Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

WikiLeaks Releases Trove of Alleged C.I.A. Hacking Documents

nytimes.com

Post reply on HN
Print view View original

211–220 of 250 posts

Re: WikiLeaks Releases Trove of Alleged C.I.A. Hacking Documents

#211

Post by libertymcateer »

GauntletWizard wrote: post #185
libertymcateer wrote: post #108

Earlier quoted context omitted.

> Why? Because that's a false sense of security. Chrome would have to also store the encryption key, and store it in the same place and under the same access controls as the encrypted data. I hear you, but this is not the case with Safari. It offers secure local storage. It's the securesettings API. It uses the OS level encryption, and, based on the current state of play, this does not appear to be compromised. > as…

I'll admit that the OSX Keychain has advantages - Offering OS-managed secure storage, with the possibility of the OS authenticating requests for credentials with the user is pretty cool. But as Chrome is cross-platform, and there's not standardized and similar APIs on Linux and Windows, I don't think it's the right move to have an OSX exclusive implementation that uses that api.

> But as Chrome is cross-platform, and there's not standardized and similar APIs on Linux and Windows, I don't think it's the right move to have an OSX exclusive implementation that uses that api.

That is a very fair point, which I will take into consideration.

Re: WikiLeaks Releases Trove of Alleged C.I.A. Hacking Documents

#212

Post by ProAm »

jacquesm wrote: post #204
ProAm wrote: post #198

Earlier quoted context omitted.

Of course, Im only speaking in the context that you are worried about the CIA or other governments.

Even if you are worried about them it still does not mean that you have been compromised. And if you do worry about them: don't use your phone (or any computer, for that matter) for sensitive stuff.

Of course, my original point was don't count on Signal to protect you. That was my whole point.

Re: WikiLeaks Releases Trove of Alleged C.I.A. Hacking Documents

#213

Post by mmrezaie »

scblock wrote: post #75
shp0ngle wrote: post #39

Earlier quoted context omitted.

No, it's not. The encryption is not broken, it's bypassed . The data go to an unintended third party, even when the encryption is legit, rendering the encryption useless. So the word "bypass" is correct.

This is a dangerous headline because it implies that Signal was broken, which could lead to people moving to LESS SECURE SERVICES because they think the more secure one is broken. When in reality is the phone and OS. They have similar end result for the phone in question, but headlines like this can lead to people being less secure on the whole.

Well, it would be really dangerous if they have put a headline that did not make normal people not read it. I do not see this as click bait, and I see this as a usual signal for the mainstream to be aware.

Also, if you these people read only the title, then the problem is not any sort of text, you should fix those people first. No matter what words were chosen they will most likely make the wrong judgment.

Re: WikiLeaks Releases Trove of Alleged C.I.A. Hacking Documents

#214

Post by throwaway743824 »

idlewords wrote: post #113
revelation wrote: post #103

Earlier quoted context omitted.

Seems like the headline is perfectly fine. The software on the device you don't own is bypassed, resulting in encryption being ineffective? That seems like a highly critical issue for whoever owns the software . Step the fuck up Google. Android security is an embarrassment.

The headline mentions specific apps; readers will remember that those apps are "insecure". Very dangerous.

They are insecure from the perspective of protecting people from targeted government surveillance though. The security model doesn't support it.

Re: WikiLeaks Releases Trove of Alleged C.I.A. Hacking Documents

#215

Post by acomar »

27182818284 wrote: post #62
trendia wrote: post #8

Earlier quoted context omitted.

edit: apparently NYT had a different headline and changed it... ignore this post The current title [0] is wrong, but NYTimes is relatively clear: > Among other disclosures that, if confirmed, would rock the technology world, the WikiLeaks release said that the C.I.A. and allied intelligence services had managed to bypass encryption on popular phone and messaging services such as Signal, WhatsApp and Telegram. Accordi…

When I read "bypass" I kind of read "go the alternate route. As in around the impasse" which in this case the impasse was encryption. I think a lot of people in this thread are hating on NYTimes today for this headline because of the inaccurate WhatsApp encryption news stories of recent. I could see myself being bothered if they had written that the encryption was "broken" or "cracked" as if you destroyed the boulder…

> I think a lot of people in this thread are hating on NYTimes today for this headline because of the inaccurate WhatsApp encryption news stories of recent.

More because we're all getting blown up with "Signal is broken" messages and have to answer them one by one because of misleading/disingenuous headlines. Yes, 'bypass' is technically correct but the implication of the headline is that the problem lies with the named apps. This is not true and actively problematic.

Re: WikiLeaks Releases Trove of Alleged C.I.A. Hacking Documents

#216

Post by bitmapbrother »

libertymcateer wrote: post #180
bitmapbrother wrote: post #168

Earlier quoted context omitted.

