Horizontal Hostility: Episode 1: Riseup, Technological Centralization & Snitching

  • Posted on: 3 March 2017
  • By: Anonymous (not verified)

From Horizontal Hostility

Horizontal Hostility’s inaugural episode. The five hosts gather in the same city and same room (with two spectators and occasional commentators) to talk about Riseup.net’s decision to turn over information regarding two users to the FBI and their justification. Basically Will demonstrates he’s spineless and weak on snitches by talking a lot to defend the value of Riseup’s infrastructure while everyone else disagrees and Pax actively whittles torture implements to use on snitches in Iranian prisons over the course of the episode. Possibly more nuanced conversation is had about the context of Riseup’s decision. Lots of shit is talked about the hacker community. Discussion gets a bit technical at places, but should still be followable.

[download mp3]

category: 

Comments

The continuous Warren G loop is annoying.

It's Ice Cube you fucking herb

*ice cubes*

I kept hoping that the beat's presence meant that, sooner or later, Gillis would suddenly bust out:

Yo, the name's Willy G,
Yeah, you heard 'bout me,
I'm the one tellin' you that e-mail makes us free,
Using terms like bandwidth for human activity
Though haters love to make me targets of their mockery,
They won't laugh when I have digital immortality!

So market trans humanists are anarchists now? Cool story, bruh.

I'd even dare to say "ancaps".

Gillis is the only person on this pod that is pro-markets tmk.

At first I disavowed Gillis as part of the anarchist movement on any level due to the embarrassment. But I have honestly come around to him and think of him as the cuck of the North American Anarchist Movement.

I look forward to a time when USA anarchism is no longer dominated by babbling idiot men with their endless boring podcasts and their rival online personality cults.

is very easy actually:

Bring on the FAI/CCF to the US!

Then expect all of these personality cults with their real legal names attached to stfu all of a sudden and maybe resurfacing later, somewhere in Mexico.

Jesus fuck, pls work on your audio. Speak directly into the mic!! Turn that shit up!

Supposed geeks who don't know how to use a micro and Audacity...

Hey Anarchist podcaters! Thanks for making more anarchist media but if you're going to post content on Archive[dot]org why aren't you using their podcast feeds? It would make life much easier for the listener.

Was the first 65 minutes on RiseUp necessary?

