Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Harvard Student Charged In Bomb Hoax

boston.cbslocal.com

Post reply on HN
Print view View original

41–50 of 55 posts

Re: Harvard Student Charged In Bomb Hoax

#41

Post by tedunangst »

alphonse23 wrote: post #19
Torgo wrote: post #2

http://www.scribd.com/doc/192157170/Eldo-Kim-Complaint It sounds like they determined from the email provider that the message came from a Tor exit node, then from there they looked for who had made a connection on Harvard campus to known Tor relays. He had, so they interviewed him and he confessed to everything. I don't see any strong indication of a weakness in Tor from this, but it's a bit concerning that you coul…

so why didn't he go to starbucks or something to do this, I would have anticipated all this. I guess he was running out of time, and under the pressure he made a careless split second decision.

As the very first bullet point on the tor project homepage says, "Tor prevents people from learning your location or browsing habits." Why bother going to Starbucks when using tor means you're safe?

Re: Harvard Student Charged In Bomb Hoax

#42

Post by beerme »

jpwright wrote: post #7
Torgo wrote: post #2

http://www.scribd.com/doc/192157170/Eldo-Kim-Complaint It sounds like they determined from the email provider that the message came from a Tor exit node, then from there they looked for who had made a connection on Harvard campus to known Tor relays. He had, so they interviewed him and he confessed to everything. I don't see any strong indication of a weakness in Tor from this, but it's a bit concerning that you coul…

This basically adds no new information about Tor, except what we already knew -- that you should really have a private bridge, and that Tor traffic is readily discernible from normal traffic (hence, avoid using it on networks where authorization is linked to your identity!). The affidavit doesn't say how they linked the GuerillaMail address to Tor, presumably they used a subpoena. He could have easily avoided detecti…

The GuerrillaMail to Tor link is explained by the last line in GuerrillaMail's TOS (https://www.guerrillamail.com/tos), which says that they inject your IP address into the email's headers. So there was no subpoena required. The use of GM was a no-op in this case.

Re: Harvard Student Charged In Bomb Hoax

#43

Post by Crito »

grugq wrote: post #38
whitehat2k9 wrote: post #27

Earlier quoted context omitted.

This. It sounds like he folded as soon as he was interviewed by law enforcement. Don't underestimate the power of the $5 wrench. http://xkcd.com/538/

Seriously, enough with the XKCD 538 fallacy. That is not how interrogations work. It just isn't. Violent torture is not how you get people to provide information. Actual interrogations are far more cunning and complex, involving psychological tricks and play against weaknesses in the human mind. Perpetuating this "they'll hit you until you confess" bullshit stops people from learning actually useful information about…

The comic is not literally suggesting that interrogations imply violence any more than it is literally suggesting that any violence must be done specifically with a wrench.

Pedantism and comics do not go well together. The format is not meant for conveying exactingly precise information. Interpretation is required.

Re: Harvard Student Charged In Bomb Hoax

#44

Post by jbooth »

mindslight wrote: post #40
anigbrowl wrote: post #33

Earlier quoted context omitted.

That's ridiculous. If police find a print of XYZ-brand shoes near a crime scene and start keeping their eyes open for people who have XYZ shoes, they're not trying to oppress people with a certain taste in footwear. there seems to be a misconception about that police need probable cause before they even ask questions, which is nonsensical. Edit for clarity: I don't think that following up obvious leads is evidence of…

It's "hostile government" when analyzing the failure of Tor, because the tool should have kept this kid off of the suspect list. I'm guessing you don't even believe this to be a laudable goal, and that's precisely why we need anonymity tools.

Oh, for god's sake.

First off, don't put words in the anigbrowl's mouth.

Second off, it's not government hostility to investigate a bomb hoax that costs a lot of people money and inconveniences a ton of people. This guy wasn't engaging in civil disobedience.

Third off, the dude could have just walked to any of the dozen coffee shops in harvard square with free wifi and done this all in the clear, and been fine. Tor cannot and will never prevent traffic analysis if you're dumb enough to plug into the organization you're hoaxing's network. Tor created reasonable doubt, that's all it could do in this case, as a matter of physical limitations.

Re: Harvard Student Charged In Bomb Hoax

#45

Post by mindslight »

jbooth wrote: post #44
mindslight wrote: post #40

Earlier quoted context omitted.

