Forgot your password?
typodupeerror
Privacy Communications Government The Internet News

Berners-Lee Says No To Internet Snooping 113

Posted by timothy
from the and-what-does-this-guy-know? dept.
Jack Spine writes "The inventor of the World Wide Web has pointed out some of the dangers of deep packet inspection. Sir Tim said that ISPs 'snooping' on data was similar to the interception of mail. 'This is very important to me, as what is at stake is the integrity of the internet as a communications medium,' Berners-Lee said on Wednesday. TBL's comments come as the UK government is gearing up to intercept all web communications in the UK through the Intercept Modernisation Programme, and echo comments he made last year about Phorm."
This discussion has been archived. No new comments can be posted.

Berners-Lee Says No To Internet Snooping

Comments Filter:
  • by ericrost (1049312) on Wednesday March 11, 2009 @03:35PM (#27155747) Homepage Journal

    The inventor of the world wide what?

  • by CRCulver (715279) <crculver@christopherculver.com> on Wednesday March 11, 2009 @03:38PM (#27155787) Homepage
    I remember 10 years ago that every nerd had a PGP key and Schneier's Applied Cryptography [amazon.com] was a standard text for our crowd. Now, the majority of even the hard-core geeks no longer have much interest in encryption. Somewhere along the way we forgot that every step forward on the net demands a way to guarantee privacy. Berners-Lee might regret the lack of privacy now, but he and other luminaries weren't vocal enough about the need for encryption and lots of it.
    • Re: (Score:2, Interesting)

      by Anonymous Coward

      The promise of the internet is free and open data. Encryption is anti-everything the internet is about.

      The real death of the internet was ~10 years ago, when anonymous posting disappeared.

      • Re: (Score:2, Insightful)

        by Anonymous Coward

        Well that's the thing. Anonymous posting provided one form of security that's no longer feasibly available. Encryption allows better privacy. As more and more cultures/subcultures/thought-pattern-sharers participate on the web, conflicts and clashes are more and more likely to happen. Opportunistic encryption, as long as it is controllable, will make the web a mutual haven for all cultures. One community can keep their convos/files/culture to themselves, while others can still broadcast theirs. The he

      • by lenski (96498) on Wednesday March 11, 2009 @03:59PM (#27156163)

        the promise of the internet is free and open communications.

        What we do with our data is entirely up to us, and nobody else. Not "the government", not ISPs. This includes encrypting whatever is being transmitted.

        You may share any paper, report, program, comment that is yours to publish. Some communications using the Internet should be more like a phone conversation (before USAPATRIOT stupidity), in which a modicum of privacy is a reasonable presumption.

      • by ClosedSource (238333) on Wednesday March 11, 2009 @07:21PM (#27159133)

        "The promise of the internet is free and open data."

        I thought the promise of the internet was free porn.

        Seriously, it started as a government program and open and free communications was not the goal.

    • by icebike (68054) on Wednesday March 11, 2009 @03:48PM (#27155989)

      PGP keys only help with email.

      Far better to move the entire web to ONLY ssl based servers, (after fixing ssl of course).

      • Re: (Score:3, Informative)

        by Sloppy (14984)

        PGP keys only help with email.

        Far better to move the entire web to ONLY ssl based servers, (after fixing ssl of course).

        And the way to fix SSL, is to switch to using PGP keys [gnu.org].

    • by Creepy Crawler (680178) on Wednesday March 11, 2009 @03:49PM (#27156007)

      Where have YOU been living?

      1. I have _multiple_ active GPG keys. All Ubuntu has GPG on them by default.
      2. I use TOR regularly, which uses multiple levels of encryption.
      3. I use HTTPS sites regularly. Not the old dinky 40bit keys either.
      4. My filesystem on my laptops are encrypted via DM_CRYPT and Luks.
      5. Every machine I communicate with has SSH. Therefore, I also have encrypted data tunnels for everything.
      6. I use W.A.S.T.E.

      Yeah. That whole encryption thing died out a while back. Uh huh.

      • by FooAtWFU (699187) on Wednesday March 11, 2009 @03:52PM (#27156057) Homepage
        Weirdo.
        • by Creepy Crawler (680178) on Wednesday March 11, 2009 @04:04PM (#27156245)

          What do you mean "Weirdo"?

          Anybody that uses a Unix based system (BSD, Linux, Solaris) all use a variant of OpenSSH.
          Anybody that buys stuff on the net uses 128bit SSL.
          Even that child porn dude that's in the supreme court knew enough to use TrueCrypt.

