Category: Decentralisation and Neutrality

Categories
Data Custody Decentralisation and Neutrality The Next Computer

Cloud islands

A lot of what I write is about data custody. It’s a topic that we’re inevitably going to have to debate in the mainstream sometime this decade – I mean prime time conversations on TV. That’ll happen when enough people experience the downsides of having their data reside with just a few large tech companies.

The Custodial Internet
Data Ownership vs Custody for the 21st Century – Part 1

There are many ways things could go wrong with your data in the Cloud.

People could be locked out of their account for some violation of terms of service they weren’t even aware of, or being hacked via social engineering. If it’s their Google account, they lose access to their email, their photos, contacts. This has happened several times. We only rarely hear of it when it happens to someone with a large online following.

One of these companies may have a problem with their data centers. Even though people have access to their accounts, they could find their emails, documents, chats lost.

Companies could suffer an outage. This happens fairly regularly, most recently just a few days ago with the data organisation company Notion. If you can’t access your information at a critical moment – if you need to pull up a receipt number or a scan of a medical prescription – you lose trust in the company you stored your data with.

There are others still:

Governments could ban companies overnight, leaving you unable to access your data – India’s upcoming cryptocurrency law could do just that.

Companies could readjust free limits, leaving you with no choice but to begin paying them to hold your data – the upcoming changes to Google Photos’ free tier is an example.

You could find that there’s no easy way to export your data – if you move from an iPhone to an Android, it’s really hard to transfer the notes from your Notes app to an equivalent Android app.

The ‘cloud’ as the default for our life’s information and documents and photos – this is all very new. Email was probably the first to move to the cloud with Gmail, but even that was just fifteen years ago. That’s barely half a generation.

Each of us needs to spend at least some time thinking about how we’re going to deal with our data when we’re ten, twenty, thirty years older than today. How likely is it we’ll continue use iPhones or whatever they evolve to, to have several terabytes of info in our iCloud Drive or its successor(s), that we’ll keep buying Apple TVs to project our photos on? Ditto with Google. Or {giant trillion dollar corporation}.

We have collectively been exposed to billions of dollars of marketing to keep us from thinking about this, to believe that our data’s safe in the Cloud for now and forever.

To add to that, most of us aren’t ‘tech-savvy’ enough to even know what alternatives exist, much less be able to move to them and use them on an every day basis – why, even if you change your default browser, you’ll be asked if you want to switch back by the browser your computer shipped with (try it – change your default browser to Firefox on Mac OS; Safari will ask you right away if you want to switch back. Microsoft is even worse with Edge)

Finally, neither independent software makers nor open source projects been able to create software that, for the most part, can replace the entire gamut of Cloud-like software that the dominant tech companies provide. For instance, it’s not straightforward to organise your photos using something that’s not Apple Photos or Google Photos or Adobe Lightroom Classic – alternatives exist but they’re not great.

So. It’s not easy and it’s not a solved problem by any means.

Until the Cloud becomes a safe, reliable commodity like the electricity grid or the Internet itself, we’re going to have multiple independent Cloud islands. Apple’s. Google’s. Amazon’s. Microsoft’s. Yandex’s. Dropbox’s. Adobe’s. And a dozen more.

Each are closed worlds, but worlds that hold your life’s work and loves. And your only key, your username and password, isn’t guaranteed to always work.

It’s not sustainable.

(Featured Image Photo Credit: Pearse O’Halloran/Unsplash)

Categories
Decentralisation and Neutrality Privacy and Anonymity The Dark Forest of the Internet

Decentralisation and criminal activity

A few days ago we discussed how end to end encryption and decentralisation were an inherently political matter.

Signal and Bitcoin are equally dangerous

We saw how Signal’s end to end encryption meant that security agencies can’t simply compel the Signal nonprofit to unscramble users’ messages or monitor them. With Bitcoin, there is no central authority to target, and no easily traceable identities, unless you’re a beginner who’s left their cryptocurrency in an exchange’s account. But it’s because they’re inherently secure, they’re attractive to criminals and terrorists. That in turn attracts the attention – and ire – of law enforcement agencies. And turns it into a political issue.