>Which is irrelevant if the runtime is compromised, which appears to be the case. You're under the false assumption that these exploits are current - they're not. In fact, they're very old.

These ones? https://www.washingtonpost.com/world/national-security/wikil...

Why not point to the actual ancient exploits from circa 2011-2013 for Android versions below 5 and Chrome versions below 40?

https://wikileaks.org/ciav7p1/cms/page_11629096.html

Re: WikiLeaks Releases Trove of Alleged C.I.A. Hacking Documents

#217

Post by v64 »

tzs wrote: post #205
v64 wrote: post #35

Earlier quoted context omitted.

Makes the conspiracy theories regarding journalist Michael Hastings' death in 2013 seem more plausible. [1] Former U.S. National Coordinator for Security, Infrastructure Protection, and Counter-terrorism Richard A. Clarke said that what is known about the crash is "consistent with a car cyber attack". He was quoted as saying "There is reason to believe that intelligence agencies for major powers — including the Unite…

> Makes the conspiracy theories regarding journalist Michael Hastings' death in 2013 seem more plausible. Not really. The possibility of taking over unmodified cars remotely was not very widely known at the time. An organization that knew about that and had the technology to actually do so would not want to use it except on high value targets that they could not reach by more conventional means, because they would wa…

Agreed, which is why I think this information is additional evidence and not a smoking gun. I do think given what is public knowledge, the prospect of the CIA using an experimental new technique on a target like Hastings is suspect.

Ultimately though, we don't know what he uncovered and intended to publish, and how long the CIA had to react to it. An extraordinary revelation may have necessitated an extraordinary reaction. The point is that the new information takes the concept of malicious car hacking from speculation to reality.

Re: WikiLeaks Releases Trove of Alleged C.I.A. Hacking Documents

#218

Post by nikcub »

nthm wrote: post #202
nikcub wrote: post #179

Earlier quoted context omitted.

> Next time I won't post in a rush during work hours. I'd suggest taking the same approach with your "secure, end-to-end encrypted communications" app you keep mentioning here[0] A one-way sha256 hash of a message using a password that has to be 8 characters long[1] and can't accept special characters[2] is not a secure communications app It is trivial to find the plaintext in these situations. Your Chrome extension…

Could you explain how [3] is an RCI bug? getNum() returns either 'false' or 'n' with the length of gibberText (ie. n20, n35, etc). I can't imagine any content where .length() would return harmful code; though I'm not well versed in JS.

That image isn't very useful on its own.

the design of the app is that it injects content scripts with global variable names everywhere.

any site can overwrite the encryption functions, or redefine some of the global vars that are used for images, etc.

Re: WikiLeaks Releases Trove of Alleged C.I.A. Hacking Documents

#219

Post by nikcub »

libertymcateer wrote: post #207
nthm wrote: post #202

Earlier quoted context omitted.

Could you explain how [3] is an RCI bug? getNum() returns either 'false' or 'n' with the length of gibberText (ie. n20, n35, etc). I can't imagine any content where .length() would return harmful code; though I'm not well versed in JS.

I'm also interested to know. Believe it or not, I would love to get Nik as a consultant. I fear my 'hubris' (I won't deny it, this idea is extraordinarily ambitious and I have to be arrogant to even conceive of it) will have pissed him off irrevocably. That aside, I don't really follow his point on the login PW. I understand 8 char alphanum pw is pretty low entropy... but that isn't used for encryption. And the login…

It isn't the login password but the message password - although using sha256 for a login password isn't great either

if you're doing

aes(plaintext, sha2(password)) = cyphertext

given cyphertext I can get to plaintext with sha2(8-char dictionary)

well designed systems will generate a truly random key there, exchanged using public-key. if you're going to use a password, you need a key-derivation algorithm

this is all bunk tho since the big vulnerability here is that you're delivering the encryption routines via javascript in a global browser space

Re: WikiLeaks Releases Trove of Alleged C.I.A. Hacking Documents

#220

Post by nikcub »

libertymcateer wrote: post #197
nikcub wrote: post #195

Earlier quoted context omitted.

I'd probably take the site down, or mark it clearly as being a hobby project. As for Chrome - that team has some of the smartest infosec and cryptography people in the world working on and contributing to the project. If you want some insight into how some of the security design principals and tradeoffs were rationalized, i'd start with the project wiki: https://www.chromium.org/Home/chromium-security

It's currently marked as beta all over the site, for exactly these reasons.

it is more prominently marked as "secure, end-to-end encrypted communications" - which it certainly is not.

it is also being marketed as such by you here

Post reply on HN