          Or even another encryption used: WEP and WPA. There's 2 very standard, "non-weird" encryptions. They just arent terribly strong.

          • Apparently, you've turned off your sarcasm detector.

            • Ooh, a sarcasm detector. That's a real useful invention.
              • by xmundt (415364)

                Greetings and Salutations..
                Hum...this looks like an excellent proof of the observation that inability to detect sarcasm is an early sign of dimentia.
                          G,D, R
                          Dave Mundt

          • Re: (Score:3, Insightful)

            by hairyfeet (841228)

            And you just accidently hit on the reason why having that stuff can have you sent to PMITA prison. Did you catch it? Here I'll point it out-"Even that child porn dude that's in the supreme court knew enough to use TrueCrypt.". The simple facts are that law enforcement HATES encryption, because it means they have to bust their ass instead of running a simple scan for *.whatever. So I have no doubt you will see more and more prosecutors using "You know why he has that stuff and won't let us go through his fil

            • What you underlaid was the idea that encryption is just a "Big Red Flag" saying something good is in here. Well, of course. It all comes down to that idea of plausible deniablity.

              If you use full disk encryption, its to encrypt my business and personal information. You prepare this partition as if somebody will look at it. The FDE is "just for looks". On the FDE level, you have most of your computing environment. You have your games, function apps, system stuff, database with receipts and business purchases.

      • Where have YOU been living?

        1. I have _multiple_ active GPG keys. All Ubuntu has GPG on them by default. 2. I use TOR regularly, which uses multiple levels of encryption. 3. I use HTTPS sites regularly. Not the old dinky 40bit keys either. 4. My filesystem on my laptops are encrypted via DM_CRYPT and Luks. 5. Every machine I communicate with has SSH. Therefore, I also have encrypted data tunnels for everything. 6. I use W.A.S.T.E.

        Yeah. That whole encryption thing died out a while back. Uh huh.

        We Await Silent Tristero's Empire.

      • by knewter (62953)

        Is W.A.S.T.E. still under active dev? I used that thing for around a year after aol killed it in ~2003/4, and then me and my cousin stopped sharing files as frequently (really the only person I shared files with via WASTE)

      • by pilgrim23 (716938)
        Ha! I always send text written with an Enochian font (look it up) after first translating into Voynich script! Now if only I could figure out how to decode it I would be able to read this shopping list....
      • Wow, clearly your individual example shows that every human being in existence does exactly the same thing. You really showed the parent poster he's been living under a rock...
    • by 0100010001010011 (652467) on Wednesday March 11, 2009 @03:56PM (#27156123)

      Because most of us came to this realization: http://xkcd.com/538/ [xkcd.com] or the fact that 90% of it doesn't matter.

      All of my Tax documents and other financial stuff is on a 256-bit encrypted disk image. But why the hell do I need to encrypt the message to my mom about my Easter plans? Furthermore, how do I explain to someone that just learned to use a computer that Obama wants to know if it's going to be Ham or Turkey.

      And the last time I planned something big and illegal we sure as hell didn't EMAIL each other about it, we met in person. (3 friends of mine all worked at Taco Bell through High School. Summer before college we planned a heist of the flags off the top. I still have a flag I fly on Rugby trips with the Taco Bell Dog.)

      • by Red Flayer (890720) on Wednesday March 11, 2009 @04:15PM (#27156381) Journal

        Because most of us came to this realization: http://xkcd.com/538/ [xkcd.com] or the fact that 90% of it doesn't matter.

        The problem with the xkcd cartoon is that it only applies if whoever wants your information knows that you have it.

        The point of general encryption is that fishing expeditions are impossible... so the "juicy" stuff that would warrant attention from the powers that be is hidden in the morass of all the other encrypted data.

        Yes, a ten-dollar hammer can be used to get my keys from me... but how do you know I've got the goods if you've never been able to read anyone's data?

        • by houghi (78078)

          Yes, a ten-dollar hammer can be used to get my keys from me... but how do you know I've got the goods if you've never been able to read anyone's data?

          I hit the guy who gave you the goods with a ten-dollar hammer.

        • by Anonymous Coward

          but how do you know I've got the goods if you've never been able to read anyone's data?

          Just another use for a ten dollar hammer. Only people with something to hide use encryption and those packet headers weren't pointing to amazon.com. So that makes you a suspect and the shmuck at the other endpoint too.