It's "hostile government" when analyzing the failure of Tor, because the tool should have kept this kid off of the suspect list. I'm guessing you don't even believe this to be a laudable goal, and that's precisely why we need anonymity tools.

Oh, for god's sake. First off, don't put words in the anigbrowl's mouth. Second off, it's not government hostility to investigate a bomb hoax that costs a lot of people money and inconveniences a ton of people. This guy wasn't engaging in civil disobedience. Third off, the dude could have just walked to any of the dozen coffee shops in harvard square with free wifi and done this all in the clear, and been fine. Tor c…

What specific words did I put in his figurative mouth? anigbrowl took a technical point about anonymity opsec and responded to it as if it were a political plea about the police, and you're doing the same. So I'm guessing that both you and him don't consider this a failure of Tor because you consider the "right thing" to have happened in the larger situation.

As I had said, it's a "hostile government" in the context of security analysis. Sorry, there just isn't a technical distinction between this kid and a dissident. To take a principled stand of saying dissidents should have the means to communicate freely, you also have to assert that you'd like for this kid to not get caught. Understandably this is a hard thing to do, given the chaos it would cause (is causing) in the short term.

Re: Harvard Student Charged In Bomb Hoax

#46

Post by grugq »

Crito wrote: post #43
grugq wrote: post #38

Earlier quoted context omitted.

Seriously, enough with the XKCD 538 fallacy. That is not how interrogations work. It just isn't. Violent torture is not how you get people to provide information. Actual interrogations are far more cunning and complex, involving psychological tricks and play against weaknesses in the human mind. Perpetuating this "they'll hit you until you confess" bullshit stops people from learning actually useful information about…

The comic is not literally suggesting that interrogations imply violence any more than it is literally suggesting that any violence must be done specifically with a wrench. Pedantism and comics do not go well together. The format is not meant for conveying exactingly precise information. Interpretation is required.

The comic does actually suggest that, and the comment I replied to specifically suggested that.

This sort of interrogation typically starts with "we know you did it, so why don't you make things easy for yourself...", not "break his finger so he knows we're serious".

The XKCD 538 fallacy is the delusional belief that torture and threats of violence are how people are coerced into confession during an interrogation. That is not the case. Perpetuating that fallacy actually helps interrogators, since the fear of "confess or else you'll get the wrench" is implanted in people's minds. Since that is not how things actually work, it is counter productive. It does not help anyone except the authorities. This is why I say stop perpetuating the fallacy. Seriously.

Re: Harvard Student Charged In Bomb Hoax

#47

Post by jbooth »

mindslight wrote: post #45
jbooth wrote: post #44

Earlier quoted context omitted.

Oh, for god's sake. First off, don't put words in the anigbrowl's mouth. Second off, it's not government hostility to investigate a bomb hoax that costs a lot of people money and inconveniences a ton of people. This guy wasn't engaging in civil disobedience. Third off, the dude could have just walked to any of the dozen coffee shops in harvard square with free wifi and done this all in the clear, and been fine. Tor c…

What specific words did I put in his figurative mouth? anigbrowl took a technical point about anonymity opsec and responded to it as if it were a political plea about the police, and you're doing the same. So I'm guessing that both you and him don't consider this a failure of Tor because you consider the "right thing" to have happened in the larger situation. As I had said, it's a "hostile government" in the context…

Well, sorry, I read it like you were the one injecting politics about 'government hostility' into it, regardless of Tor or SSL, ssh keys or whatever methods are involved. You seemed to be attributing motives to the previous poster with comments about "maybe you prefer it that way" which seem to place him on the side of surveilling fascists, and I thought that was unjustified but maybe I misread it. If you're not getting political about it, then neither am I, and sorry.

On a technical level.. I don't see how Tor could have performed better here. It's physically impossible for them to mask the fact that this guy connected, through the harvard network, to the tor network. The rest of it is between the police and the guy. If they had gotten proof that it was his specific machine that sent the emails through some weakness in Tor, then I'd lay some blame with Tor.

I disagree that I have to root for this kid not to get caught. Tor didn't fall down, and I'm not rooting for Tor to fall down. He could have stonewalled the cops, or he could have taken the most basic precaution on earth of not doing it from his frickin dorm room, Tor or no

EDIT: Actually, maybe they'd be able to correlate his mac address if they subpoena'd whatever coffee shop the email came from. That's a much bigger fishing expedition for "any coffee shop that connected to a tor node that day", though. But anyways, my point is that Tor can't be held responsible for things it will physically never be able to mask.

