Black Hat
1 HN recommender · recommended in 16 months, 2014–2023
54:35 · 65K views · Aug 8, 2014
Dan Geer's Black Hat 2014 keynote argues that cybersecurity is a matter of power and policy rather than wishful thinking. He covers surveillance, the vulnerability market, software liability and privacy as the capacity to misrepresent yourself.
Cited over and over as an important talk, with commenters borrowing its ideas on cheap surveillance, offense-favoring security and liability.
19 comments from Hacker News
> Obfuscation may be our best digital weapon. From Dan Geer's talk "Cybersecurity as Realpolitik" (which everyone should hear[1]/read[2]): >> There are so many technologies now that power observation and identification of the individual at a distance. They may not yet be in your pocket or on your dashboard or embedded in all your smoke detectors, but that is only a matter of time. Your digital exhaust is unique hence it identifies. Pooling everyone's digital exhaust also characterizes how you differ from normal. Privacy used to be proportional to that which it is impossible to observe or that which can be observed but not identified. No more -- what is today observable and identifiable kills both privacy as impossible-to-observe and privacy as impossible-to-identify, so what might be an alternative? If you are an optimist or an apparatchik, then your answer will tend toward rules of data procedure administered by a government you trust or control. If you are a pessimist or a hacker/maker, then your answer will tend towards the operational, and your definition of a state of privacy will be my definition: the effective capacity to misrepresent yourself . >> Misrepresentation is using disinformation to frustrate data fusion on the part of whomever it is that is watching you. Some of it can be low-tech, such as misrepresentation by paying your therapist in cash under an assumed name. Misrepresentation means arming yourself not at Walmart but in living rooms. Misrepresentation mea
All it takes is metadata . The "digital exhaust" we leave behind is extremely revealing. I usually use COTRAVELER as my example of how just a few data points (without any PII) can reveal a LOT about your social interactions, but browser history is another powerful data source. I believe this is why Dan Geer, in his incredible talk last year[1], suggested that "privacy" should now be defined as "the effective capacity to misrepresent yourself". To avoid exactly the type of analysis, you need the capability to misrepresent yourself, and you need to regularly be in the habit of use use that capability. Misrepresentation is using disinformation to frustrate data fusion on the part of whomever it is that is watching you. Some of it can be low-tech, such as misrepresentation by paying your therapist in cash under an assumed name. Misrepresentation means arming yourself not at Walmart but in living rooms. Misrepresentation means swapping affinity cards at random with like-minded folks. Misrepresentation means keeping an inventory of misconfigured webservers to proxy through. Misrepresentation means putting a motor-generator between you and the Smart Grid. Misrepresentation means using Tor for no reason at all. Misrepresentation means hiding in plain sight when there is nowhere else to hide. Misrepresentation means having not one digital identity that you cherish, burnish, and protect, but having as many as you can. [1] this video [LINK]
Dan Geer at his important talk at Black Hat: The central dynamic internal to government is, and always has been, that the only way for either the Executive or the Legislature to control the many sub-units of government is by way of how much money they can hand out. [...] Suppose, however, that surveillance becomes too cheap to meter, that is to say too cheap to limit through budgetary processes. Does that lessen the power of the Legislature more, or the power of the Executive more? I think that ever-cheaper surveillance substantially changes the balance of power in favor of the Executive and away from the Legislature. While President Obama was referring to something else when he said "I've Got A Pen And I've Got A Phone," he was speaking to exactly this idea -- things that need no appropriations are outside the system of checks and balances. this video [LINK] While Congress has been occupied with infighting and stupid political theater, the Executive branch has been taking a lot of their power. Is it "making war" when Congress is clearly abdicating their responsibilities? It has certainly done more damage to the country than any army has ever accomplished.
Y Not - Adventures in Functional Programming by Jim Weirich [LINK] The Coming Civil War over General Purpose Computing by Cory Doctorow [LINK] Cybersecurity as Realpolitik by Dan Geer this video [LINK]
From your other posts you seem to have a very good sense of social responsibility, so I'm surprised at this comment. Multiple identities are incredibly important to anybody in a minority that is threatened by their local mainstream culture. Black people in may areas (even today), gay or lesbian people in many parts of the world, and trans people just about anywhere[1] are some obvious examples. There are numerous others, which bring varying amounts of risk if exposed publicly. These people are often forced to put on a facade when in public, to avoid the risk of being fired (only a few of these are protected classes), beaten, or even killed. The internet has created a space where these people can be themselves... as long as it doesn't connect back to their real name and identity. Yes, leaving a job is a good way to avoid a bigoted manager, but that isn't an option for everybody. Your boss isn't the only threat, either: it wasn't that long ago that being openly gay could get you lynched in some areas. This comes down to the basic concept of privacy. I recommend Dan Geer's definition[2] of privacy in light of modern technology: Privacy used to be proportional to that which it is impossible to observe or that which can be observed but not identified. No more -- what is today observable and identifiable kills both privacy as impossible-to-observe and privacy as impossible-to-identify, so what might be an alternative? If you are an optimist or an apparatchik, then your answer will