I was fairly disappointed in the lack of critique of the usability of GPG/PGP on this podcast. The segments talking about GPG could have been made yesterday or 7 years ago and the conversation would be exactly the same. There's no evident evolution in thinking on this from the speakers who seem to exist in a techno-geek bubble that mocks people's inability to use GPG.I use GPG, I've taught many people to use GPG, and given workshops on GPG. I work as a programmer and am a very technically literate person. Having said all that, I am convinced that GPG is too complicated for the average anarchist (or person) to use and will remain so forever. I still learn new aspects of how GPG works after years of using it when I have conversations about it with people BECAUSE it's so complicated. I used to apologize for GPG ("It's easy!") and think that we just needed enough workshops and people would, as one speaker on the podcast says "step up" collectively and learn GPG. This is unrealistic and I think it's harmful to keep parroting this opinion. GPG will continue to be used by a small minority of the anarchist movement. I think it's great that the people that use GPG use it but the discussion around usability with GPG is very relevant and is wholly dismissed in this podcast.Furthermore (never claimed to be objective), while there is basically zero criticism of GPG's usability and lack of evolution, there is a good amount of attempts to criticize Signal has being inadequately secure, with a good amount of non-factual information thrown in that is partially caught and corrected by other speakers on the show but not entirely. A non-technical user listening comes away with the conclusion (IMO) that Signal is imperfect and GPG is perfect. So let's dissect the actual facts and limitations of GPG and Signal:Mass surveillance:- Both GPG and Signal will secure the contents of your messages.- Metadata (who's messaging who) will always be exposed with GPG, but never with SignalTargeted remote surveillance:- GPG lives on your computer and Signal lives on your phone. Which is more inherently secure is debateable depending on the operating system, updatedness, and configuration. It certainly could be argued well that your computer is easier to secure comparatively. In the end, if the government is able to exploit a vulnerability on your phone or computer or trick you into installing malware, they can get around either GPG or Signal.- If the government seizes or intercepts your e-mails encrypted with GPG, they have all your metadata and can still map networks of who's talking to who with what frequency and unless you're using Tor or a VPN, they will likely have the IP addreses of those communicating. By contrast, if the maintainers of Signal "cooperate" they have no real useful information to give (no metadata, IP addresses, or even the encrypted messages themselves). They have been tested on this claim recently: https://whispersystems.org/bigbrother/eastern-virginia-grand-jury/Targeted in-person surveillance (cops seize your phone or computer)- If both your phone and your computer are unencrypted, the situation is bad, but probably worse with your phone. Phone disk encryption is unfortunately terribly designed and encourages users to choose bad passwords because you have to enter it every time to open your phone and typing is way slower on a touchscreen than a keyboard so a very long password would make your phone unusable. Apple is trying to solve this problem by the security features (hardware and software) they are constantly working on and we heard about with their drama with the FBI, which was encouraging. But even so, Apple's software is not open source so it's hard to ever totally trust it, although they do get some credibility points in my opinion after the FBI affair.- Signal does provide the option to enable a passphrase on your Signal app to encrypt your message database on your phone so that if your phone is seized, they can't access your messages without the password (if it's locked). This is also more usable in that you typically only have to enter your passphrase once and then it stays unlocked so you don't have to enter it every time you get a message. However in this situation it is only your message contents that is encrypted, the metadata is still exposed if there isn't a full device encryption enabled (and locked with a good passphrase).In my opinion, the lack of metadata exposed with Signal and its supreme usability are major factors in its favor over GPG. The negative aspects of Signal...aren't really negative aspects of Signal specifically but rather negative aspects of phones. And of course your phone is tracking you wherever you go, but this point has already been made abundantly clear to everyone in the anarchist community. All of these people are still using phones and bringing them (almost) everywhere because it's 2017 and that is the reality of modern communication. And within that context, Signal is absolutely the most secure thing you could possibly use, especially if your alternative is STILL making calls, STILL sending texts, but completely insecurely. There is no choice between only communicating with GPG on your computer or only communicating with Signal. One is completely not an option and the other actually is (I'll leave it to you to decide which one).Being targeted because of who you know or who you're talking to is a real thing, especially with anarchists, so that information being substantially harder to gather (with Signal) is a huge advantage for anarchists that also aren't using Facebook or some similar network tracking service (wishful thinking but hey, there are some holdouts).The podcast simultaneously tries to make the point that if you're committing serious crimes or are a less "wanted" anarchist, GPG is the best solution in both situations. These are actually two different situations. Depending on the severity of your "underground"ness, you may not even want to have a phone at all to avoid location tracking so in that situation GPG won't necessarily be a better option, but rather your only option. And sure, you can easily make new e-mails but generally e-mails don't stay very "anonymous" for long. Not to say that a phone number is anonymous, far from it. But while it's easy for any dedicated adversary to find out who's behind a phone number, it's not easy for that same adversary to see the metadata of all your messages in which your phone number is exposed, leading to that second stage where they ask "So who is this phone number?" The more protected you are from mass surveillance, the harder a time the government has filtering down to the people they're "really" interested in.

The speakers on this podcast also object to the "centralization" of Signal and the ability of the government to shut down the servers Signal uses. If such an attempt were made, it would be rather trivial to set up new servers in a less hostile environment and continue routing all traffic over that. Signal has already been implementing measures to thwart government interference with their service in the Middle East quite successfully. And additionally, Signal has gained quite a lot of support from other powerful tech companies, news agencies, and members of the public to such an extent that an attempt by the u.s. government to shut them down completely or imprison their administrators would cause enormous outcry. This is why I find the idea of it being "shut down" so easily as rather unlikely. It's not the same as shutting down Napster. There was open acknowledgement that the purpose of Napster was copyright infringement. To criminalize Signal would require encryption to be outlawed which seems very unlikely.

I'd like to see e-mail encryption become as usable as Signal. The LEAP project and Darkmail/Lavabit were both looking promising but it's unclear what the future of those projects are. Darkmail is particularly interesting because it's promising a whole new e-mail protocol that will make metadata harvesting very difficult and has usability as a top goal. I gotta say though when I evaluate the evidence, if find little fault with Signal (certainly less than this podcast implies) and a lot of issues with GPG. I still use GPG, but I'm having fewer and fewer people to use it with because more people are gravitating toward easier, better designed, and very secure alternatives. Seriously, you can't say shit about Signal's integrity, it's rock solid. Phones aren't rock solid but hey, hopefully they get more so every day and allegedly all known CIA exploits are being patched as we speak so that's a step in the right direction.