          People tend to forget how much 'intelligence' can be gleaned from communications even though the content of the communications are encrypted. It doesn't take deep packet inspection to map interrelationships

      • by TrekkieGod (627867) on Wednesday March 11, 2009 @04:24PM (#27156509) Homepage Journal

        Because most of us came to this realization: http://xkcd.com/538/ [xkcd.com] or the fact that 90% of it doesn't matter.

        All of my Tax documents and other financial stuff is on a 256-bit encrypted disk image. But why the hell do I need to encrypt the message to my mom about my Easter plans?

        Because if somebody's watching you send all those messages to your mom about Easter plans and then suddenly see encrypted traffic, they're going to know that the encrypted traffic must have been special and then come after you with the wrench?

        • by 0100010001010011 (652467) on Wednesday March 11, 2009 @04:34PM (#27156657)

          The world has moved beyond simply sending encrypted e-mails back and forth. Steganography, torrents, tor, etc.

          If I REALLY wanted to coordinate killing the president or something big. I'd probably use YouTube or Craigslist where the Signal to Noise is infinitely small. I'd embed an encrypted stegano message inside video of a guy lighting farts on fire or 'casual encounter' ad. Heck, put up some eBay listings with big pictures. How do you know that latest version of Heroes you downloaded from Bit Torrent doesn't have a 5MB image embedded in it with the President's route on some foreign trip?

          How about those Spam messages that look like a ton of gibberish, do you know they're not some secret code?

          I'm sure if a few Slashdoters put their minds to it, they could come up with a bit more ingenious ways of sending messages than 'plain text' encrypted PGP e-mails.

          The next terrorist isn't going to suddenly start sending encrypted messages from a normal account.

          • by tsotha (720379)
            Bah. The Secret Service has a pretty easy job for the next four years. The president has the ultimate assassination insurance - Joe Biden.
          • by AmiMoJo (196126)

            Actually, there is a much easier way to defeat what the UK government is planning to do. The key is that they require the ISPs to do all the logging, so if you run your own SMTP server or use one in a safe country (e.g. Russia) they they don't get to monitor you.

            Sure, your communications are not encrypted, but most people don't have PGP and wouldn't know how to use it anyway. It also breaks web mail (now there's a feature I'd like to see for gmail, don't know how it would work securely though). If you use T

      • Re: (Score:2, Interesting)

        by broken_chaos (1188549)

        Encryption works for very important data (that you would die to protect), less important data transferred over a network (moderately important e-mails), and unimportant data as a form of misdirection (if everything is encrypted, no one can tell what's important or not).

        Full disk encryption, while nice, is not a protection for your data from someone who really wants it, unless you will die to protect it. It is protection from casual thieves for things like passwords, credit card data, personal information (y

      • by Sloppy (14984) on Wednesday March 11, 2009 @05:05PM (#27157127) Homepage Journal

        A lot of very foolish people have overgeneralized the point of that cartoon.

        The $5 wrench attack does work to defeat encryption, but it only works when someone is specifically interested in you.

        The bad guys cannot put a $5 wrench on the backbone and slurp up everything. The only way they can do that, is if people agree to not encrypt.

        If you encrypt, you defeat massive-scale surveillance. And you are not defeating a theoretical attack; you're not even defeating a plausible attack. You defeat an attack that the US government is known to be using.

        You don't need to read phrack or 2600 to know about this; read the New York Times or turn on your TV and watch Frontline. Get your head out of the sand.

        • by severoon (536737)

          If I suddenly had a need to send something encrypted, but I didn't want it to appear encrypted, I would take the encrypted block and bury it steganographically in an image attached to the email, an image relevant to the innocuous message about Easter dinner that is in the body of the message...like a picture of a ham or something.

          In fact, I suspect that most of the innocuous-looking traffic that's flying around the web right now is actually bearing a different encrypted message to the intended recipient as

          • by Sloppy (14984)

            If I suddenly had a need to send something encrypted, but I didn't want it to appear encrypted, I would..

            You've already lost me at the premise. Why wouldn't you want it to appear encrypted? Ideally, everything you ever do should be encrypted.

            How do we know everyone's not already encrypting everything worthy of being encrypted?

            That's really obvious: Because some people are still using plaintext for some things, and some people (such as Berners-Lee) are complaining about internet snooping.

            When you forwa

      • by Sloppy (14984) on Wednesday March 11, 2009 @05:12PM (#27157239) Homepage Journal

        But why the hell do I need to encrypt the message to my mom about my Easter plans?

