Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

What the CIA WikiLeaks Dump Tells Us: Encryption Works

nytimes.com

Post reply on HN
Print view View original

181–190 of 270 posts

Re: What the CIA WikiLeaks Dump Tells Us: Encryption Works

#181

Post by geofft »

cJ0th wrote: post #180
andai wrote: post #67

I don't see any mention of quantum computers in here so I thought I'd mention: the NSA themselves are concerned that quantum computing will be a great threat to encryption in the near future. Keep in mind that the NSA and god knows who else are storing encrypted communications to break them later. Quantum computing will defeat RSA, DH, ECC, asymmetric crypto, but it will only weaken symmetric crypto (eg. AES) by a fa…

> Quantum computing will defeat RSA, DH, ECC, asymmetric crypto, but it will only weaken symmetric crypto (eg. AES) by a factor of two. That's quite a bummer. I finally managed to convince someone to use gpg and now I learn that this just makes sure your emails will be read/analyzed by anyone who has an interest in it in the future.

"anyone who has an interest in it in the future" is a very vague term. I'm confident lots of things will happen in crypto centuries after I die, but that's not in my threat model.

Re: What the CIA WikiLeaks Dump Tells Us: Encryption Works

#182

Post by geofft »

catshirt wrote: post #97
andai wrote: post #67

I don't see any mention of quantum computers in here so I thought I'd mention: the NSA themselves are concerned that quantum computing will be a great threat to encryption in the near future. Keep in mind that the NSA and god knows who else are storing encrypted communications to break them later. Quantum computing will defeat RSA, DH, ECC, asymmetric crypto, but it will only weaken symmetric crypto (eg. AES) by a fa…

> the NSA themselves are concerned that quantum computing will be a great threat to encryption in the near future. pardon my ignorance. but, isn't this an inevitability? not just a possibility?

It's a possibility that it'll be a great threat in the near future. Remember that Babbage's Analytical Engine was designed on paper in 1837, and nothing similar was constructed for over a century.

If it's not the near future, we might move to post-quantum algorithms (or quantum cryptography, a field almost entirely unrelated to classical cryptography which involves carefully moving entangled pairs of particles around) before quantum computers become any good at cryptanalyzing realistically-sized encryption algorithms.

Re: What the CIA WikiLeaks Dump Tells Us: Encryption Works

#183

Post by krrrh »

RubyPinch wrote: post #48
espeed wrote: post #17

Earlier quoted context omitted.

The Signal protocol ( https://en.wikipedia.org/wiki/Signal_Protocol ) has been vetted, and the code is online available to be audited: - Signal code: https://github.com/whispersystems/ Telegram has had known flaws, which have been discussed in part here: - Telegram protocol defeated. Authors are going to modify crypto-algorithm https://news.ycombinator.com/item?id=6948742 - A Crypto Challenge For The Telegram Develop…

How much of that Telegram info applies to anything in the last 2 years or so?

They still haven't open sourced the server afaik. The thing that is a problem with Telegram is that they market on their security, but it's not secure by default, or on group chats. Moreover, it stores chat histories, and if you add someone to a group chat they get access to the historical data. A lot of folks use it without thinking about this, or understanding the implications.

Re: What the CIA WikiLeaks Dump Tells Us: Encryption Works

#184

Post by matthewaveryusa »

Filligree wrote: post #158
y7 wrote: post #110

Earlier quoted context omitted.

True. Note that some "post-quantum" key exchange schemes already exist (based on lattice cryptography, for which there are no known poly-time quantum attacks), e.g. https://eprint.iacr.org/2015/1092 . But I haven't heard of it being used anywhere.

The sad truth is, until we've spent a lot more time analysing and attacking those algorithms, they aren't as secure as what we've got.

There's an extremely simple method which is to onion multiple algorithms. If you want to add the promised security features of a new algorithm that hasn't been battle-tested it's well worth the effort.

Re: What the CIA WikiLeaks Dump Tells Us: Encryption Works

#185

Post by geofft »

xg15 wrote: post #68
MarkMc wrote: post #37

Earlier quoted context omitted.

