Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

An encrypted message to Edward Snowden

wired.com

Post reply on HN
Print view View original

141–150 of 164 posts

Re: An encrypted message to Edward Snowden

#141

Post by dredmorbius »

teeja wrote: post #124
gasull wrote: post #16

Snowden, just remember that Kevin Poulsen and Adrian Lamo helped the US Government in catching Bradley Manning. EDIT: Also, a pretty safe way to carry an interview would be VPN + Tor + Bitmessage. EDIT2: Users sneak and tlb claim Tor isn't safe because of timing attacks. Read below.

A couple of days ago I read that 'As of 2012, 80% of the Tor Project's $2M annual budget comes from the United States government.' http://online.wsj.com/article/SB1000142412788732467720457818... That might be another reason that TOR isn't safe. You don't ever know who any of the other servers belong to ... and the staff at the Exit Node can (and has) read anything. I wouldn't bet my life on software 'originally spons…

The State Department has had a strong interest in enabling communications particularly from dissidents in various countries (China, Arabian states, possibly others). I'm aware of some projects they've backed or considered. I'm also aware that State is frequently a cover for intelligence operations. And that there's been a fair bit of cooperation between various intelligence organizations and Free Software projects (Salon's got a long piece on Hadoop up at the moment).

Re: An encrypted message to Edward Snowden

#142

Post by dredmorbius »

cdjk wrote: post #22

If Edward Snowden does have a pgp key (I can't find one online), it hasn't been revealed in this message. It looks like the signing and encryption keys are the same: gpg: armor: BEGIN PGP MESSAGE gpg: armor header: Version: GnuPG/MacGPG2 v2.0.19 (Darwin) gpg: armor header: Comment: GPGTools - http://gpgtools.org :pubkey enc packet: version 3, algo 1, keyid 5B50940B79DEBE35 data: [4096 bits] gpg: public key is 79DEBE3…

Well, there's now a key matching that ID on subkeys.pgp.net:

    $ gpg --recv-key '0x5B50940B79DEBE35'
    gpg: requesting key 79DEBE35 from hkp server subkeys.pgp.net
    gpg: key 2BE0BC29: public key "Verax (Informed Democracy Front)" imported
    gpg: Total number processed: 1
    gpg:               imported: 1  (RSA: 1)
Claims to have been created May 20, 2013, though it's only self-signed:

    $ gpg --list-sigs 2BE0BC29
    pub   4096R/2BE0BC29 2013-05-20
    uid                  Verax (Informed Democracy Front)
    sig 3        2BE0BC29 2013-05-20  Verax (Informed Democracy Front)
    sub   4096R/79DEBE35 2013-05-20
    sig          2BE0BC29 2013-05-20  Verax (Informed Democracy Front)

Re: An encrypted message to Edward Snowden

#143

Post by tekromancr »

crdoconnor wrote: post #138
tekromancr wrote: post #135

Earlier quoted context omitted.

So that they could conduct cyberwarfare ops and maintain deniability. Math is math. All of the cards are on the table, the code is entirely open. The protocol is designed in such a way that any of the in-transit nodes know fuckall about the messages source, destination, or content. There is no "the" exit node, anyone can operate one. Not to mention that there is nothing stopping you from encrypting the data going int…

>There is no "the" exit node, anyone can operate one. From what I understand an awful lot of them are run by the US government.

There is one way to fix that, but it involves you having to explain why your IP address has been accessing CP honeypots.

Re: An encrypted message to Edward Snowden

#144

Post by alan_cx »

TillE wrote: post #79
alan_cx wrote: post #77

Earlier quoted context omitted.

No idea. I wouldn't dare to risk it. For me, I just have always assumed that electronic communications are easier to compromise than old traditional ones. In the end, you connect to an ISP and packets can be inspected. OK, you might have encryption, but there have been too many schemes cracked or broken. So, why ever think that electronic comms can ever be secure? In the extreme, if the spooks get your encrypted data…

The medium is irrelevant if you're using a OTP that has already been securely exchanged. You can broadcast your message to the world, like number stations do. To anyone without the OTP, it's quite literally impossible to decrypt.

Indeed and, in theory, 100% agreed.

But remember my bit about knowing if you are being watched. Electronic, I have no idea, unless, IIRC, we get quantum about it. Old skool, chances are better. I, or a friend can observe my drop box or exchange, and so on.

Im not saying there are no good electronic methods, I am saying that ultimately I'd be more comfortable not using them. Remember too, I am talking ultimate paranoia, life and death.

In the end of course the weakest link of all is the humans operating any system. I mean, the whole PRISM thing was blown by a human.

The other thing in my mind is that these days spooks expect and are geared up for electronic comms, not so human comms. Budgets slashed, less "watchers", and men on the ground. Going olde skool is a sort of curved ball.

Also, I know paper. I can verify hiding places. I can watch people move. I am not good enough to review, completely and confidently, code and encryption software. I would have to trust programmers I dont know, in a climate where we believe the likes of GCHQ, NSA, etc have back doors and cracks. We are given to understand that these people are all over electronic comms. As far as I know, they have not penetrated writing paper and hiding holes. They are not invisible either. Maybe you and others are good enough to verify all the software, encryption and networking software and hardware sufficiently enough to trust your life to it. I know I'm not.

In short, if my life is on the line, I would go with what I know best. I know paper better than deeply complex mathematics and programming.