        Because I might be looking for houses to burgle on Easter.

        Because privacy should be the default. Instead of asking why your plans should be secret, ask why your plans should be public. It's just as legitimate of a question.

        And the last time I planned something big and illegal we sure as hell didn't EMAIL each other about it, we met in person.

        Good for you. But there's more to life than planning crimes, and there are other threats than government law enforcement (they just happen to be the most high-profile). I know some people think that the only purpose of the internet is for pedophiles to trade porn, but really, people do have other uses for it. Most of those uses are nobody else's business. If you wanted the world to know your Easter plans, you could have posted them to Usenet. Instead, you chose email.

      • And the last time I planned something big and illegal we sure as hell didn't EMAIL each other about it, we met in person. (3 friends of mine all worked at Taco Bell through High School. Summer before college we planned a heist of the flags off the top. I still have a flag I fly on Rugby trips with the Taco Bell Dog.)

        Even better, you posted about it on Slashdot!

      • by kinnell (607819)

        But why the hell do I need to encrypt the message to my mom about my Easter plans?

        For the same reason people feel the need to send most written letters in envelopes rather than on postcards.

      • And the last time I planned something big and illegal we sure as hell didn't EMAIL each other about it, we met in person. (3 friends of mine all worked at Taco Bell through High School. Summer before college we planned a heist of the flags off the top. I still have a flag I fly on Rugby trips with the Taco Bell Dog.)

        But then you posted it on the net bragging about it... so you just technically submitted your confession. Let's hope this doesn't bite you in the ass now. Even if it does, maybe then you will understand a few things a bit better.

    • by schwaang (667808) on Wednesday March 11, 2009 @04:16PM (#27156403)

      Encryption gives a sometimes false sense of security, and the technology is a hassle. It's better to reinforce societal expectations for privacy where it is due, and let social mechanisms (like laws and market reputation) do the job.

      Consider e.g. that if you use https from your workplace and see the happy little lock icon in FF or IE, you probably feel safe.

      But some workplaces insert a proxy in between you and gmail (or what have you), having stuffed the proxy's certificate on your (their) work machine through local policy. Unbeknownst to you, your employer then sees the communication which you thought was totally private. Now imagine if an ISP could do that and get away with it.

      The point is that even if you do *care*, the technology is hard to keep track of, and there is an arms-race ladder of one-upmanship that makes this a never-ending game, which some nerds can win, and most of us will lose.

      What will really keep you safe is to stand up for a reasonable expectation of privacy where it should exist, and create norms and laws that protect this. Saying "NO" to Phorm or other invasions by ISPs is part of that approach, and creates legal and commercial consequences that are more effective than asking every grandma to mess with PGP.

    • Re: (Score:3, Insightful)

      by Lord Ender (156273)

      Key exchange is hard.

      If we had signed DNS, and DNS started distributing X.509 certificates ("type CERT queries"), then secure email really would hit the mainstream.

    • by Sloppy (14984) on Wednesday March 11, 2009 @04:51PM (#27156905) Homepage Journal

      Now, the majority of even the hard-core geeks no longer have much interest in encryption.

      Then they're not hard-core geeks.

      Geez, they're not even soft-core geeks. In December 2005, paranoid what-if rants about theoretical risks, became mainstream knowledge. If you're awake (geek or not), you know we have to start encrypting.

    • Re: (Score:3, Interesting)

      We never went anywhere. I still read Applied Cryptography from time to time. I also:

      • Run a private XMPP server for me and my girlfriend which only accepts SSL connections.
      • Operate a tor exit.
      • Attach a PGP signature to every e-mail I send.
      • Still think anonymous digital cash schemes are a really cool idea.

      The problem is mostly that there are so few other people who seem to care. I send a digital signature on every e-mail, but as far as I know no one ever verifies it. I've sent and received maybe two *enc

    • by chappel (1069900)

      I've played around with FireGPG to encrypt gmail via firefox, and it's pretty cool, but I've been really disappointed at the total lack of gpg/pgp client software for 'smart' phones - I've got a work issued Blackberry with no gpg options, and I haven't had any luck finding anything that will run on an iPhone or android, either. What's up with that? Anybody know of a way to encrypt gmail (or anything else, for that matter) on a smartphone? I love 'email in my pocket' and would gladly start encrypting most

  • by Anonymous Coward

    Encrypt everything. Even if you have no reason to, encrypt everything, because someday it might bite you in the ass.

