How to Leak to the Press • Hacker News Board

Re: How to Leak to the Press

#41

Post by saalweachter » Fri, Jun 07, 2013, 2:05 PM UTC

dsleno wrote: post #30

jusben1369 wrote: post #16

Earlier quoted context omitted.

The bigger point is that journalists usually need to go back and forth with you.

Tell the reporter to mail you at Mailinator or Lockbin.com and retrieve their messages by connecting with TOR.

Or tell the reporter to take out a classified ad in a free, public paper distributed in the nearest large metropolitan area.

The communications from the reporter don't need to be private or targeted. Everyone will know he's involved when he publishes, and he can reasonably encode questions by referring to the documents already sent. "MR X, CAN YOU PROVIDE FURTHER INFORMATION ON THE EVENTS DISCUSSED ON PAGE 13."

Re: How to Leak to the Press

#42

Post by hawleyal » Fri, Jun 07, 2013, 2:06 PM UTC

irrationalidiom wrote: post #3

This advice is dangerous, because the author fails to mention other precautions the user can and should take, such as: * Use a Linux live CD on the "burner laptop" -- don't trust the preinstalled OS * Change the MAC address of the Wifi used to connect at the internet cafe * Use Tor, most easily via the Vidalia browser bundle The author also does not mention that leaking documents can expose the whistleblower via wate…

Agreed. The author obviously knows little about opsec.

Re: How to Leak to the Press

#43

Post by mtgx » Fri, Jun 07, 2013, 2:12 PM UTC

What about "simply" using DeadDrop?

http://deaddrop.github.io

http://www.newyorker.com/online/blogs/closeread/2013/05/intr...

Or Retroshare:

http://retroshare.sourceforge.net

https://retroshareteam.wordpress.com/2012/12/28/cryptography...

https://retroshareteam.wordpress.com/2013/01/06/privacy-on-t...

Re: How to Leak to the Press

#44

Post by brown9-2 » Fri, Jun 07, 2013, 2:16 PM UTC

digitalengineer wrote: post #15

codeulike wrote: post #8

Earlier quoted context omitted.

Although, first comment on the new yorker post is a good explanation of why StrongBox might not be enough http://fyre.it/i3tCXN.4

Clicking on the comments link does not reveal any comments. I'm getting a "Subscribe now to get more of The New Yorker's signature mix of politics, culture, and the arts. "

Screenshot: http://cl.ly/image/0P2C0z013h43

Re: How to Leak to the Press

#45

Post by steveklabnik » Fri, Jun 07, 2013, 2:17 PM UTC

anonyfuss wrote: post #40

steveklabnik wrote: post #37

Earlier quoted context omitted.

This is where the 'many eyes' things comes into play; if the whole distro is OSS, then you can be pretty sure that it's good.

Most people never review source code, and they certainly don't disassemble and review all the binaries. 'Many eyes' is a security fallacy in cases like this.

Tails is ridiculously well known; if something was bad in it, it would be big news.

Re: How to Leak to the Press

#46

Post by brown9-2 » Fri, Jun 07, 2013, 2:18 PM UTC

saalweachter wrote: post #41

dsleno wrote: post #30

Earlier quoted context omitted.

Tell the reporter to mail you at Mailinator or Lockbin.com and retrieve their messages by connecting with TOR.

Or tell the reporter to take out a classified ad in a free, public paper distributed in the nearest large metropolitan area. The communications from the reporter don't need to be private or targeted. Everyone will know he's involved when he publishes, and he can reasonably encode questions by referring to the documents already sent. "MR X, CAN YOU PROVIDE FURTHER INFORMATION ON THE EVENTS DISCUSSED ON PAGE 13."

The communications from the journalist certainly do need to be private. Advertising that you are working on a story that will reveal big government secrets is a good way to be put under surveillance to find out who is doing the leaking to you. The journalist would not want to announce to the world that the process of receiving classified information is ongoing.

Re: How to Leak to the Press

#47

Post by sfall » Fri, Jun 07, 2013, 2:22 PM UTC

Ilmesnkie_Jones wrote: post #39

300bps wrote: post #17

Earlier quoted context omitted.

>Print the addresses (be careful here - printers sometimes put identifying marks - get the most common one) Printer steganography is usually limited to color laser printers and high-end inkjets. Buying a common one unfortunately won't help you. Included in the codes that have been cracked is the serial number of the printer as well as a date and time stamp of the printout. Source: http://en.wikipedia.org/wiki/Printer…

Couldn't you just buy a cheap printer with cash, use it, and then dump it as well, perhaps leave it in a charity bin somewhere. Printers are pretty cheap these days, and it seems that in order for any of the markings to be useful they would have to find the printer in question in your possession/prove it was your printer.

or buy a crappy one from goodwill or a pawn shop, pawn shop might have cameras goodwill probably not

Re: How to Leak to the Press

#48

Post by _k » Fri, Jun 07, 2013, 2:22 PM UTC

sahirh wrote: post #21

The leaking via gmail has an issue: In many cases when creating a new gmail account, you have to provide a phone number for an automatic text verification code.

True. The article has so many mistakes in it, it's almost as if it's written by the government !! We need a new article.

Re: How to Leak to the Press

#49

Post by raverbashing » Fri, Jun 07, 2013, 2:36 PM UTC

tehmaco wrote: post #35

atirip wrote: post #27

Earlier quoted context omitted.

Write in foreign language you do not master well. All your errors are then "childish" and untraceable.

Or run it through Google translate (or equivilent) a few times and manually correct any critical words in the end result.

Hopefully it doesn't log the messages... or does it?

Re: How to Leak to the Press

#50

Post by mirkules » Fri, Jun 07, 2013, 2:51 PM UTC

Question about cash: do banks keep track of the bills that are dispensed through ATMs? If so, it's probably safer to break your bills first.

Also, be aware of cameras near the internet cafes or places you intend to use the burner phone.