Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Judge Who Authorized Police Search of Privacy Activists Wasn't Told About Tor

thestranger.com

Post reply on HN
Print view View original

161–170 of 236 posts

Re: Judge Who Authorized Police Search of Privacy Activists Wasn't Told About Tor

#161

Post by matt_wulfeck »

ivanca wrote: post #140
downandout wrote: post #100

Earlier quoted context omitted.

Apparently, the National Center for Missing and Exploited Children provides ISPs with a hash database of known illegal images [1]. ISPs are then required by statute to notify the government when images with matching hashes cross their network [2]. [1] https://www.law.cornell.edu/uscode/text/18/2258C [2] https://www.law.cornell.edu/uscode/text/18/2258A

All you have to do is get access to that DB and then you have A1 blackmail material, ready to bury any enemy of yours, specially in America, specially if they have/deal-with children.

I know you're being facetious but seriously... what a way to easily ruin someone's life. This system needs reform.

Re: Judge Who Authorized Police Search of Privacy Activists Wasn't Told About Tor

#162

Post by SolarNet »

ivanca wrote: post #140
downandout wrote: post #100

Earlier quoted context omitted.

Apparently, the National Center for Missing and Exploited Children provides ISPs with a hash database of known illegal images [1]. ISPs are then required by statute to notify the government when images with matching hashes cross their network [2]. [1] https://www.law.cornell.edu/uscode/text/18/2258C [2] https://www.law.cornell.edu/uscode/text/18/2258A

All you have to do is get access to that DB and then you have A1 blackmail material, ready to bury any enemy of yours, specially in America, specially if they have/deal-with children.

I think, since it's a database of hashes, it's non-reversible. Access to the database gives you nothing but a way to detect the files, and even if a file happens to have the same hash (which would be exceedingly rare) it's easy to see that it's a false positive. Actually a pretty good win for cryptography in fighting the problem (as it doesn't require the illegal material to detect the illegal material - regardless of how irresponsible it is to have a concept of illegal information).

Re: Judge Who Authorized Police Search of Privacy Activists Wasn't Told About Tor

#164

Post by fareesh »

SolarNet wrote: post #162
ivanca wrote: post #140

Earlier quoted context omitted.

All you have to do is get access to that DB and then you have A1 blackmail material, ready to bury any enemy of yours, specially in America, specially if they have/deal-with children.

I think, since it's a database of hashes, it's non-reversible. Access to the database gives you nothing but a way to detect the files, and even if a file happens to have the same hash (which would be exceedingly rare) it's easy to see that it's a false positive. Actually a pretty good win for cryptography in fighting the problem (as it doesn't require the illegal material to detect the illegal material - regardless o…

If someone were to crop an arbitrary side of the image by 1-2 pixels would that defeat a system like this? Extending that thinking a bit further, would it be trivial to just build out an Apache extension like Google Pagespeed that sort of did this randomly?

Re: Judge Who Authorized Police Search of Privacy Activists Wasn't Told About Tor

#165

Post by davmre »

fareesh wrote: post #164
SolarNet wrote: post #162

Earlier quoted context omitted.

I think, since it's a database of hashes, it's non-reversible. Access to the database gives you nothing but a way to detect the files, and even if a file happens to have the same hash (which would be exceedingly rare) it's easy to see that it's a false positive. Actually a pretty good win for cryptography in fighting the problem (as it doesn't require the illegal material to detect the illegal material - regardless o…

If someone were to crop an arbitrary side of the image by 1-2 pixels would that defeat a system like this? Extending that thinking a bit further, would it be trivial to just build out an Apache extension like Google Pagespeed that sort of did this randomly?

"This hash is computed such that it is resistant to alterations in the image, including resizing and minor color alterations." (https://en.wikipedia.org/wiki/PhotoDNA)

Re: Judge Who Authorized Police Search of Privacy Activists Wasn't Told About Tor

#166

Post by click170 »

downandout wrote: post #100
walrus01 wrote: post #79

The warrant is ridiculous even without the tor part. Read pages #6 and #7. http://www.thestranger.com/images/blogimages/2016/04/08/1460... ISPs maintain hash values of known child porn files? Show me a single ISP in the Seattle area that runs any of its residential customer http traffic through a caching proxy that examines and hashes each file, I'll eat my shoe.

