71–80 of 164 posts
Earlier quoted context omitted.
I2P has protection against timing attacks. Bitmessage has deniability, but if the receiver end is compromised or untrustworthy, then the deniability is gone, and the timing attack might be possible. Combining Bitmessage and I2P would be solution, I think, but I don't know of any Bitmessage nodes on I2P.
Bitmessage doesn't have forward secrecy.
Snowden, just remember that Kevin Poulsen and Adrian Lamo helped the US Government in catching Bradley Manning. EDIT: Also, a pretty safe way to carry an interview would be VPN + Tor + Bitmessage. EDIT2: Users sneak and tlb claim Tor isn't safe because of timing attacks. Read below.
I posted something to that effect in the article's comments. It was moderated and comments are now closed (at least for me).
Snowden, just remember that Kevin Poulsen and Adrian Lamo helped the US Government in catching Bradley Manning. EDIT: Also, a pretty safe way to carry an interview would be VPN + Tor + Bitmessage. EDIT2: Users sneak and tlb claim Tor isn't safe because of timing attacks. Read below.
>Snowden, just remember that Kevin Poulsen and Adrian Lamo helped the US Government in catching Bradley Manning. I posted something to that effect in the article's comments. It was moderated and comments are now closed (at least for me).
"Commenting has been disabled for this article"
Earlier quoted context omitted.
AFAIK, the current publicly-known record for breaking RSA keys is the factorization of RSA-768 in 2010: http://eprint.iacr.org/2010/006.pdf That paper says it took about 1500 CPU-years to break a 768-bit key, and that the difficulty increases 1000x for each additional 256 bits of key length. For a back-of-the-envelope cost estimate, I'm going to assume that there have been no major theoretical breakthroughs in the la…
Assuming there's no known exploit. The NSA might know of an exploit for that algorithm.
If Edward Snowden does have a pgp key (I can't find one online), it hasn't been revealed in this message. It looks like the signing and encryption keys are the same: gpg: armor: BEGIN PGP MESSAGE gpg: armor header: Version: GnuPG/MacGPG2 v2.0.19 (Darwin) gpg: armor header: Comment: GPGTools - http://gpgtools.org :pubkey enc packet: version 3, algo 1, keyid 5B50940B79DEBE35 data: [4096 bits] gpg: public key is 79DEBE3…
Having said, that, according to PGP Dump
Old: Public-Key Encrypted Session Key Packet(tag 1)(524 bytes)
New version(3)
Key ID - 0x5B50940B79DEBE35
Pub alg - RSA Encrypt or Sign(pub 1)
RSA m^e mod n(4096 bits) - ...
-> m = sym alg(1 byte) + checksum(2 bytes) +
PKCS-1 block type 02
New: Symmetrically Encrypted and MDC Packet(tag 18)(4096
bytes) partial start
Ver 1
Encrypted data [sym alg is specified in pub-key
encrypted session key]
(plain text + MDC SHA1(20 bytes))
New: (1024 bytes) partial continue
New: (18 bytes) partial endEarlier quoted context omitted.
If it were me, literally, I go olde skool. Nothing electronic what so ever.
What about a pager? Can that somehow lead them to you? I'm not talking about tactics, but about the device in itself.
For me, I just have always assumed that electronic communications are easier to compromise than old traditional ones. In the end, you connect to an ISP and packets can be inspected. OK, you might have encryption, but there have been too many schemes cracked or broken. So, why ever think that electronic comms can ever be secure? In the extreme, if the spooks get your encrypted data and they really believe that the data contains the "ticking bomb", they'll just torture you until you give up the key. So, you're still stuffed. Why give them even that much?
More over, the one big issue I have to electronic communications, is that it is very hard to know if you are under surveillance. The old methods give you a better chance to discover that you are being watched. It is also easier to hide the fact that you are communicating at all.
The clincher for me was that a while ago an "amusing" story appeared in a British news paper. Essentially it "exposed" MI6 spies in Moscow using actual drop boxes to pass along information. Now, if MI6 are still using pre-WWII methods, that has to tell you something, right? They don't trust the electronic methods.
So, if secure communications really mattered to me, life or death type mattered, then I'd be looking at things like one time pads, drop boxes, people, etc. Of course a lot of it depends on what you are trying to communicate, how many people are involved, and frankly how much money you have to use.
One thing I do know, electronics would be something I would work very hard to avoid.
Lastly, if I were going to whistle blow to a journalist on this scale, the first thing I would establish would be several methods of communication. Times, places, codes, etc. I suspect that, given the nature of this exposure, that will have been done, and none of it will be electronic.
If Edward Snowden does have a pgp key (I can't find one online), it hasn't been revealed in this message. It looks like the signing and encryption keys are the same: gpg: armor: BEGIN PGP MESSAGE gpg: armor header: Version: GnuPG/MacGPG2 v2.0.19 (Darwin) gpg: armor header: Comment: GPGTools - http://gpgtools.org :pubkey enc packet: version 3, algo 1, keyid 5B50940B79DEBE35 data: [4096 bits] gpg: public key is 79DEBE3…
If --hidden-encrypt-to is used, there still will be signs of that. Specifically, the message addressed to 0x0000000 and the recipient will basically brute force it uses every key he/she has. Having said, that, according to PGP Dump Old: Public-Key Encrypted Session Key Packet(tag 1)(524 bytes) New version(3) Key ID - 0x5B50940B79DEBE35 Pub alg - RSA Encrypt or Sign(pub 1) RSA m^e mod n(4096 bits) - ... -> m = sym alg…
Earlier quoted context omitted.
What about a pager? Can that somehow lead them to you? I'm not talking about tactics, but about the device in itself.
No idea. I wouldn't dare to risk it. For me, I just have always assumed that electronic communications are easier to compromise than old traditional ones. In the end, you connect to an ISP and packets can be inspected. OK, you might have encryption, but there have been too many schemes cracked or broken. So, why ever think that electronic comms can ever be secure? In the extreme, if the spooks get your encrypted data…
You can broadcast your message to the world, like number stations do. To anyone without the OTP, it's quite literally impossible to decrypt.
Interesting, the encrypting key is "Verax (Informed Democracy Front)" and claims to have been created on May 20th. I can't tell what key the message is encrypted for. They may have used --hidden-recipient