Never outsource security if you actually want security...
Never roll your own security if you actually want security, either. What are we supposed to do :).
Use one time pads
‘Every message was copied to the police’
21–30 of 193 posts
Re: ‘Every message was copied to the police’
#22> Now that the workings have been revealed, An0m is a trick that could surely never be repeated in the world of organised crime. The revelations will push criminals away from technology, even if it makes their work more laborious and slow-moving. I can imagine future organized crime information flows more closely resembling what was depicted in John Wick: a lot of secretaries and file clerks pushing paper around, usi…
That sounds like it would be a big win for law enforcement. If you can force your opponent to avoid some modern ways to communicate, you can put a big dent in their efficiency. It's possible that paranoia might lead to criminals avoiding even technology that they could be using safely, further slowing them down. An old fashioned system also seems like it would require more people, opening up more opportunities for hu…
Or they could learn to use Signal.
Properly installed (F-Droid) on off-the-shelf phones with fresh prepaid sims and OS updates disabled, it can be considered secure software against all but the most sophisticated adversaries.
Then, simply verify the handshake key for your contacts, and you can be sure there is no man in the middle attack. Rotate phone+sim every 2 months, while keeping the same "outside" number, say, a landline you control.
There are attacks against this too, but they are very noisy (modify all Signal binaries delivered to a certain area) or typically exceed the technical capabilities of run-of-the-mill agencies (exploit an OS zero day).
Re: ‘Every message was copied to the police’
#23Re: ‘Every message was copied to the police’
#24Never outsource security if you actually want security...
Never roll your own security if you actually want security, either. What are we supposed to do :).
I always took this as "you're not a domain expert so you'll get it wrong", with the implied corollary that if you actually _are_ a domain expert, then you know what you're doing. IOW, hire bonafide domain experts rather than trying to cheap out.
Re: ‘Every message was copied to the police’
#25There've been a number of earlier HN discusions of this story:
5 days ago, 31 points, 5 comments: The story of An0m Chat, Run by the Police https://news.ycombinator.com/item?id=28490871 https://www.theguardian.com/australia-news/2021/sep/11/insid...
3 months ago, 130 points, 62 comments: Why no-one in America was arrested as part of Operation Ironside https://news.ycombinator.com/item?id=27509550 https://www.abc.net.au/news/2021-06-15/no-one-in-america-arr...
3 months ago, 431 points, 350 comments: Australian Federal Police and FBI nab underworld figures using encrypted app https://www.abc.net.au/news/2021-06-08/fbi-afp-underworld-cr... https://news.ycombinator.com/item?id=27430508
3 months ago, 18 points, 5 comments: Hundreds arrested in global crime sting using messaging app https://www.bbc.com/news/world-57394831 https://news.ycombinator.com/item?id=27435467
Search also under "at0m", "operation ironside", and "operation trojan shield".
Re: ‘Every message was copied to the police’
#26Interesting thing about intercepting messages which are encrypted using modern encryption protocols like OTR is deniability. If a police installs MitM on a server, it can't cryptographically prove that messages were originating from criminals, not written themselves.
Re: ‘Every message was copied to the police’
#27Never outsource security if you actually want security...
Never roll your own security if you actually want security, either. What are we supposed to do :).
Why not both? Encrypt your message with your home grown encryption, then send it through standard TLS. Both would have to fail for the message to be revealed.
Sometimes when I'm wearing my tinfoil hat I wonder if the advice to avoid rolling your own crypto is a conspiracy. The powers that be want to maintain their backdoors, maybe? Probably not. Of course, it's definitely true that there are more attack vectors out there than an amateur can be aware of.
Re: ‘Every message was copied to the police’
#28These operations require justification. Wouldn't be surprised to find most of the supposed drugs to come from the same people who supposedly found them.
Re: ‘Every message was copied to the police’
#29Earlier quoted context omitted.
Never roll your own security if you actually want security, either. What are we supposed to do :).
Why not both? Encrypt your message with your home grown encryption, then send it through standard TLS. Both would have to fail for the message to be revealed. Sometimes when I'm wearing my tinfoil hat I wonder if the advice to avoid rolling your own crypto is a conspiracy. The powers that be want to maintain their backdoors, maybe? Probably not. Of course, it's definitely true that there are more attack vectors out t…
The main warning against rolling your own crypto is because you would (or would be tempted to) replace standard crypto with it.
Re: ‘Every message was copied to the police’
#30Interesting thing about intercepting messages which are encrypted using modern encryption protocols like OTR is deniability. If a police installs MitM on a server, it can't cryptographically prove that messages were originating from criminals, not written themselves.
True but it can be shown to be plausibly written by the defendant if there's no reasonable way the police could have known details without the message being intercepted.
For example:
"Hey Bill, I'm going to steal the car at 123 Anywhere Street on Thursday at 2 am."
Police then put a camera at 123 Anywhere St., and a reasonable juror would likely conclude there are two lines of legitimate evidence.