Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Inside the Operating System Edward Snowden Used to Evade the NSA

wired.com

Post reply on HN
Print view View original

21–30 of 83 posts

Re: Inside the Operating System Edward Snowden Used to Evade the NSA

#21

Post by nounaut »

devconsole wrote: post #12

It's worth noting that Tails doesn't make you impervious. Tails uses Tor, and Tor is vulnerable to NSA and GCHQ attacks. Specifically, they have the capability of deanonymizing individual targets. I hypothesize that this capability works by monitoring Tor traffic worldwide, then performing a timing correlation between an origin and an endpoint. Here's an example: Let's say (for the sake of example please) that the NS…

I think you mean to say that users of Tor are potentially vulnerable to NSA and GCHQ attacks. Specifically, they lack the capability to deanonymize individual targets upon request and according to the slides leaked by Snowden they are only able to deanonymize a very small fraction of the traffic and usually have to rely on attacking surrounding software, such as the Firefox browser bundled with Tor.

http://www.theguardian.com/world/2013/oct/04/nsa-gchq-attack...

Re: Inside the Operating System Edward Snowden Used to Evade the NSA

#22

Post by epo »

aw3c2 wrote: post #17
bluenose69 wrote: post #16

The article suggests security because "all of the Tails code is open source, so it can be inspected by anyone worried about foul play." Yeah, that worked out well for openssl.

Yes it did. The heartbleed bug was found during an audit of the open source of openssl.

The audit occurred because testing revealed the presence of a problem. Shutting the stable door after the horse has bolted is no vindication of open source.

Re: Inside the Operating System Edward Snowden Used to Evade the NSA

#24

Post by reedalex01 »

cloudwalking wrote: post #2

Tails (The Amnesic Incognito Live System) http://en.wikipedia.org/wiki/The_Amnesic_Incognito_Live_Syst... , a Debian fork which forces Tor for all outgoing and incoming connections. Designed to be run from read-only media.

More info on their relationship with Debian: https://tails.boum.org/contribute/relationship_with_upstream

"For various reasons Tails tries to diverge by the smallest possible amount from its upstream projects, and especially from Debian"

"We try to push our changes upstream when we need to modify software we ship. This often requires us to write code in a generic way, rather than implementing ad-hoc hacks to fit our specific needs: e.g. we often need to make the stuff we need opt-in and add configuration options."

The official term for this is "Debian derivative" rather than "fork."

Re: Inside the Operating System Edward Snowden Used to Evade the NSA

#25

Post by infinity0 »

epo wrote: post #22
aw3c2 wrote: post #17

Earlier quoted context omitted.

Yes it did. The heartbleed bug was found during an audit of the open source of openssl.

The audit occurred because testing revealed the presence of a problem. Shutting the stable door after the horse has bolted is no vindication of open source.

How would you have found the bug without it being open source? You think companies pay for these open public audits on proprietary software?

Re: Inside the Operating System Edward Snowden Used to Evade the NSA

#26

Post by UweSchmidt »

aw3c2 wrote: post #17
bluenose69 wrote: post #16

The article suggests security because "all of the Tails code is open source, so it can be inspected by anyone worried about foul play." Yeah, that worked out well for openssl.

Yes it did. The heartbleed bug was found during an audit of the open source of openssl.

Found late, and found in a an error-prone environment. This weakens the oft-implied "proof by open-sourceness", and has brought up some criticism on how open source projects are ran and incentivized.

Doesn't mean "Open Source sux", just some nuanced criticism, ok?

Re: Inside the Operating System Edward Snowden Used to Evade the NSA

#27

Post by jgalt212 »

devconsole wrote: post #12

It's worth noting that Tails doesn't make you impervious. Tails uses Tor, and Tor is vulnerable to NSA and GCHQ attacks. Specifically, they have the capability of deanonymizing individual targets. I hypothesize that this capability works by monitoring Tor traffic worldwide, then performing a timing correlation between an origin and an endpoint. Here's an example: Let's say (for the sake of example please) that the NS…

Has anyone looked into thwarting timing attacks by using Selenium to run web tasks at random times?

Re: Inside the Operating System Edward Snowden Used to Evade the NSA

#28

Post by mike-cardwell »

devconsole wrote: post #12

It's worth noting that Tails doesn't make you impervious. Tails uses Tor, and Tor is vulnerable to NSA and GCHQ attacks. Specifically, they have the capability of deanonymizing individual targets. I hypothesize that this capability works by monitoring Tor traffic worldwide, then performing a timing correlation between an origin and an endpoint. Here's an example: Let's say (for the sake of example please) that the NS…

https://tails.boum.org/doc/about/warning/index.en.html#index...

"Tor doesn't protect you from a global adversary

A global passive adversary would be a person or an entity able to monitor at the same time the traffic between all the computers in a network. By studying, for example, the timing and volume patterns of the different communications across the network, it would be statistically possible to identify Tor circuits and thus matching Tor users and destination servers.

It is part of Tor's initial trade-off not to address such a threat in order to create a low-latency communication service usable for web browsing, Internet chat or SSH connections.

For more expert information see Tor Project: The Second-Generation Onion Router, part 3. Design goals and assumptions. [https://svn.torproject.org/svn/projects/design-paper/tor-des...

Re: Inside the Operating System Edward Snowden Used to Evade the NSA

#29

Post by pmr_ »

UweSchmidt wrote: post #26
aw3c2 wrote: post #17

Earlier quoted context omitted.

Yes it did. The heartbleed bug was found during an audit of the open source of openssl.

Found late, and found in a an error-prone environment. This weakens the oft-implied "proof by open-sourceness", and has brought up some criticism on how open source projects are ran and incentivized. Doesn't mean "Open Source sux", just some nuanced criticism, ok?

I assume that no one in its right mind would refute a nuanced criticism of Open Source, but the grandparent just didn't think it necessary to be nuanced or elaborate or make some concrete point at all. He just went for the quick pun and is being down-voted for it.

Re: Inside the Operating System Edward Snowden Used to Evade the NSA

#30

Post by danford »

jebus989 wrote: post #23

Impressive how much thought and work has gone into Tails development, e.g. it has a surprisingly-convincing XP skin that hides the fact you're even using Linux to the casual observer. Kudos to the devs.

It's called GNOME 2 and it feels exactly like you're using Linux, which is a great feeling. Kudos to the devs.

Edit: apparently I was mistaken. GNOME 2 is the default desktop, but there is an XP skin. See comments below.

Post reply on HN