Besides, given the revelations, why even bother to risk it? Even before all this, I would laugh my nuts off at terrorists who were caught and convicted using electronic evidence. I thought them idiots for even touching a computer to arrange terrorism. I assume that now, they wont be so stupid. It was nice and easy for the authorities to plunder their computers and and electronic trail. Now their job just got harder.

Re: An encrypted message to Edward Snowden

#145

Post by zeckalpha »

flomo wrote: post #123
meowface wrote: post #112

Earlier quoted context omitted.

I'm pretty sure he was being sarcastic, playing on the fact that Wired and Ars Technica are sort of competitors.

Perhaps they are 'sort of' competitors, but both are owned by Condé Nast, so probably more a friendly corporate rivalry.

Not even that. Both are part of Wired Digital.

Re: An encrypted message to Edward Snowden

#146

Post by trotsky »

antocv wrote: post #137
trotsky wrote: post #18

Earlier quoted context omitted.

If you want a realistic chance of not losing control of your private key the only real answers are hardware based - using a tamper resistant smart card, hardware security module, tpm or similar systems in which the signing is done inside the chip that contains your signing keys and no general purpose device ever sees the key at all. Most people using software only solutions won't ever have their keys stolen, but that…

I may be on the edge but a "Trusted Platform Module" doesnt automatically let me conclude that indeed the hardware module is to be trusted. It seems quite unlikely the masses would have access to a trusted platform of any kind, especially considering that any secure platforms for communication that have existed, like Skype, have been opened up. Even good old GSM (AS/1 was it called?) voice-talk encryption was designe…

When I wrote that I definitely debated whether to include tpm in the list because of concerns along those lines. But in the end it's a widely deployed example of that type of technology which makes it a good example. It definitely wouldn't be my first choice in any case just due to the complexity of it - there is > 10k loc inside your typical tpm as i understand it. One thing to keep in mind though is that tpm is a spec/standard that's been implemented by several different vendors. They're the ones that write the code that goes inside as it was considered an implementation detail in the spec. So that means you can buy a german tpm (infineon) or a french tpm (stm) or a us tpm (intel, atmel?) and so on including taiwan and china. So you can sort of pick your poison, presumably they aren't exactly sharing their backdoors with each other at least not france+us+china.

Even assuming it's a compromised platform it's still a hell of a lot more likely to keep your key material safe as compared to having it sit on disk or in addressable address space. One presumes backdoors like that are used sparingly as they become considerably less valuable once publicly exposed.

Re: An encrypted message to Edward Snowden

#147

Post by foobarqux »

gasull wrote: post #71
foobarqux wrote: post #59

Earlier quoted context omitted.

Bitmessage doesn't have forward secrecy.

I think that's right, but why would Snowden need forward secrecy here?

Because he want's to keep his previous messages secret even after his computers are seized or hacked?

Re: An encrypted message to Edward Snowden

#148

Post by trotsky »

nthj wrote: post #41
trotsky wrote: post #18

Earlier quoted context omitted.

If you want a realistic chance of not losing control of your private key the only real answers are hardware based - using a tamper resistant smart card, hardware security module, tpm or similar systems in which the signing is done inside the chip that contains your signing keys and no general purpose device ever sees the key at all. Most people using software only solutions won't ever have their keys stolen, but that…

I would be very interested in a a tutorial or guide for getting something like this set up on OS X.

The answer depends on what kind of key material and applications you use. Sadly there is no one size fits all system.

https://www.opensc-project.org/opensc/wiki/OverView

this would probably be the place to start, at least to figure out which type of card you'd want. The main choices are a) support pgp and ssh b) support x.509 certificate based signing c) support time or use type tokens (like smartphone 2 factor apps) or d) some non standardized system running custom code on a tiny jvm inside the card.

a) would be what you'd want in the context of this conversation, but b) is much more supported and has a wider set of use cases.

In most cases it amounts to making sure you buy the right card & reader, plugging it in, and compiling the opensc and related packages

Re: An encrypted message to Edward Snowden

#149

Post by trotsky »

cheald wrote: post #42
MiguelHudnandez wrote: post #35

Earlier quoted context omitted.

The light reflected off your eyes from the capslock key is readable from high-res cameras. It's better to have leads hooked up to one of your toes and to toggle a 24V source so you can interpret the pulses in morse code. Edit: obviously the 24V must come from a battery which is charged only at specific intervals -- otherwise they can interpret your messages by watching mains voltage variation.

Those leads are gonna generate magnetic distortions. You should only do this with your feet next to a giant 18" subwoofer while blasting dubstep in order to mask any electromagnetic fluctuations. Bonus: Anyone surveilling you via audio bugs will need new ears.

I know this is all in good fun, but you all are uncomfortably close to describing things that will soon get added to the practical threat landscape.

As long as you have a flexible hardware platform that lets you crank up some of the voltage regulator outputs, gpios that can be attached to a long trace/external wire as a makeshift antenna and have a decently fast cpu clock you have all the ingredients for a crude but usable software defined radio. maybe not super fast if you can't repurpose a hardware phy or radio interface, but more than enough bandwidth to exfil a secret key or 10 for maybe a couple dozen meters.

Tools to do sdr utilizing only general purpose processors and no radio specific gear are already available here and there as research implementations, and code that uses gpus/audio dacs/ and re-purposed phys to make a radio interface with a different spec or broadcast frequency is already in production use (wifi phy using a dvb radio interface -> tv whitespace communicator).

Using an approach like that to exfil or bridge an air gap is just too tempting for it to not happen. Honestly, I'd be willing to bet there's already an example of that somewhere out there in the wild today.

Post reply on HN