Seriously? I'd accept this from someone who is tech illiterate but the very idea that a phone can hide it's metadata is outrageous. Signal can't be from anon party to anon party as long as it requires a phone #. Email can be, easily, everyone know this so blow your metadata out your ass here. Also you can use pgp/gpg over signal if you really want to because it's an exposed protocol just for data, not an app.

Usability is important but let's be real, if you're trying to be secure it will always be difficult and let's not act like that wont be the case. If you're an anarchist, please for all that is good stop waiting for facebook to protect you and fucking protect yourself. Anarchy is hard, security is hard, life is hard.

Obviously I wouldn't be discussing anything really compromising through Signal or Riseup. I'd be doing it the old Soviet way, which is to go for a walk in the bushes. In today's world these bushes are usually a dozen times further, since especially in overly-developed regions you gotta be lucky in order to find an area without cell phone coverage. But but but... there's also the lower levels of an underground parking lot, where there's no cell phone repeater, I guess.

Yet as long as people use GPG to/from encrypted devices, this is decently safe, even if not completely. Also human intelligence is still a thing... it's hard to really know if anyone in your clique isn't a snitch.

Completely safe is impossible. GPG is stronger than signal hands down, whether you use it or not I guess depends on whether you are just worried about someone figuring out what party you're going to this weekend or whether you have some real immediate need for security or you have a long-term perspective.

Using signal is smart for regular business, but it's inherently insecure because it's centralised, and controlled by google not by open whisper, as much as people would like to ignore that google holds the update keys, they do.

Bottom line, gpg's integrity has been tested long term by AR and other groups and it works, signal hasn't and at best it is as secure as google's integrity.

especially with the tools we got today that don't require that pedestrian console techno-thriller every time.

As you are somewhat saying, the problem is how poorly it's been taught, by pedantic or bubble-boy geeks who never give a fuck about being intelligible to the laymen.

Example... instead of horrifying lectures about private and public keys, keychains and network of trust, I could explain GPG in one straightforward way:

You want someone to be able to send you a memo without anybody else reading it.

You get a small safe with a crack on top for slipping in the memo, and you're the only one who has the key or combination for the lock (or your group has it too, if needed).

You pass on the safe to your friend(s), so they can put in their messages without opening the box (if it's private key).

Then at some point you get your locked box back. If it hasn't been tampered with you can open it with your password/key, and you get access to your mail, that nobody else could have read outside of your pen pals.

Alternatively, it's also a good idea to teach encryption through going through its history, how it's been used and for what purpose.

The complexities are all about the language used... which is in that case pretty over-complicated and schizo. Vulgarizing is what's needed.

Cutting and pasting text from an email to a GPG gui client like the GNU Privacy Assistant is simple, secure, and long predates the existance of Signal or even smartphones. Lots of intel about things like HLS moved around that way, among folks who damned well knew the stakes and did their homework as a result.

Signal's main advantage is that you can get your friends who haven't yet been personally attacked by the state and/or do not think their work is "heavy" stuff to use it, and they usually already have everything they need to install it. It is the one thing we have that stops people from relying on unencrypted phone calls and unencrypted text messages. Just don't trust it for anything you don't trust a cellphone itself to be present for.

Getting people who mostly are used to organizing lockdowns to install a good linux distro on an encrypted disk, then cut and paste text between any two applications can be like pulling teeth. Makes the most secure systems, but it's easier to talk to these folks in person with phones off than to get them to install Linux or cut and paste text between any two applications.

Add new comment

Filtered HTML

  • Web page addresses and e-mail addresses turn into links automatically.
  • Allowed HTML tags: <a> <em> <strong> <cite> <blockquote> <code> <ul> <ol> <li> <dl> <dt> <dd>
  • Lines and paragraphs break automatically.

Plain text

  • No HTML tags allowed.
  • Web page addresses and e-mail addresses turn into links automatically.
  • Lines and paragraphs break automatically.
To prevent automated spam submissions leave this field empty.
CAPTCHA
Human?
f
z
2
m
z
K
T
Enter the code without spaces.