‘Every message was copied to the police’ • Hacker News Board

Re: ‘Every message was copied to the police’

#31

Post by generalizations » Wed, Sep 22, 2021, 6:43 PM UTC

Buttons840 wrote: post #27

bowmessage wrote: post #8

Earlier quoted context omitted.

Never roll your own security if you actually want security, either. What are we supposed to do :).

Why not both? Encrypt your message with your home grown encryption, then send it through standard TLS. Both would have to fail for the message to be revealed. Sometimes when I'm wearing my tinfoil hat I wonder if the advice to avoid rolling your own crypto is a conspiracy. The powers that be want to maintain their backdoors, maybe? Probably not. Of course, it's definitely true that there are more attack vectors out t…

I also wonder why there's such a pushback against one-time-pads. The common critiques don't seem to be any greater of a risk than the holes we've already encountered (e.g. heartbleed).

I think I remember a scifi story that mentioned some character who worked in the one-time-pad shipping business. I guess a spacecraft full of data storage can hold enough random data to last for a long time.

Seems like we should at least come up with a proper protocol for it, so we can at least get started with something that's broadly compatible.

Re: ‘Every message was copied to the police’

#32

Post by CWuestefeld » Wed, Sep 22, 2021, 6:44 PM UTC

Andrew_nenakhov wrote: post #26

Interesting thing about intercepting messages which are encrypted using modern encryption protocols like OTR is deniability. If a police installs MitM on a server, it can't cryptographically prove that messages were originating from criminals, not written themselves.

That's an interesting thought, but I doubt it matters much in practice. I mean, we don't refuse to admit into evidence a ransom note just because the criminal didn't get it notarized. And that's all that SSL is doing, is acting as that notary. The jury can still decide that they think other evidence pointing to the message's origin is sufficient proof.

Re: ‘Every message was copied to the police’

#33

Post by robertlagrant » Wed, Sep 22, 2021, 6:45 PM UTC

bowmessage wrote: post #8

sharklazer wrote: post #5

Never outsource security if you actually want security...

Never roll your own security if you actually want security, either. What are we supposed to do :).

It's don't roll your own crypto, not security in general.

Re: ‘Every message was copied to the police’

#34

Post by tokai » Wed, Sep 22, 2021, 6:45 PM UTC

icu wrote: post #16

The striking thing is that criminal enterprise relies on software as much as any other legitimate business. The adage "software is eating the world" comes to mind. It's probably the case that more technically adept criminals will roll their own tech and out manoeuvre rival criminals and law enforcement. Considering the sums of money discussed in the article it's not inconceivable for criminal organisations to start c…

You would think that, but the whole an0m thing showed that it wasn't really the case.

Re: ‘Every message was copied to the police’

#35

Post by bitwize » Wed, Sep 22, 2021, 6:46 PM UTC

eptcyka wrote: post #7

bitwize wrote: post #2

> Now that the workings have been revealed, An0m is a trick that could surely never be repeated in the world of organised crime. The revelations will push criminals away from technology, even if it makes their work more laborious and slow-moving. I can imagine future organized crime information flows more closely resembling what was depicted in John Wick: a lot of secretaries and file clerks pushing paper around, usi…

Its harder to erase paper trails, so I think the future of crime is using open source or in-house comms tools.

Fire, judiciously applied, can erase paper trails rather efficiently.

Re: ‘Every message was copied to the police’

#36

Post by jhgb » Wed, Sep 22, 2021, 6:47 PM UTC

oh_sigh wrote: post #11

badRNG wrote: post #6

> There, since 2018, the Telecommunications and Other Legislation Amendment (Tola) has allowed government agencies to compel telecommunications providers to allow authorities to intercept criminal messages – powers that are not yet available to police elsewhere in the world. That "yet" is terrifying. If you thought the PATRIOT Act was an overstep, you need to read TOLA. This is the revival of the crypto wars. Good wr…

How does one even know they are criminal messages if they haven't already been intercepted?

It's an island prison -- of course these are criminal messages to begin with!

Re: ‘Every message was copied to the police’

#37

Post by jimt1234 » Wed, Sep 22, 2021, 6:48 PM UTC

infogulch wrote: post #20

oh_sigh wrote: post #11

Earlier quoted context omitted.

How does one even know they are criminal messages if they haven't already been intercepted?

Messages on their own are considered criminal until proven otherwise, just like your cash (see civil forfeiture). I wish I could add /s

I recall reading a while back that judges were signing off on surveillance warrants based on messages using any sort of encryption (like https), because obviously anyone encrypting a message is up to no-good. /s ;)

Re: ‘Every message was copied to the police’

#38

Post by Y_Y » Wed, Sep 22, 2021, 6:51 PM UTC

Buttons840 wrote: post #27

bowmessage wrote: post #8

Earlier quoted context omitted.

Never roll your own security if you actually want security, either. What are we supposed to do :).

Why not both? Encrypt your message with your home grown encryption, then send it through standard TLS. Both would have to fail for the message to be revealed. Sometimes when I'm wearing my tinfoil hat I wonder if the advice to avoid rolling your own crypto is a conspiracy. The powers that be want to maintain their backdoors, maybe? Probably not. Of course, it's definitely true that there are more attack vectors out t…

I think that this isn't strictly true. If you naïvely apply bad encryption before good you may weaken the entire system. For a silly example, imagine your "homegrown" crypto adds a publicly known plaintext to the start of the cyphertext. I think this is discussed in Schneier's textbook.

Re: ‘Every message was copied to the police’

#39

Post by GuB-42 » Wed, Sep 22, 2021, 6:53 PM UTC

isoprophlex wrote: post #21

bowmessage wrote: post #8

Earlier quoted context omitted.

Never roll your own security if you actually want security, either. What are we supposed to do :).

Use one time pads

One time pads are really inconvenient and hard to get right. That's why they are almost never used in practice, despite being theoretically perfect.

First, you need to generate large amounts of unbiased, true random data. If it is not true randomness, you have a stream cypher, and if you "rolled your own", probably not a good one.

They you have to store the one-time pad. It is usually too big to memorize. You have to store in on a device like a USB stick or a book, and guard it well.

Then, you have to share the secret, and for that you need a secure channel and that shouldn't rely on encryption, because it would miss the point. Essentially, you need to meet in person, in a secure location.

Then, you need to make sure that the one-time pad really is one-time. It should be securely destroyed after each use, preferably on both ends.

Re: ‘Every message was copied to the police’

#40

Post by monocasa » Wed, Sep 22, 2021, 6:56 PM UTC

yholio wrote: post #22

dankent wrote: post #9

Earlier quoted context omitted.

That sounds like it would be a big win for law enforcement. If you can force your opponent to avoid some modern ways to communicate, you can put a big dent in their efficiency. It's possible that paranoia might lead to criminals avoiding even technology that they could be using safely, further slowing them down. An old fashioned system also seems like it would require more people, opening up more opportunities for hu…

Or they could learn to use Signal. Properly installed (F-Droid) on off-the-shelf phones with fresh prepaid sims and OS updates disabled, it can be considered secure software against all but the most sophisticated adversaries. Then, simply verify the handshake key for your contacts, and you can be sure there is no man in the middle attack. Rotate phone+sim every 2 months, while keeping the same "outside" number, say,…

The easier way to attack this is by instituting a know your customer law for phone systems including prepaid SIMs, combined with accomplice charges for anyone who's SIM is used in connection with criminal acts.