I think you are being too strict in your definition of 'secure'. 99.99% of devices run Android, iOS or Windows which are closed source and therefore not 'secure'. To me, security is not a binary property but rather a sliding scale. WhatsApp say they use end-to-end encryption and they have a strong financial incentive to be telling the truth. No hacker has demonstrated that WhatsApp are lying and the Wikileaks dump su…

> WhatsApp say they use end-to-end encryption and they have a strong financial incentive to be telling the truth. I'm not giving much to the various "whatsapp backdoor" allegations but I'm curious to why they'd have financial incentive to provide privacy. Most of their userbase likely still doesn't care about security and they do belong to Facebook - so if anything, they'd have a financial incentive not to use effect…

> Most of their userbase likely still doesn't care about security

Teen Vogue just suggested people should use WhatsApp instead of Snapchat because it does end-to-end crypto. I don't think it's true any more that the general public doesn't care about security, if it was ever true.

http://www.teenvogue.com/story/how-to-keep-messages-secure

Re: What the CIA WikiLeaks Dump Tells Us: Encryption Works

#186

Post by cJ0th »

geofft wrote: post #181
cJ0th wrote: post #180

Earlier quoted context omitted.

> Quantum computing will defeat RSA, DH, ECC, asymmetric crypto, but it will only weaken symmetric crypto (eg. AES) by a factor of two. That's quite a bummer. I finally managed to convince someone to use gpg and now I learn that this just makes sure your emails will be read/analyzed by anyone who has an interest in it in the future.

"anyone who has an interest in it in the future" is a very vague term. I'm confident lots of things will happen in crypto centuries after I die, but that's not in my threat model.

Neither do I care about what happens in a couple of centuries. My main worry is that in a somewhat foreseeable future data of electronic communications can be used to construct a model of how a society of interest works to a degree useful enough to attack/control it.

So it isn't necessarily about what I am communicating or to whom I talk but the fact that it seems impossible for society as a whole the hide the details of its functioning.

I viewed pgp/gpg as a tool that could counter this. Convincing people to use it would've been an uphill battle but there would have been a slim chance of succeeding to a useful degree.

Re: What the CIA WikiLeaks Dump Tells Us: Encryption Works

#187

Post by john61 »

xapata wrote: post #159
john61 wrote: post #151

Earlier quoted context omitted.

People in a single entity are by definition not independent.

In that sense, no one is independent. We've all got friends and family, or at least people we know. By definition, if you've heard of someone else's software, that person had a social network by which they distributed the software to you.

Social dependency is not binary. Developers in a company a much more dependent from each other and the boss, than reviewers of free software.

Re: What the CIA WikiLeaks Dump Tells Us: Encryption Works

#188

Post by astrange »

ekianjo wrote: post #60
oculusthrift wrote: post #28

Earlier quoted context omitted.

if the cia has to bypass it by hacking users phones it seems to apply the encryption itself is solid.

no. it means there are far easier ways to spy stuff, thats all.

Hacking an individual's phone isn't "easy". It means we've made everything else harder.

Re: What the CIA WikiLeaks Dump Tells Us: Encryption Works

#189

Post by sitkack »

andai wrote: post #75
imaginenore wrote: post #72

Earlier quoted context omitted.

If it's airgapped, how do you use it for communication?

I'm thinking about giving both machines a little speaker and microphone and using high frequency pulses to transfer the text. (modem) I don't know enough about computer security to understand whether a specially crafted piece of morse code audio (transferred through actual sound waves) could be used as an exploit, but I'm leaning towards "implausible".

Airgaps are not just the physical separation of systems, but also auditing and filtering of what goes on to the airgapped machine.

One can get many of the properties of an air gapped system by compartmentalizing ones activities. Only playing media in the media-vm, only surfing the web in the web-vm, and only doing banking and high security stuff in the security-vm. Many of these systems wouldn't need persistent storage. And each one has different requirements, for the VM doing banking one could remove the root certs for everything except the sites you care about. Each VM could be on its own VPN, for the security-vm one could choose a network exit that was closest to the desired endpoint.

Copying media files from a guest to the host would compromise the air gapped machine. The host should not do any general purpose computing and nor should there be an account with special administrator privileges.

Look at https://www.qubes-os.org/

Re: What the CIA WikiLeaks Dump Tells Us: Encryption Works

#190

Post by Traubenfuchs »

Does it? Maybe it's a huge false flag campaign.

You should always operate under the assumption that "they" can see everything they want to see on your internet connected device if they deem you important enough.

For example, what's with that one news story about government agencies being unable to break TrueCrypt. How did that get out? Sounds like a huge bullshit campaign to me, aimed at creating trust in TrueCrypt! (Yes thank you very much I know about VeraCrypt)

Post reply on HN