[2013-12-30]

Trust over security in today’s internet

I assume that you are rightfully scared of public cloud services like Google and the legal terrorism done by insatiable secret services. If you are instead a happy GMail user and don’t know what I’m talking about – go watch cat pictures instead and enjoy your life. Beati pauperes spiritu. 🙂

For a while I followed the daily horror news after it became public what secret services are doing against the people that pay them. Then I started wondering what to do against it. A friend asked whether we should join public protest marches against surveillance. But let’s be honest – that had just wasted both our time and improved absolutely nothing. It’s probably human to “just do something about it” – no matter how pointless it actually is. Our politicians do not care for protesters. And what is worse: various backyard lobby meetings made their surveillance legal. That’s why I speak of legal terrorism against us – the people. Of course what they are doing it completely wrong in every aspect. But protesting does not help. Voting does not help either because our politicians are bound by their own laws anyway. It’s about too powerful individuals, lobbyism and money. Everyone with at least an average informedness should know from public information sources that it’s not about terrorism but industrial and economical espionage and keeping power over the people. It is very unlikely that you have any power to change that situation alone. Protesting? Screw that.

The next logical idea is increasing technical security. After all we are geeks so let’s use our knowledge and improve the ways we communicate. I switched all my own web sites to HTTPS (of course I used self-signed certificates), switched to SSH public key authentication and replaced all passwords that I might ever have used over an unencrypted channel like HTTP. I enabled the OTR encryption in Pidgin to communicate with my friends in a safer manner. That made me feel very relieved regarding the services I was personally responsible of. The only lacking part was email. I could just convince two relatives to switch to GnuPG for personal email – but most people don’t care enough or claim that GnuPG makes their lives too complicated. So I consider email a public medium and educate people to use it like that. Okay, technical security increased – check.

So the communication channels were secured. But what information did I store on the internet? Well, unless I stopped shopping on the internet there would be no way I could avoid leaving footprints. Strangely it scared me way more to save my contacts and calendar entries at Google to sync them with my Android smartphone than having them know my credit card number. Think about it: what is the worst thing that could happen if someone steals my credit card number? I would call my bank, cancel the card and get a new one. But what if someone steals the full contact information of most people I deal with and knows from my calendar where I will be at a certain time? Why did I worry about encryption and on the other hand fed Google all that information? Just because the Android installation wizard tricked me into it and made it easy. Oh, you evil laziness. So I moved my calendar entries and contact information into my personal OwnCloud instance. Except for the “Play Store” (still the most ridiculous name for an appstore anyway) I did not need anything from Google. And while I was at it I stopped using my Google account as an OpenID provider and disconnected all trust relationships to other websites and instead gave every website a distinct long password saved in my encrypted personal password file. I removed the last instance of Google Analytics and went through the ridiculously simple steps to set up Piwik instead.

Then at 3 a.m. one day I was on the phone with a friend when I suddenly realized what the actual problem is: trust. What is the good of having a smartphone calendar if I have a bad feeling storing personal information at an organisation that I don’t trust. To hell with Google’s “don’t be evil” slogan – it died long ago. I don’t trust politicians to decide in my interest. I don’t trust my bank to have any interest in anything but my money. I don’t trust the press to provide me with well-balanced information about the state of the world. I used to be called paranoid. Now I feel like the only non-naive running around. I find it alarming that the majority of people seem to have stopped thinking about trust. Face it: what is the motivation of a newspaper to deliver news to you? Their interest in being honest to you? Or their interest in making money? I don’t mean to say that you should distrust humanity entirely. Many people do great things. Just be careful who you trust – and that’s way more true than decades ago when your mom told you so.

You think you control who you trust? Take a look at the trusted certification authorities in the browser that you use to read this article. What made you trust these organisations? My next article will probably about the absurdity of trust centers who trade money for fake trust. Stay tuned.

Leave a Reply

Your email address will not be published. Required fields are marked *