Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

CIA’s Latest Layer: An Onion Site

cia.gov

Post reply on HN
Print view View original

31–40 of 147 posts

Re: CIA’s Latest Layer: An Onion Site

#31

Post by tgragnato »

cyphar wrote: post #16
peteretep wrote: post #8

> ciadotgov4sjwlzihbbgxnqg3xiyrg7so2r2o3lt5wz5ypk4sxyjstad.onion How does one store links like this? You'd need a bookmark file, which would sort of give the game away, I'd have thought. How do you make sure you notice when you visit a URL with the same readable prefix?

This is an unfortunate downside of onion URLs and a restriction imposed by Zooko's triangle (the CAP theorem of naming systems)[1]. One possible solution would be to issue a TLS certificates for both the clear-web and .onion domain (for services which are offering .onion services to provide better anonymity for users not their servers). Unfortunately, the CAB forum has decided to not allow this -- only EV certificate…

I was looking for the name of the CAP theorem, thanks for posting this!

HN discussed (https://news.ycombinator.com/item?id=14038013) about the issue and the post (https://blog.torproject.org/cooking-onions-names-your-onions) outlines some of the ways in which you can mitigate right now.

Cloudflare is using the 'alt-svc' header (https://blog.cloudflare.com/cloudflare-onion-service/).. The CIA is not, I'd have loved it.

curl -I https://www.cia.gov/index.html HTTP/1.1 200 OK Accept-Ranges: bytes Content-Type: text/html ETag: "" Last-Modified: Tue, 28 May 2019 15:05:25 GMT Content-Length: ID: SESSION: Date: Thu, 30 May 2019 12:36 GMT Connection: keep-alive Set-Cookie: _session_=; path=/; domain=cia.gov; secure; HttpOnly ID: SESSION:

Re: CIA’s Latest Layer: An Onion Site

#32

Post by stallmanite »

theonemind wrote: post #14
vowelless wrote: post #2

I have a question for the HN audience. Many here have gone to top schools and studied crypto, ML, etc with the best. And are probably the best in their field. Do you currently work for any three letter agencies? Did your smartest colleagues go to work at three letter agencies? I am trying to gauge the quality of talent at CIA, NSA, FBI, etc. All of my best colleagues went to the private sector, usually tech or securi…

A bit off topic, but I worked with someone who interviewed with the NSA, got a job offer and declined the job. The funny part is that he has a 100% chance of getting “randomly” selected for search every time he takes a plane.

Hmm so if you don’t accept you’ll be harassed? Sounds like a disincentive to even applying.

Re: CIA’s Latest Layer: An Onion Site

#34

Post by dragonwriter »

edoo wrote: post #20
mruts wrote: post #15

Earlier quoted context omitted.

One of my best friends worked at the NSA, then the CIA. Smart guy. Unfortunately he got charged for Vault7 leaks and is going to spend the rest of his life in jail. So, in short, don’t work for them. It might seem cool, but it’s not worth it. If they don’t like you, they’ll fuck you.

How do you get charged for leaks if you weren't the leaker?

How do you get charged with any crime without being guilty? It's not that uncommon an occurrence.

Re: CIA’s Latest Layer: An Onion Site

#35

Post by lallysingh »

edoo wrote: post #20
mruts wrote: post #15

Earlier quoted context omitted.

One of my best friends worked at the NSA, then the CIA. Smart guy. Unfortunately he got charged for Vault7 leaks and is going to spend the rest of his life in jail. So, in short, don’t work for them. It might seem cool, but it’s not worth it. If they don’t like you, they’ll fuck you.

How do you get charged for leaks if you weren't the leaker?

Be on the list of people who have access and be the least lucky on it.

Re: CIA’s Latest Layer: An Onion Site

#37

Post by scottLobster »

edoo wrote: post #20
mruts wrote: post #15

Earlier quoted context omitted.

One of my best friends worked at the NSA, then the CIA. Smart guy. Unfortunately he got charged for Vault7 leaks and is going to spend the rest of his life in jail. So, in short, don’t work for them. It might seem cool, but it’s not worth it. If they don’t like you, they’ll fuck you.

How do you get charged for leaks if you weren't the leaker?

Collusion with the leaker probably

Re: CIA’s Latest Layer: An Onion Site

#38

Post by hanniabu »

peteretep wrote: post #8

> ciadotgov4sjwlzihbbgxnqg3xiyrg7so2r2o3lt5wz5ypk4sxyjstad.onion How does one store links like this? You'd need a bookmark file, which would sort of give the game away, I'd have thought. How do you make sure you notice when you visit a URL with the same readable prefix?

Would be cool if there were QR code-like images but with a sliced onion and it uses the pattern of the veins to decrypt it.

Re: CIA’s Latest Layer: An Onion Site

#39

Post by peteretep »

GordonS wrote: post #28
peteretep wrote: post #8

> ciadotgov4sjwlzihbbgxnqg3xiyrg7so2r2o3lt5wz5ypk4sxyjstad.onion How does one store links like this? You'd need a bookmark file, which would sort of give the game away, I'd have thought. How do you make sure you notice when you visit a URL with the same readable prefix?

Password safe seems like a good idea, especially since you'll quote likely want to store credentials for the site anyway.

Yeah, fair enough. I guess I'd feel like that removes any deniability though, where you can remember credentials.

Re: CIA’s Latest Layer: An Onion Site

#40

Post by yazan94 »

stallmanite wrote: post #32
theonemind wrote: post #14

Earlier quoted context omitted.

A bit off topic, but I worked with someone who interviewed with the NSA, got a job offer and declined the job. The funny part is that he has a 100% chance of getting “randomly” selected for search every time he takes a plane.

Hmm so if you don’t accept you’ll be harassed? Sounds like a disincentive to even applying.

I think they are referring to that candidate's ethnicity
Post reply on HN