Reddit's new privacy policy is bogus

53  2013-05-01 by LEGAL_FRAUD

So, here we are. May 15th a new privacy policy will be active that will allow Reddit to distribute our information to about anywhere.

Other extraordinary circumstances may require disclosure: we may also disclose your information when we believe it's necessary to prevent imminent and serious bodily harm to a person; to address fraud, security, or spam; or to protect our rights or property.

This will make it possible for them to just disclose your information without your consent or court order, no questions asked. This makes the entire privacy policy complete bogus. All the other points could be voided by this single line. Anything could be classified as one of these five 'categories', while two categories (security and spam) are the most easy void-subjects.

link to thread

They have all your posts, your messages and your upvotes (and e-mail, if you gave it) linked to your IP-address. That's a lot of information for someone to have.

42 comments

We need a site that is not owned by a Corporation but rather by the people that use it, a Cooperative effort to stop the Insanity.

Well that was reddit until they sold out.

if you want to pay for the bandwidth, be my guest. I imagine shit gets expensive when half of the 12-40 age demographic is hitting your website every day.

startup cost could be donated through the internet, easily

then the challenge of covering costs and finding large donors.

or better yet, start cooperative business's within the community.

the money is the problem and solution at the same time, half the battle is won if we get the thing going.

You make it sound nice and easy.

Step 1: Site code. Step 2: Ask for money. Step 3: ??? Step 4: Freedom!

Last time a conversation like that was had around these parts we saw two things happen:

  1. Reddit, Inc. was formed as a New York corporation and the reddit.com web service was moved from Condé Nast Digital's control to this new entity.

  2. All of the default and influential subreddits had significant changings of the guard amongst the moderation teams. These new moderation team members all advocated for stricter moderation to "clean up" the subreddits. New rules were implemented, all with similar open-ended clauses to the one demonstrated above by the OP, allowing for arbitrary interpretation and enforcement of the rules.

Advance Publications knows how much the web service reddit.com is worth. A billion page views a month is nothing to scoff at. We made this site successful, so successful in fact that it is no longer our website. We made someone else a ton of money and we misplaced our trust.

I don't know what they will do to bury the pleas of the rabble rousers this time, but we will see. Throwing a fictitious entity at us worked for almost exactly a year (1 year, 1.5 months) last time. Maybe a new privacy policy that actually protects our rights will shut us up for another year or two.

There is a reddit on the deep web...

http://redditqlrzb7rrsy.onion/

(You must be using the TOR browser bundle for this link to work)

What is it? Is it a site using the reddit code?

What is it?

It's an onion version of Reddit. You'll have to learn more about the deep web before you fully understand what's going on. You can start here, but I warn you it's best to get inside a virtual machine before you venture to far around onionland.

Is it a site using the reddit code?

I assume so.

Reddit inc. themselves could be hosting it I'm not sure. They seem to have the same privacy policy however it's an onion so everyone if forced to connect to it anonymously.

Why use a virtual machine? Can it do harm to a operating system?

The deep web is the wild west of the internet. It's filled with hackers, assassins, drug dealers, and human traffickers. Everyone there is anonymous and there aren't really any laws that they follow or even care to acknowledge. If someone was to set up a malicious website no one could do anything about it and you might not have any way of knowing a site is malicious. It best to browse them from within a virtual machine just to make sure.

yes, just like the most important thing in the world....means of exchange, they call it money....the second you let a private for profit company own your currency supply is the second you have no government....give me control of the currency, give me control of everything....

I assumed they always had this power. Its an online message board, just like how 4chan and Facebook compile with the FBI/law why wouldn't reddit. All they did was made this more clear in their outlined policy.

Edit: seems like its always been the same http://www.reddit.com/r/blog/comments/1dhw2j/reddits_privacy_policy_has_been_rewritten_from/c9qgomc

They just made the language simple to understand for laypersons, thus, the sudden outrage at something that has been there for quite a while

This was great and you're great.

http://www.youtube.com/watch?v=NIzyoKsWTA4

relax, just let the hooks do their work

what information do they really have?

See edit. It can be a lot of sensitive information for many.

You're not wrong about the IP address. Protect yourself, reddit is "somewhat friendly" to this.

Of course, in reality, this project is most likely nothing more than a confidence shield, since clearly TPTB would easily be able to see right through that fog. It does alleviate the reddit privacy issue, though.

10 day old account... Tor is a "confidence shield".... "see right through the fog"...

Lol, Ok.

it's a well known flaw that anyone operating multiple entry and exit nodes would be able to statistically correlate traffic information such that it effectively destroyts the anonymity offered by Tor. The ability to correlate such information growing with the number of simultaneous nodes in operation.

Now throw in TEMPEST, in LEO.

the NSA is inside your brain, making you stupider every minute. tick tock tick tock

Tor is not a "confidence shield" - it's exactly what it claims to be - an anonymous distributed IP tunnelling project. No one can easily see though it. It would take an incredible amount of international cooperation and research to be able to get meaningful information to trace tor traffic, and it would need to be in near realtime, because interconnections can change frequently.

If you're in any doubt about that Tor is open-source, you are welcome to research it yourself.

