Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The FBI stole an Instapaper server in an unrelated raid

blog.instapaper.com

Post reply on HN
Print view View original

221–230 of 263 posts

Re: The FBI stole an Instapaper server in an unrelated raid

#221

Post by spoondan »

dspace wrote: post #186
Xk wrote: post #25

Instapaper stores only salted SHA-1 hashes of passwords, so those are relatively safe. -- Obligatory statement on NEVER USING SHA-1 HASHES to make passwords "safe". Any normal person can brute force millions of SHA-1 hashes (salted however much you want) per second on a GPU. If the FBI so wanted (although I don't believe they do) I'm sure they could brute force almost every single password in that database. Granted,…

This is more "crypto nerd imagination", a la the XKCD comic. The FBI doesn't care about the encrypted passwords because it has access to all the content in plaintext. And what else would they need the passwords for? Other accounts on other services? They can just confiscate those servers too, where the content is most likely also in plaintext. So in this case , where the FBI is involve, using a SHA-1 hash poses no ex…

They can just confiscate those servers too, where the content is most likely also in plaintext.

I imagine that many companies are better prepared to deal with the FBI than this data center was. I have a hard time imagining the FBI going into a Google data center and easily walking out with a few racks. But even if that's too optimistic, I doubt the FBI could go about seizing servers for very long. If nothing else, this would eventually piss off big companies who will lobby Congress to curtail the FBI.

Re: The FBI stole an Instapaper server in an unrelated raid

#223

Post by m0nastic »

gwright wrote: post #219
m0nastic wrote: post #193

Earlier quoted context omitted.

I don't think that would be reasonable, but I also don't think that is analagous. For starters, that hypothetical search warrant is too broad to be executed. Keep in mind, I'm not saying that I believe that the FBI executed this seizure correctly. I'm saying that based on third-hand limited information, I don't think it's possible to rule out the possibility that what they did was warranted. If you showed up to perfo…

But you've simply pointed out the strength of the analogy. Siezing adjacent blades in a multi-tenant rack is just as nonsensical as siezing adjacent computers in a multi-tenant office. Physical proximity is simply not a valid justification in either situation. If the courts and/or the FBI are unable to understand this, the remedy is to get them educated and not to simply accept the consequences of overly-broad warran…

I've agreed that the hypothetical search warrant you outlined would be too broad to be enforceable, but I disagree that the search warrant in this case was necesarilly this broad.

I'm not saying it wasn't, I'm saying that it is not a requirement that it was.

I disagree that siezing adjacent blades is just as nonsensical as seizing adjacent computers. I think it's unfortunate, and suboptimal; but I don't think they are the same.

If the search warrant had nothing to do with computers, let's say it was for a silver Motorola Razr. The FBI enters the premises and finds a bucket with ten silver Motorola Razr's. Their job is then to try and determine which specific Razr they are looking for. You can be sure that it's within the realm of possibility that they'd sieze all of them, and then later determine which ones are unrelated.

You can argue, "but then the search warrant should have to be more specific, it should have to have the serial number of the specific Razrs on it", to which I'd agree, that'd be nice. Computer-related search warrants are almost always executed with only the originating IP address and the location to which the IP address was established to be at.

Assuming that they took all the blades (which again, we have no idea one way or the other), I agree it would have been nice to know ahead of time that the specific blades associated with the target were X. I'm not sure that the lack of that specificity of information makes it impossible for them to execute the search warrant.

But basically we're lambasting the FBI for something we have no idea if they've even done, without any actual information about the contents of the raid. I'm trying to keep in mind that it's actually possible (even if not likely) that their actions in this raid were not incorrect.

Re: The FBI stole an Instapaper server in an unrelated raid

#224

Post by m0nastic »

justinweiss wrote: post #222

Looks like it's back: http://twitter.com/instapaper/status/84106275796946944 "As of 2 minutes ago, my DigitalOne server is back online. The logs indicate that it was off and not booted during the time it was missing."

But that would mean that the FBI weren't bumbling morons who salted the earth after tearing out everything in the datacenter with a power supply...

I'm not sure I can deal with the possibility.

Re: The FBI stole an Instapaper server in an unrelated raid

#225

Post by encoderer »

caf wrote: post #201
encoderer wrote: post #153

Earlier quoted context omitted.

Right, so then the idea is that if they get your DB dumb, and see this salt scheme in your code, they can compute a rainbow table using it and now they have cracked all your passwords in the time it would take to brute force one (well, not really, because it's not as if they'd have to brute force the entire keyspace before they got to the one password they're trying to break, but I think I'm onto the right idea about…

Effectively you are still using a hash without a salt, it's just that you've created a new, non-standard, hash function.

I like that explanation.

Re: The FBI stole an Instapaper server in an unrelated raid

#226

Post by engtech »

pkteison wrote: post #185
dragonsky wrote: post #178

Earlier quoted context omitted.

As they have the Web code base, you must assume that they have the salt to the hashing... If they actually want to get these passwords, all they have to do is generate rainbow tables using SHA1 and the appropriate salt. We're back to relying on the length and bit depth (range of characters) of the passwords you are trying to find.

Salts, done properly, vary per user not per server.

but I'm assuming that if they have the code base, the plaintext user names (emailaddys) and the salted password, then they would have whatever the per user salt is.

Re: The FBI stole an Instapaper server in an unrelated raid

#229

Post by protomyth »

m0nastic wrote: post #205
protomyth wrote: post #202

Earlier quoted context omitted.

How is the DOD allowed to work on civilian law enforcement in any capacity?

I'm not sure exactly what you mean, but the Defense Department works with other government agencies and non-governmental agencies; and has for quite a long time. One of these collaborations is responsible for you being able to type that comment and have it be readable by someone on another computer. As to the specifics of the DOD CyberCrime center, it was set up in 98 to offer training/services to other law enforceme…

I was wondering about the interaction and how it fits with the Posse Comitatus Act.
Post reply on HN