Re: Harvard Student Charged In Bomb Hoax

#48

Post by Crito »

grugq wrote: post #46
Crito wrote: post #43

Earlier quoted context omitted.

The comic is not literally suggesting that interrogations imply violence any more than it is literally suggesting that any violence must be done specifically with a wrench. Pedantism and comics do not go well together. The format is not meant for conveying exactingly precise information. Interpretation is required.

The comic does actually suggest that, and the comment I replied to specifically suggested that. This sort of interrogation typically starts with "we know you did it, so why don't you make things easy for yourself...", not "break his finger so he knows we're serious". The XKCD 538 fallacy is the delusional belief that torture and threats of violence are how people are coerced into confession during an interrogation. T…

The person who posted that comic was not literally suggesting that a $5 wrench was used. The FBI asked the guy some questions, and he folded. The XKCD comic was referenced because he rightly understood the comic to be making a general statement about the worth of cryptography when you consider the human element.

Seriously, you are not telling anybody here anything they did not already know.

Re: Harvard Student Charged In Bomb Hoax

#49

Post by mindslight »

jbooth wrote: post #47
mindslight wrote: post #45

Earlier quoted context omitted.

What specific words did I put in his figurative mouth? anigbrowl took a technical point about anonymity opsec and responded to it as if it were a political plea about the police, and you're doing the same. So I'm guessing that both you and him don't consider this a failure of Tor because you consider the "right thing" to have happened in the larger situation. As I had said, it's a "hostile government" in the context…

Well, sorry, I read it like you were the one injecting politics about 'government hostility' into it, regardless of Tor or SSL, ssh keys or whatever methods are involved. You seemed to be attributing motives to the previous poster with comments about "maybe you prefer it that way" which seem to place him on the side of surveilling fascists, and I thought that was unjustified but maybe I misread it. If you're not gett…

I'd just gotten done typing why it's impossible to convince most people this stuff matters, and was responding to a comment that seems to be written with the assumption that man-made laws are the ultimate authority. So I'll admit to being a bit presumptuous, but I really do believe it to be a fact that most people will never see the need for technically-granted anonymity, and that these opinions simply aren't relevant when discussing such software.

Back to the technical, isn't this the point of Tor "bridges" ? Of course these don't work out of the box - they require finding out the address of one out-of-band and manually configuring it. Wider casual adoption of Tor would have also fixed the problem in this case (if the resulting Tor user list was too long to question everybody).

The whole point is that ending up on a shortlist means you are essentially caught. This kid may have gotten off by playing it cool. But translated into the dissident scenario, it's still a loss.

Given the proliferation of surveillance cameras, the coffee shop scenario becomes much harder. Assuming after-the-fact facial recognition is standard these days, it would only work if there were enough other Harvard students also on tape. Low latency is the mortal enemy of mix networks.

Re: Harvard Student Charged In Bomb Hoax

#50

Post by ryanfreeborn »

grugq wrote: post #46
Crito wrote: post #43

Earlier quoted context omitted.

The comic is not literally suggesting that interrogations imply violence any more than it is literally suggesting that any violence must be done specifically with a wrench. Pedantism and comics do not go well together. The format is not meant for conveying exactingly precise information. Interpretation is required.

The comic does actually suggest that, and the comment I replied to specifically suggested that. This sort of interrogation typically starts with "we know you did it, so why don't you make things easy for yourself...", not "break his finger so he knows we're serious". The XKCD 538 fallacy is the delusional belief that torture and threats of violence are how people are coerced into confession during an interrogation. T…

I think you're reading into the $5 wrench a bit too literally. It's not about perpetuating the idea (false or not) that torture is an effective means of procuring intelligence. The point of the comic—at least to me—is about tunnel vision w/r/t security. Someone might invest a great amount of time and effort on encryption, but then look past the fact that the encryption is only as strong as the password that protects it...or that the password is only as secure as the place it is stored (lastpass, 1password, or even your brain).

There are many creative ways to circumvent encryption, and one of those ways could be something sinister like a wrench-torture, but it could also be through social engineering or psychological craft. The wrench is just an extreme example, maybe even a metaphor.

Post reply on HN