Apparently, the National Center for Missing and Exploited Children provides ISPs with a hash database of known illegal images [1]. ISPs are then required by statute to notify the government when images with matching hashes cross their network [2]. [1] https://www.law.cornell.edu/uscode/text/18/2258C [2] https://www.law.cornell.edu/uscode/text/18/2258A

I always assumed antivirus venders were given a copy of the list as well.

It's a way to scan millions of computers without the owners of those computers knowing they are even being checked. It's perfect.

It also begs the question can you get around detection by re-encoding the files so the hashes don't match?

Re: Judge Who Authorized Police Search of Privacy Activists Wasn't Told About Tor

#167

Post by vinay427 »

matt_wulfeck wrote: post #161
ivanca wrote: post #140

Earlier quoted context omitted.

All you have to do is get access to that DB and then you have A1 blackmail material, ready to bury any enemy of yours, specially in America, specially if they have/deal-with children.

I know you're being facetious but seriously... what a way to easily ruin someone's life. This system needs reform.

> what a way to easily ruin someone's life.

Isn't that what they're going for? I certainly haven't seen any signs of intent to correct or rehabilitate the convicted for many crimes. The Department of Corrections should just be called the Department of Punishment, in my opinion, though that's perhaps not as catchy.

Re: Judge Who Authorized Police Search of Privacy Activists Wasn't Told About Tor

#168

Post by fareesh »

davmre wrote: post #165
fareesh wrote: post #164

Earlier quoted context omitted.

If someone were to crop an arbitrary side of the image by 1-2 pixels would that defeat a system like this? Extending that thinking a bit further, would it be trivial to just build out an Apache extension like Google Pagespeed that sort of did this randomly?

"This hash is computed such that it is resistant to alterations in the image, including resizing and minor color alterations." ( https://en.wikipedia.org/wiki/PhotoDNA )

Thanks!

Re: Judge Who Authorized Police Search of Privacy Activists Wasn't Told About Tor

#169

Post by voxic11 »

fareesh wrote: post #164
SolarNet wrote: post #162

Earlier quoted context omitted.

I think, since it's a database of hashes, it's non-reversible. Access to the database gives you nothing but a way to detect the files, and even if a file happens to have the same hash (which would be exceedingly rare) it's easy to see that it's a false positive. Actually a pretty good win for cryptography in fighting the problem (as it doesn't require the illegal material to detect the illegal material - regardless o…

If someone were to crop an arbitrary side of the image by 1-2 pixels would that defeat a system like this? Extending that thinking a bit further, would it be trivial to just build out an Apache extension like Google Pagespeed that sort of did this randomly?

It not like a md5 hash. The hashing function is designed such that similar images will produce similar hashs. But yes if you modify it enough it will not match, you will have to modify it much more then just cropping though. They usually do very well with that.

Re: Judge Who Authorized Police Search of Privacy Activists Wasn't Told About Tor

#170

Post by wookasz »

derefr wrote: post #50
jobu wrote: post #11

Money quote in the last paragraph: "When we get into things like this," [Judge William Downing] said, "anonymizing stuff, that’s well over my head technologically, then it becomes very murky and hazy." That sounds to me like the judge likely wouldn't have known what a TOR node was if the police had told him these guys were running one. Technology isn't slowing down, so how can we make sure the law keeps up?

The judge wouldn't have known what a Tor node is—but that's not a bad thing. What he's saying here is that the facts as originally presented to him translated into a well-known "cached" judgement; but the facts as they actually were would require original thought and research on his part (and/or those of analysts working for the judge) to come to a decision. "Guy has child porn on his computer" has a clear-cut answer…

Judges don't decide cases. The jury does. Judges are there to lead the proceedings and instruct jurors in matters of the law. No evidence or facts exist outside the courtroom. Only what is stated in court can be considered. It is against the law for a juror to research an issue outside the courtroom.
Post reply on HN