There are risks to using Tor, most notably that someone can possible capture your traffic on a Tor exit node (but HTTPS or other protocol encryption addresses that). But Tor itself is an entirely effective anonymiser that, by it's design, makes it effectively impossible for any party to determine the source IP address of any given connection.

it's a confidence shield if you don't know the NSA can see right through it.

Edit: wake up. 3DES/AES were broken before they were released, NSA could brute force them then, and they can do it in a fraction of the time now. There is no such thing as cryptography.

it's a confidence shield if you don't know the NSA can see right through it.

To be honest, if the NSA "broke" AES, they wouldn't use it. You know, probably due to the fact that it would be a liability waiting to happen.

NSA could brute force them then, and they can do it in a fraction of the time now.

[citation needed]

There is no such thing as cryptography.

Good to know that encryption like Blowfish doesn't exist. I wonder how the NSA's doing with their pile of bitcoins, since you know, cryptography doesn't work.

In 1976, NSA could bruteforce DES. This is clearly shown by their contribution to the cipher, which was to make the algorithm better while specifically demanding that the key size be reduced. This shows they were trying to take out any possible backdoor, and force everyone to brute force What that means, .is they were well aware that they had the highest CPU throughput on the planet. The actions in 1976 clearly show they could brute force the standard at 64 bits in 1976, probably nearly instantly.

Think about Moore's Law.

The strength of cryptography isn't the issue. Unless Tor embeds some sort of sidecar data about the source in traffic there's no way to track back to the origin unless you have access to every node the traffic has passed through. The Tor code is open source, you can review if for yourself and see that it doesn't have any such weakness.

Given that Tor routing changes regularly you'd also need to capture data from all implicated nodes at the same time to be able to get source information.

You don't need every node, only entry and exit nodes. you only need to correlate ip/port duples like any stateful firewall to perform the kind of analysis you are referring to

The entry node is the originating computer. To any other node on the route it's impossible to tell if the node upstream is the origin or just another intermediate node.

If you have control of the entry node then you already know where the traffic originated.

To any other node on the route it's impossible to tell if the node upstream is the origin or just another intermediate node.

Which is why statistical analysis is used based upon IP and port combinations. Once again, such data is received from the initial connection and the exit node (which is also like any other node out there).

http://lbpe.wikispaces.com/CryptographyWithLB102

tl;dr

"NSA: our MFLOPS are bigger than yours."

And if you really want to read into their actions:

"NSA: 1976 USSR can't break 48 bits."

Not sure what a BASIC implementation of DES is supposed to tell me?

PGP puts it best:

If the NSA were able to crack RSA or any of the other well known cryptographic algorithms, you would probably never hear about it from them. Now that RSA and the other algorithms are very widely used, it would be a very closely guarded secret.

The best defense against this is the fact the algorithms are known worldwide. There are many competent mathematicians and cryptographers outside the NSA and there is much research being done in the field right now. If any of them were to discover a hole in one of the algorithms, I'm sure that we would hear about it from them via a paper in one of the cryptography conferences. http://www.pgp.net/pgpnet/pgp-faq/pgp-faq-security-questions.html#security-against-nsa

Essentially most widespread cryptographic ciphers are very public. We know exactly as much about them as the NSA. Many very smart researchers devote a lot of time to understanding and breaking these ciphers. If they have weaknesses we'll hear about it.

The NSA has a lot more computing resources than us, for sure, but they are not infinite and even with those resources we can be reasonably assured that any brute force efforts would still take, at the very least, a decent amount of time and in some cases a really really really long time.

*adjusts tinfoil hat: Unless they have working quantum computers.

*takes off hat: I doubt they could keep that secret.

do you think the NSA doesn't have access to the brightest cryptographic minds out there?

what do you think it means to be a 'backdoor' in a cypher scheme?

you are a moron.

private companies have publicly brute forced DES in 22 hours.

WAKE UP

I'm not arguing about the crackability of DES. With a 56bit key it is low-hanging fruit. It's been largely retired for serious cryptography.

You said:

There is no such thing as cryptography

It think you're wrong. While DES may be vulnerable, even the small step up to Triple DES is a huge improvement.

A 128bit AES key, for example, is effectively unbreakable by brute force.

Cryptography exists.

So why did the nsa insist on smaller keys in 76?

DES != 3DES

With an Amazon GPU cluster I can break DES in a few hours as well. http://aws.amazon.com/hpc-applications/

NSA could do it in '76. Think about that.

Other extraordinary circumstances may require disclosure: we may also disclose your information when we believe it's necessary to prevent imminent and serious bodily harm to a person; to address fraud, security, or spam; or to protect our rights or property.

Several thoughts on this:

  • 1 All of our speculation about Boston Bombings opened some eyes at the Federal Level. "We done goofed" and totally missed it.

  • 2 How much do you want to make a bet the Feds could (and would if they needed to) link the bombers to live accounts on Reddit? They already said that the two boys were "Conspiracy Theorists".

Oddly enough just yesterday I was looking into GNU Privacy Guard encryption.

  • 3 CISPA has been stopped for now, however now they hit us where we live (post).

NSA could do it in '76. Think about that.