the EFF's.
> it's because the 2014 report is bogus (two of the categories are "published a report")
again, I'd suggest actually reading the report. Several of the categories this year also only require a single line in a privacy policy. That's all this report has ever been -- some disclosures, but in many cases, just flat out statements that something will be done with no actual verification that it will be (since in many cases that's not conclusively possible).
learnstats2(2)
Look at pages like DataSaver.
https://support.google.com/chrome/answer/2392284?p=mobile_ba...
There's nothing there about privacy considerations. It'd be great if Google started letting users know of there are (or aren't) privacy implications.
https://support.google.com/chrome/answer/2392284?p=mobile_ba...
There's nothing there about privacy considerations. It'd be great if Google started letting users know of there are (or aren't) privacy implications.
Curious if there's any project that aggregates all the transparency data data into a nice CSV, could be useful to chart and track trends.
[deleted]
The stars should link to sources of each of these categories, that'd be cool.
Microsoft opposes backdoors but not some process that is very similar that allows "legitimate legal requests" to be fulfilled ...
Another issue here is that by looking at the past reports you see how quickly one company is the favorite and soon becomes the ugly step child. The columns with stars are also changing to what sound like very vague and lax requirements compared to the year before.
I didn't see any explanation there why. For instance they took out the "requires warrant" column. I wonder if companies are contributing to the EFF and so the EFF feels the pressure to make these companies look good in the face of this new Snowden era. For instance, isn't it great that Apple now has 5 stars as it's starting it's big "we're private" push while Google is now very low compared to previous years? And how about twitter? They used to be a poster child for good behavior as far as companies go.