Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

SecureDrop

ssl.washingtonpost.com

Post reply on HN
Print view View original

21–30 of 99 posts

Re: SecureDrop

#21

Post by sp332 »

lnanek2 wrote: post #10

Wow, Tor is still a thing? We have confirmation that security agencies have taken over exit nodes and injected spyware before to track targets. I'm surprised anyone uses it. It's like the security lottery.

Tor isn't some magic wand you can wave to get security, but it helps. The core Tor software's job is to conceal your identity from your recipient, and to conceal your recipient and your content from observers on your end. By itself, Tor does not protect the actual communications content once it leaves the Tor network. This can make it useful against some forms of metadata analysis, but this also means Tor is best used in combination with other tools. https://blog.torproject.org/blog/prism-vs-tor

Re: SecureDrop

#22

Post by wwwwwwwwww »

rdl wrote: post #18
blueskin_ wrote: post #8

Earlier quoted context omitted.

Fortunately, they can't do that for all the open/WEP/WPS wireless APs everywhere.

They've done a pretty good job of scaring people into securing their APs (which is also a legitimate thing in most cases); just publishing some stories about people having ISP service cut off due to freeloaders doing bad stuff would probably be enough; wouldn't even need to try to prosecute some.

>They've done a pretty good job of scaring people into securing their APs

How is this even remotely a bad thing? It's trivial to MITM people on unsecured networks - I can't think of a single consumer router that actually does DHCP snooping to prevent it either.

Re: SecureDrop

#23

Post by gabemart »

blauwbilgorgel wrote: post #16

Does anyone know what the codenames are like? If they are easy enough to remember, then they may be easy enough to brute-force? I think this is a great concept, yet perhaps too little, too late (Journalists should know PGP and drop boxes like these should have been common already). I also worry a bit because of Washington Post's track record with leaks, of the top of my head: - Washington Post was Snowden's first cho…

> Does anyone know what the codenames are like? If they are easy enough to remember, then they may be easy enough to brute-force?

I don't know what they're like, but if you take a list of 5000 common words and use 4 random entries for each codename, there are 625,000,000,000,000 possible combinations. Brute-forcing the entire space at 100,000 tries per second would take ~200 years.

Edit: I made a toy jsfiddle version: http://jsfiddle.net/SwWZ9/10/

The wordlist is just a random sampling of English nouns (I couldn't find a quick source of common nouns long enough). It may contain profanity, watch out!

Re: SecureDrop

#24

Post by revscat »

hadoukenio wrote: post #2

Sometime in the near future, I predict that the US will require some form of photo I.D before using an internet kiosk. As usual, the spin will be to protect the children.

I have a better idea. Make it so that some traffic receives higher priority than others, and force content providers to have to pay to play. Then limit competition at the ISP level so that to succeed you have to pay a monopoly to carry your traffic in a timely manner.

No need for something as heavy as what you propose.

Re: SecureDrop

#25

Post by Create »

meowface wrote: post #17
lnanek2 wrote: post #10

Wow, Tor is still a thing? We have confirmation that security agencies have taken over exit nodes and injected spyware before to track targets. I'm surprised anyone uses it. It's like the security lottery.

The NSA leaks reveal that for the most part, Tor is still secure if you're using a sufficient number of intermediary nodes. If anything, the real concern here is the implicit encouragement to use local library computers, which would be much easier for a government agency (or cybercriminal) to infect with malware and observe.

“The American Library Association (ALA) opposes any use of governmental power to suppress the free and open exchange of knowledge and information or to intimidate individuals exercising free inquiry…ALA considers that sections of the USA PATRIOT ACT are a present danger to the constitutional rights and privacy rights of library users.”

http://www.librarian.net/technicality.html

https://www.gnu.org/philosophy/right-to-read.html

Re: SecureDrop

#26

Post by FiloSottile »

If the leaker visits this page before opening the Tor Browser from a regular browser to copy the onion url, the whole thing is as safe as SSL as there will be a trail of the SSL connection just before the visit to SecureDrop. And they don't even explain to avoid it.

OPSEC is hard.

Re: SecureDrop

#27

Post by nfoz »

wwwwwwwwww wrote: post #22
rdl wrote: post #18

Earlier quoted context omitted.

They've done a pretty good job of scaring people into securing their APs (which is also a legitimate thing in most cases); just publishing some stories about people having ISP service cut off due to freeloaders doing bad stuff would probably be enough; wouldn't even need to try to prosecute some.

>They've done a pretty good job of scaring people into securing their APs How is this even remotely a bad thing? It's trivial to MITM people on unsecured networks - I can't think of a single consumer router that actually does DHCP snooping to prevent it either.

I think the technology confuses two things: 1. Encrypted traffic between device and wireless hotspot 2. Restricted access to the wireless hotspot (you need a password or it won't give you service)

I want to allow anonymous access, but let the traffic be encrypted. Is there a technical reason why this is not implemented?

I'm very sad by the culture (and moreso, the legal necessity) of restricting wireless access. I want to share, and have at times relied on anonymous wifi to help me get home.

Re: SecureDrop

#28

Post by peterwwillis »

Tor hidden services are not bulletproof. Just as a really simple example, you can do network traffic analysis to find network nodes with one-way traffic to hosts without a correlated public service and deduce if a hidden service is nearby.

There are several exploits which have been used in the past to expose Tor hidden services, and several papers on theoretical ways to expose them. Many of these attacks can be used in reverse to expose the origin of a connection to a hidden service.

In the [not so] extreme case, the govt can always issue a National Security Letter to WaPo and scoop up any data it wants directly from the hidden service servers, similar to its Silk Road and Freedom Hosting takedowns.

The FBI TOR Exploit [ http://resources.infosecinstitute.com/fbi-tor-exploit/ ]

Heartbleed used to reveal Tor hidden services [ https://blog.torproject.org/blog/openssl-bug-cve-2014-0160/ ]

Hot or Not: Revealing hidden services by their clock skew [ http://www.cl.cam.ac.uk/~sjm217/papers/ccs06hotornot.pdf ]

Tor Hidden Service Passive De-Cloaking [ http://blog.whitehatsec.com/tor-hidden-service-passive-de-cl... ]

Re: SecureDrop

#29

Post by cik »

FiloSottile wrote: post #26

If the leaker visits this page before opening the Tor Browser from a regular browser to copy the onion url, the whole thing is as safe as SSL as there will be a trail of the SSL connection just before the visit to SecureDrop. And they don't even explain to avoid it. OPSEC is hard.

There's this hard tradeoff that most people are willing to make, between making things more 'secure' and making things useable by the general public. I just wish that attention would be paid to the security side of things.

Ultimately, we can write descriptive documentation - but getting it read and understood is hard. Cryptoparties, are again a great idea, but getting the non-technical user involved is damned hard.

IMHO these things always come down to "how do we make it easy for the public, whilst keeping it REALLY secure". How does security become a general piece of education, much akin to math, or at least history?

Re: SecureDrop

#30

Post by middleclick »

lnanek2 wrote: post #10

Wow, Tor is still a thing? We have confirmation that security agencies have taken over exit nodes and injected spyware before to track targets. I'm surprised anyone uses it. It's like the security lottery.

I want to ask for citations but I think I will skip. But no, you are wrong.
Post reply on HN