    • by Shakrai (717556)

      Even if you have no reason to, encrypt everything, because someday it might bite you in the ass.

      Like when you forget your encryption key ;)

    • Re: (Score:2, Funny)

      Yeah, I used to do this...

      Then I lost the key due to a hard drive and floppy disk failure within the same week (wow, that dates this a bit...)

      Now I have these wonderful encrypted documents that contain proof of alien intervention with the history of our planet and I can't get at it anymore...

      D*MN YOU GRAYS!!!

      --
      I drank what?

    • by Obfuscant (592200) on Wednesday March 11, 2009 @04:11PM (#27156347)
      Not because it will bite you in the ass, but because by encrypting everything you 1) give them more stuff to look at and if they are looking at you they aren't looking at me, and 2) it won't be obvious that you are trying to hide something when you DO encrypt that particularly incriminating file. They'll have to spend time decrypting your email to Mom as well as the picture of cousin Julie when she was 4.
    • Re: (Score:3, Interesting)

      by element-o.p. (939033)
      I'd encrypt everything simply to protest the big-brother mentality that seems to be taking over here in the U.S. >:]
  • by MarkvW (1037596) on Wednesday March 11, 2009 @03:51PM (#27156037)

    Which side are you on: CONTROL or KAOS? That is the question. The Government can only answer that question if it can intercept your communications. Are you going to let them? Can you stop them? Do you care?

    All I can say is that you should Get Smart!

  • This is good (Score:5, Insightful)

    by damburger (981828) on Wednesday March 11, 2009 @03:54PM (#27156089)

    People like Sir Tim need to speak out on such issues, because their contributions to science and technology are touted by our leaders as 'proof' of Britain being a modern, forward thinking society - rather than the withered, reactionary, largely technophobic old empire we in fact are.

  • Is normal paper mail 'snooped' nowadays? Big box mail usually is, but envelopes? Sensible question, but if it is... in that sense snooping packets would make sense.
  • by a2wflc (705508) on Wednesday March 11, 2009 @04:24PM (#27156503)

    When governments start snooping on everything they make it harder to snoop on criminals in the future. This makes lots more people want secure networks, which makes more people create tools to make it easy to send/receive encrypted data, which makes even the people who don't know about the issues aware of the issues and tools. Once the tools/protocols become normal, police won't be able to snoop on suspected criminals even with a court order because everything is encrypted.

    That'll just make them pass more laws and restrict ISPs so that unsnoopable content isn't allowed. Which will make people start creating stenogrphy tools so things look snoopable, which will make other people aware of the issues and wonder why the gov't is so concerned and start using them.

    Then people start using those tools and snooping becomes more expensive (trying to detect stenogaphy) and still useless. But it will get lots of otherwise innocent people in trouble for using encryption or stenography to do something unimportant like send email to their mother.

    If police stick to treating everyone as innocent until they had a valid reason to think otherwise and then got a court order they will have a lot more ability to snoop in the future.

  • by Anonymous Coward

    >> Sir Tim said that ISPs 'snooping' on data was similar to the interception of mail

    Actually, if you think about it, the Post Office also ask about the _type_ of content in your mail: document (letter) ? CD/books ? or fire arms ? ;-)

    i admit Post office does not read the words in your letter.

  • Everyone knows Al Gore invented the www. ~:-)
  • by Anonymous Coward

    Sir Tim, posted his personal view to #swig on irc.freenode.net [1]

    http://www.w3.org/DesignIssues/NoSnooping.html

    [1] http://swig.xmlhack.com/2009/03/11/2009-03-11.html#1236787895.276276

  • What Al Gore thinks of this.
  • The internet then defiantly turned around and screamed, "YES!"
  • Even thinking that this is reasonable is amazingly foolish. If you are concerned that Internet snooping is a problem, then the solution isn't to demand that it not take place. The solution is to nullify it. You can only be assured that it won't happen if it cannot (technically) reasonably happen.
  • Good to see Slashdot has finally picked this up. I sent them the press release about the event last week and as one of the organisers of the event and founder of NoDPI.Org I am pleased to say the event went incredibly well and the press coverage has been amazing. Now would be a good time for people in the UK to write to their MP's directly to discuss the event and make it clear to them that you expect them to research the issue for the purpose of parliamentary debate or you will not be voting for them in
  • So does anybody believe they don't already do that here in the U.S.A?

You will lose an important disk file.

Working...