This article in fact describes the use of Jabber-based messaging apps by criminals in Russia:

Jabber’s federation means that anyone can open a server and run it as they see fit. That’s enormously attractive to criminals worried about companies cooperating closely with governments, especially in the United States. And some Jabber servers are set up specifically to cater to criminals.

– Why Jabber reigns across the Russian cybercrime underground

This isn’t a matter of forcing wiretapping phones, or compelling Apple to unlock iPhones, or forcing a bank to turn over account statements. If traffic on this server is tunneled through a VPN, even locating what Jabber chat server criminals use is a huge problem for security agencies. And unlike Parler or Facebook groups, one can simply set up another Jabber server.

It’s the same reason that sites on the Tor network that sell and list torrents and other contraband are so resilient to being taken down.

(Featured Image Photo Credit: Ricardo Gomez Angel/Unsplash)

Categories
Data Custody Decentralisation and Neutrality Personal Finance Privacy and Anonymity Real-World Crypto The Dark Forest of the Internet

Dalio on Bitcoin – store of value and its threat to governments

Some extracts from the hedge fund manager Ray Dalio’s public note about Bitcoin.

I believe Bitcoin is one hell of an invention. To have invented a new type of money via a system that is programmed into a computer and that has worked for around 10 years and is rapidly gaining popularity as both a type of money and a storehold of wealth is an amazing accomplishment.

Because of what is going on in the world, besides there being a growing need for money or storehold of wealth assets that are limited in supply, there is also a growing need for assets that can be privately held. Because there aren’t many of these gold-like storehold of wealth assets that can be held in privacy and because the sizes of their markets are relatively small, there exists the possibility that Bitcoin and its competitors can fill that growing need.

He does make a counter-argument against supply: that while Bitcoin itself is limited, there is no limit to the number of cryptocurrencies that can be created in the same manner. As untamperable and un-shut-down-able as Bitcoin.

Speaking of untamperable, Dalio recognises that the biggest threat to Bitcoin is not an attack on the chain itself, but in governments restricting access to it in the first place.

I suspect that Bitcoin’s biggest risk is being successful, because if it’s successful, the government will try to kill it and they have a lot of power to succeed… for good logical reasons governments wanted control over money and they protected their abilities to have the only monies and credit within their borders. When I a) put myself in the shoes of government officials, b) see their actions, and c) hear what they say, it is hard for me to imagine that they would allow Bitcoin (or gold) to be an obviously better choice than the money and credit that they are producing.

This is potentially what could happen in India. While the government recognises – rightly – that cryptocurrency isn’t clearly either a currency or an asset and therefore doesn’t fit into existing regulatory frameworks, its approach to it seems to be one of antipathy. A bill that may be tabled and discussed in the coming weeks is described in the current parliamentary session agenda as one that intends to

… create a facilitative (sic) framework for creation of the official digital currency to be issued by the Reserve Bank of India. The Bill also seems to prohibit all private cryptocurrencies in India, however (sic) it allows for certain exceptions to promote the underlying technology of cryptocurrency and its uses.

Categories
Decentralisation and Neutrality The Next Computer

The physical limits of software and the Internet

There’s a worldwide shortage of semiconductor chips. Across industries. Nearly every device we own today has chips, and often dozens of them. We think of chips as essentially infinite in number. But:

Industry executives also blame excessive stockpiling, which began over the summer when Huawei Technologies Co. — a major smartphone and networking gear maker — began hoarding components to ensure its survival from crippling U.S. sanctions… Rivals including Apple, worried about their own caches, responded in kind… “There’s a chip stockpiling arms race,”

All that has dried up the spigot for smaller-volume buyers such as the makers of cars and gaming consoles: Nintendo Co., Sony and Microsoft Corp. have struggled to make enough Switches, PlayStations and Xboxes for about a year… [a] growing chorus of industry leaders warning in recent weeks they can’t get enough chips to make their products. Carmakers appear in direst straits and have spurred the U.S. and German governments to come to their aid

– “Chip Shortage Spirals Beyond Cars to Phones and Consoles”

We discuss the centralisation of the Internet on this site. This article shows that even the other end of the stack – chips, the building blocks of hardware, are centralised.

