Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

What the CIA WikiLeaks Dump Tells Us: Encryption Works

nytimes.com

Post reply on HN
Print view View original

71–80 of 270 posts

Re: What the CIA WikiLeaks Dump Tells Us: Encryption Works

#71

Post by patrickaljord »

jfhcc wrote: post #36

It's possible defeating encryption is the responsibility of another top secret department whose work remains unleaked.

Breaking pgp like encryption would require a huge mathematical breakthrough in how prime numbers work and their discovery. It would also require unknown math geniuses to work for said secret department which is unlikely, most of the best mathematical geniuses are already known and tend to work at universities/public research/private research and publish their work there. Not saying this is impossible but it's really highly unlikely borderline crazy conspiracy.

Also, the fact that most governments tend to hack at the pre-encryption level and use social engineering to hack devices on encrypted networks kind of confirms they do not have the capability to break encryption.

Re: What the CIA WikiLeaks Dump Tells Us: Encryption Works

#72

Post by imaginenore »

andai wrote: post #70

Does anyone here have an air-gapped computer setup? I'm thinking of doing something with raspberry pi. I'm stuck at the part where it communicates (for my purposes, small amounts of ascii) with a non airgapped computer without using USB or networking. I'm thinking about giving both machines a little speaker and microphone and using high frequency pulses to transfer the text. Why, you may be wondering? 1. Airgapped sy…

If it's airgapped, how do you use it for communication?

Re: What the CIA WikiLeaks Dump Tells Us: Encryption Works

#73

Post by imaginenore »

benevol wrote: post #57
dromenkoning wrote: post #6

The article mentions WhatsApp multiple times as a service that successfully made the transition to end-to-end encryption, but it always seemed to me that this claim is rather meaningless when we don't have the possibility of auditing their source code.

> this claim is rather meaningless when we don't have the possibility of auditing their source code Open source is required not just for apps, but also for: - operating systems - drivers - firmware Then we can start to talk about privacy.

You forgot

- hardware

Re: What the CIA WikiLeaks Dump Tells Us: Encryption Works

#74

Post by imaginenore »

mjg59 wrote: post #11
dromenkoning wrote: post #6

The article mentions WhatsApp multiple times as a service that successfully made the transition to end-to-end encryption, but it always seemed to me that this claim is rather meaningless when we don't have the possibility of auditing their source code.

It's not hard to demonstrate that apps are performing end-to-end encryption even if you don't have access to the source code. Reverse engineering this stuff is really pretty straightforward.

It's much harder to demonstrate the app doesn't have a backdoor, or doesn't leak your data in some obscure way, or doesn't weaken the entropy when creating the keys.

Re: What the CIA WikiLeaks Dump Tells Us: Encryption Works

#75

Post by andai »

imaginenore wrote: post #72
andai wrote: post #70

Does anyone here have an air-gapped computer setup? I'm thinking of doing something with raspberry pi. I'm stuck at the part where it communicates (for my purposes, small amounts of ascii) with a non airgapped computer without using USB or networking. I'm thinking about giving both machines a little speaker and microphone and using high frequency pulses to transfer the text. Why, you may be wondering? 1. Airgapped sy…

If it's airgapped, how do you use it for communication?

I'm thinking about giving both machines a little speaker and microphone and using high frequency pulses to transfer the text. (modem)

I don't know enough about computer security to understand whether a specially crafted piece of morse code audio (transferred through actual sound waves) could be used as an exploit, but I'm leaning towards "implausible".

Re: What the CIA WikiLeaks Dump Tells Us: Encryption Works

#76

Post by corford »

homakov wrote: post #59
yellowapple wrote: post #54

Earlier quoted context omitted.

It also doesn't have to be a central authority, since "anyone" (meaning: anyone who can afford to operate a mailserver, which is actually a surprisingly-high number) can be such an authority for one's own mail.

Practically nobody is running own mail server these days. Email is extremely centralized

I still run my own for personal email (postfix + dovecot). Runs off a Linode VM atm and has no problem getting through to Gmail, Hotmail etc. users.

Re: What the CIA WikiLeaks Dump Tells Us: Encryption Works

#78

Post by icantdrive55 »

dromenkoning wrote: post #6

The article mentions WhatsApp multiple times as a service that successfully made the transition to end-to-end encryption, but it always seemed to me that this claim is rather meaningless when we don't have the possibility of auditing their source code.

From vault 7, "These techniques permit the CIA to bypass the encryption of WhatsApp, Signal, Telegram, Wiebo, Confide and Cloackman by hacking the "smart" phones that they run on and collecting audio and message traffic before encryption is applied."

1. O.k.--they are having a tough time with encryption--now. If they are intercepting information before the encryption, what's the point of encryption? (Yes--encryption is great, and we need it. It's just it doesn't seem like the CIA cares about it too much? We will need it for our everyday business.)

2. With the billions these Founders will make; how long will it be until they cave into threats by the CIA, NSA, IRS, etc., and just help the powers at be? "Here's the keys, or this is your backdoor. "I just don't want my meticulous life complicated." A poor man doesn't have anything to lose, so they might be the most trustworthy? (And don't tell me about morals. The successful founders have all bent the rules, or did something shady. You just need to dig. Yes--I'm stereotyping, and prove me wrong.)

3. An app, or hardware with real privacy will be hard to obtain.

4. A lot was redacted by Wikileaks. He redacted 10,000 spies. How do we know if he didn't redact information that would affect a IPO?

5. It used to be, "Don't trust a person with nothing to lose? For my seat, it's revered now, "Don't trust a 1 percenter who has a lot to lose." The government could make a Mennointe lose sleep at night with their shinagigans.

6. Yes--this is my dig at the "man". I don't believe 99.9% of them really care about their customers privacy. It's just grand standing. They care about money, and their lives, and maybe a few pet projects.

7. Assange has a lot of power at his fingertips. The only reason he hasen't been killed is they are scared.

8. Maybe the CIA shouldn't have computers at this point in history?

Re: What the CIA WikiLeaks Dump Tells Us: Encryption Works

#79

Post by hendzen »

andai wrote: post #67

I don't see any mention of quantum computers in here so I thought I'd mention: the NSA themselves are concerned that quantum computing will be a great threat to encryption in the near future. Keep in mind that the NSA and god knows who else are storing encrypted communications to break them later. Quantum computing will defeat RSA, DH, ECC, asymmetric crypto, but it will only weaken symmetric crypto (eg. AES) by a fa…

Symmetric encryption not being broken doesn't really help you if the encryption key has been exchanged using a (presumably quantum-breakable) form of asymmetric encryption. Most encryption in the wild works this way.

Re: What the CIA WikiLeaks Dump Tells Us: Encryption Works

#80

Post by praptak »

hendzen wrote: post #79
andai wrote: post #67

I don't see any mention of quantum computers in here so I thought I'd mention: the NSA themselves are concerned that quantum computing will be a great threat to encryption in the near future. Keep in mind that the NSA and god knows who else are storing encrypted communications to break them later. Quantum computing will defeat RSA, DH, ECC, asymmetric crypto, but it will only weaken symmetric crypto (eg. AES) by a fa…

Symmetric encryption not being broken doesn't really help you if the encryption key has been exchanged using a (presumably quantum-breakable) form of asymmetric encryption. Most encryption in the wild works this way.

One thing you could do is to exchange the keys in a nonstandard way. Phone or whatever. Obviously still breakable but at least not by a standard dragnet.
Post reply on HN