It also shows that while we aren’t wrong in thinking of the Internet and software in general as infinite, there are real physical constraints for the hardware that it all runs on.

(Featured Image Photo Credit: @awmleer/Unsplash)

Categories
Decentralisation and Neutrality Privacy and Anonymity Wellness when Always-On

It’s a war all right

In a blog post announcing a security-focused release of the Firefox browser, Mozilla described how ingeniously-constructed ‘supercookies’ work:

[to reduce bandwidth and other overhead] if the same image is embedded on multiple websites, Firefox will load the image from the network during a visit to the first website and on subsequent websites would traditionally load the image from the browser’s local image cache…

Unfortunately, some trackers have found ways to abuse these shared resources to follow users around the web. In the case of Firefox’s image cache, a tracker can create a supercookie by “encoding” an identifier for the user in a cached image on one website, and then “retrieving” that identifier on a different website by embedding the same image.

Constructing trackers with this level of sophistication and building distribution of these shared images across websites is not a trivial effort.

For this effort to make monetary sense, advertising and tracking companies need to collect vast amounts for a vast number of people – including you and me – so that even when a tiny fraction of that is useful, it makes enough money to pay for all the engineering and distribution. That means you’re up against a machine that is as aggressive as it is technically sophisticated.

Likewise, Mozilla. How does Firefox disrupt supercookie tracking without fetching an image afresh every time, even if it’s the same image?

[Firefox] still load(s) cached images when a user revisits the same site, but we don’t share those caches across sites. We now partition network connections and caches by the website being visited. Trackers can abuse caches to create supercookies and can use connection identifiers to track users. But by isolating caches and network connections to the website they were created on, we make them useless for cross-site tracking.

Given the vast number of websites that the average person jumps through over any given week, this is not easy to pull off.

I don’t use the term ‘war’ lightly. But this is absolutely a war on your privacy.

It doesn’t matter whether you value your data or not (you should), it’s that you don’t get to choose. Supercookies show that an immense amount of know-how and engineering being deployed to strip you of your privacy. Firefox in turn put in a similar amount of counter-engineering to neutralise that threat.

Make sure you move to Firefox, an open source project whose only incentive is to protect you. And keep it updated. And donate to Mozilla.

Categories
Decentralisation and Neutrality Privacy and Anonymity The Dark Forest of the Internet

Signal and Bitcoin are equally dangerous

This article describes the tension at the nonprofit that builds the messaging app Signal – the tension between providing totally private messaging, and the inevitability that such a service will be used by terrorists and criminals to organise.

Privacy was, is and will be political. Governments have always wanted access to information, from intercepting postal mail to eavesdropping on telephone conversations to the USA National Security Agency’s PRISM programme that collected data from nearly every major USA tech company: Microsoft, Google, Facebook, Apple.

Until recently, end to end encryption, like the kind Signal (and Telegram) makes possible, has not been available to people like you and me. With such encryption, not even Signal itself can access the contents of our conversations [1]. This means even if USA or other government spies were to break into Signal’s systems, or obtain its covert cooperation, they wouldn’t be able to see what messages you and I typed to each other.

That means for you and me, the very act of using Signal and other such services is political. Likewise for Signal, providing such a service is a political act.

It is always going to be at the receiving end of governmental efforts, USA and outside, to provide encryption backdoors for their security agencies [2][3].

If you were such a government, you’d use informal private pressure, you’d build a public legal case and you’d discredit the company and private messaging in general by pointing out the danger to national security. This is also the playbook governments the world over have used to deal with cryptocurrency.

I think the only way that the Signal organisation and others like it will be left un-harassed is by reframing the question.

Today it is “What is Signal doing to tackle terrorist activity taking place on your service?”

The much more politically fraught – but correct – question is “Why is the onus of identifying, reporting and shutting down terrorist/criminal activity primarily on Signal?”

Like it or not, Signal is a political organisation. It needs to begin acting like one.

[1] And we don’t need to take Signal’s word for it – the app and server code is available publicly.

[2] Never mind that that kind of backdoor would require explicitly moving to a fundamentally different, less secure encryption algorithm.

[3] PS: And you and I, as Signal users, are going to be suspect.

(Featured Image Photo Credit: Alexandru Zdrobău/Unsplash)

Categories
Data Custody Decentralisation and Neutrality Privacy and Anonymity Wellness when Always-On

Privacy from who? – Part 2

(Part 1 – when you think about privacy, it’s not just about some apps on your phone. We listed and discussed other entities that have access to your data and your online activities: your phone manufacturer, the OS that runs on your computer and phone, your browser, your internet service provider, your phone carrier/operator. The list continues below:)

The websites you visit – This is the Big Tech that people are usually concerned about. Whether Facebook.com or Google.com or Amazon.com, incognito mode protects you somewhat here as long as you don’t log in, but even then trakcers now use digital ‘fingerprinting’ that combines several signals to uniquely identify you between visits. Those trackers often send data to other trackers that consolidate this sort of data.

The apps you use – Also includes Big Tech, but goes well beyond them. As we have seen in the article about whether or not to use Whatsap, apps use ‘SDK’s or software packages from a number of tracking companies that record your activity in the app in great detail. This activtiy data is a lot creepier and a lot more valuable than we usually suspect. Consider Netflix’s analytics for modeling your preferences. It tracks

  • Times when you stop, pause, rewind or fast forward the content.
  • Days and times when you watch certain content such as rom-coms on Saturday night at 7pm, and Family Guy on Tuesdays at 10pm.
  • The specific dates you watch (e.g. what movies are popular on Valentines’ day)
  • Your location when you watch such as your home or at work.
  • What device you use to watch content. (e.g. TV for movies, Laptop for binge watching shows in bed)
  • At what points during the show you stop watching and move on. In addition, they also track whether you resume watching later.
  • What rating you assign a piece of content.
  • Your search history.

And also

  • How you browse and scroll through selections. I.e. Do you pause and read descriptions, or just skim through until you see a title/cover you like?
  • The types of trailers, promotional posters, words, colours and sounds you respond best to i.e. most likely to click on, and follow through.

Similarly, for an ecommerce app, your activity in its app – when you browse, how long you browse, what categories you spend time in, what items you tap preview images for – all this stuff collectively is as valuable as the stuff you actually buy. Same for chat apps. Even if your chat data cannot be decrypted by the company, your behaviour in the app including who you chat with, when, how long, what profiles you tap – all of this builds a picture of you. This The amount of data you can collect on an app – phone make, precise location, contacts – is deeper than websites.

Your DNS provider – DNS is the Internet’s way of translating the internet requests your browser makes and translating them to IP addresses to locate websites, images, CSS stylesheets, fonts and so on. In most cases, your DNS is provided by your ISP. That gives your ISP direct visibility to the sites you visit. If you use another, secure, DNS provider, perhaps one set by your router, or your smart device, or if you change it on your computer/phone/tablet to, say Google or Cloudflare or OpenDNS or some of the others, they now have access to that list. And using a third party DNS provider doesn’t totally hide your web traffic from your ISP either. They may not see the precise DNS request, but they’ll see the reply. You can hide this from your ISP by using a VPN service, but now your VPN provider has access to your traffic [1]

The point of all this is to show that we usually think of privacy in the context of the Big Tech USA companies: Google, Amazon, Facebook and similar. That concern is justified. If anything, it’s under-discussed and poorly understood. But the scope of online surveillance is a lot wider and a lot deeper. And significantly more creepy.

Now that you have some idea of what is watching you online, we can get into how you can protect yourself. We’ll discuss that in the coming days.

(Part 3 – a comment on data custody and open source)

Footnotes

[1] Unless you host your own VPN, but that requires technical capability, and if you’re hosting it in the cloud so you can use it both at home and outside, then you’re paying the cloud provider for all the traffic routed through the VPN.

(Featured Image Photo Credit: Anastasiia Krutota/Unsplash)

Categories
Audience as Capital Decentralisation and Neutrality Discovery and Curation The Dark Forest of the Internet

The last Twitter megapersonality – Part 2

(Part 1 – Deplatformization)

What’s new is the Trump episode demonstrated these companies’ herd mentality: first no one could afford to act against his social media accounts because it would mean losing eyeballs. And then all of a sudden no one could afford to keep his account standing. [2]

This means online personalities can’t rely of any of these platforms as an alternative to the others. Now that the platforms have acted in unison once – rather effectively – they’re likely to be more aggressive in the future. It’s like being cancelled, but by entire platforms.

So the next megapersonality isn’t going to be primarily on Twitter or Facebook or YouTube or even Telegram. They are going to own their presence. They may publish and engage on all of these platforms, but their home, their fortress, is going to be an independent online presence.

Two types of such online presences will proliferate among influencers: One, state controlled or state influenced online media for national political leaders. The internet equivalent of state TV and Radio. China leads the world here.

Two, independent online properties. We discussed this earlier in the context of Trump’s options:

Where will the Trump community congregate after the Twitter and Facebook ban?

This Vox article shows how other right-wing personalities like Alex Jones have their own website and online radio show have an audience independent of social media sites. While they also have also suffered in their ability to reach people after being shut out from media platforms, they have survived, even thrived. For Trump, who hasn’t bothered spending any time investing in any platform his own, there is suddenly no way to reach out to his followers. Every political leader, every entertainer, every tech personality has seen this unfold.

Trump may have been the last Twitter megapolemicist, but it’s likely he’s going to run one of the first personal megaplatforms. I’m looking forward to how quickly it happens and what form it takes.

(ends)

[2] The point of this is not about right or wrong. For the record I think Trump’s Twitter account was a disgrace to online decency.

(Featured Image Photo Credit: Harald Arlander/Unsplash)

Categories
Audience as Capital Decentralisation and Neutrality Discovery and Curation The Dark Forest of the Internet

The last Twitter megapersonality – Part 1

‘Deplatformization’ is now a word in the tech world’s vocabulary. It’s what the Tech Giants did to Donald Trump. First one, then another, and then all of the herd followed last week:

“How did you go bankrupt?” Bill asked. “Two ways,” Mike said. “Gradually, then suddenly.”

Ernest Hemingway, “The Sun Also Rises”.

And just like that, Trump’s vast influence was neutered. This site makes the case that after years of hand-wringing, the tech giants took action simply because it had become clear that Trump no longer held political power:

For years Facebook and Twitter were unwilling to enforce their own rules against those inciting violence, in fear of upsetting a substantial part of their userbase… Not only is this [deplatformization] too little too late, but needs to be understood as an admission of complicity… Could it be that after the electoral shake-up what used to be an asset became a liability?

One of the mega trends we explore repeatedly on this site is that of Audience as Capital. You can’t discuss that trend without recognizing the fantastic power now held by social media companies which, if user bases were populations, would be the world’s largest countries:

  • Facebook itself: over 2.5 billion active users
  • Youtube: over 2 billion
  • Whatsapp (Facebook): over 2 billion
  • Instagram (Facebook): well over 1 billion
  • Wechat: ~1 billion
  • Tiktok: ~800 million
  • Twitter: ~300 million
  • Linkedin: over 300 million

Add to this Google Play Store with about 2.5 billion users on Android and Apple’s App Store with over 1.5 billion iOS devices controlling app distribution. They took the right-wing-dominated social network Parler offline.

Further add to this Amazon’s dominance of online commerce, Stripe’s of online payment acceptance, the decades-old Visa-Mastercard duopoly of payments processing [1], and Amazon AWS, Microsoft Azure and Google Cloud Platform’s cornering of the internet applications, including such basic internet plumbing as DNS. AWS took Parler’s infrastructure down too.

We have never before seen such global concentration of attention and distribution.

[1] Not to mention local leaders: China Unionpay and India’s Rupay

(Part 2: so what’s the future?)

(Featured Image Photo Credit: Willian Justen de Vasconcellos/Unsplash)

Categories
Data Custody Decentralisation and Neutrality Life Design Privacy and Anonymity Wellness when Always-On

The Custodial Internet

This New York Times article talks to people who own bitcoin but cannot access them because they’ve forgotten the keys to their bitcoin wallets. Some of these people have all but lost thousands of bitcoin, which are worth hundreds of millions of dollars today. I personally know someone who was gifted a hundred or so bitcoin when they were worth a dollar each, and has since been unable to recall how to access them.

The genius of bitcoin – and therefore the problem – is that has no issuer, like a central bank. Inherently, there is no equivalent of a bank account that holds bitcoin, and no bank that you can visit or call to have your password restored. It is as decentralised as the Internet is, and people have over and over extolled bitcoin as being able to be your own bank.

But one man’s freedom is another man’s overhead. As more people hold bitcoin and other cryptocurrency, they will turn to entities to manage it for them. Specialised cryptocurrency custodial services have existed for years now, and mainstream financial institutions like Fidelity already offers it. J P Morgan is seriously evaluating it; a solution from the 130 year old Northern Trust is pending approval. It’s likely that between new and old world financial entities, most cryptocurrency will be held in custody like more traditional securitised assets.

Digitally-native things are alike in this regard. You can own them if you like, but it’s a lot easier to have a third party hold them in custody for you.

Twenty years ago it was highly uncommon for the entity that gave you your email address to give you any sort of storage service for your email. You’d download your email to your computer through POP3 and it’d be wiped off the email provider’s servers . You truly owned your email – and were responsible for it. Today most people don’t even have a email client on their laptops or desktops, preferring to use web-based email with data stored entirely online. Even the email app on your phone doesn’t store all email offline, only the most recent. Your email provider is also your email custodian.

IRC messaging was similar. Many private/hobbyist IRC servers simply didn’t have the capacity to store chats. It was your IRC client stored chat logs offline, limited only by your computer’s hard drive size. But today, chat apps like Facebook Messenger and Whatsapp store chat logs entirely online, even if they claim they are end to end encrypted.

In the early days of digital cameras – the 1990s and 2000s, your photo library would exist solely on your hard drive. You had total control over the import and organisation of your photos – and consequently had total responsibility. My desktop machine crashed in 2008, leaving me with no photos from before that time – a terrible loss. Now, chances are you use either iCloud Photos or Google Photos for the massive amounts of photos your phone takes, and leave organisation to their AI while paying for online storage. They are your photo and memory custodians.

Finally, your documents, contacts, calendars all have online custodians, usually but not always Apple or Google. This is even though you could store them on your hard drive or self-host your sync server, it’s just too much work for most people.

Whether we realise it or not, whether we like it or not, we live in the Custodial Internet. We pay our custodians in cash or in data, often both.

Like people will doubtless do with bitcoin, we should evaluate custodians for our other data carefully. That data holds our relationships, our memories, our creative output, our wealth, our plans – in sum, our life.