Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

‘Every message was copied to the police’

theguardian.com

Post reply on HN
Print view View original

51–60 of 193 posts

Re: ‘Every message was copied to the police’

#51

Post by dredmorbius »

kube-system wrote: post #18
sumnole wrote: post #12

Earlier quoted context omitted.

Besides criminals, even legitimate businesses might start to prefer offline methods. With the decline of privacy comes corporate espionage and that's no good for business.

Legitimate businesses can much more easily avoid being scammed by vendors because their legitimate businesses are protected by the legal system. They also can openly discuss their experiences with vendors, because they're not hiding from anyone.

How's that working out for victims of ransomware attacks or nation-state corporate espionage?

Re: ‘Every message was copied to the police’

#52

Post by earnesti »

chongli wrote: post #42
tokai wrote: post #34

Earlier quoted context omitted.

You would think that, but the whole an0m thing showed that it wasn't really the case.

That’s one case. It doesn’t apply to all criminal organizations. The cartels in Mexico are sophisticated enough to build their own cell networks [1] to evade wiretapping. Why couldn’t they also recruit engineers to build their own crypto and secure protocols? [1] https://www.npr.org/2011/12/09/143442365/mexico-busts-drug-c...

Also, there are lot of open source software in the space - no need to develop your own, just scan the code for backdoors.

Re: ‘Every message was copied to the police’

#53

Post by rtkwe »

VLM wrote: post #45
GuB-42 wrote: post #39

Earlier quoted context omitted.

One time pads are really inconvenient and hard to get right. That's why they are almost never used in practice, despite being theoretically perfect. First, you need to generate large amounts of unbiased, true random data. If it is not true randomness, you have a stream cypher, and if you "rolled your own", probably not a good one. They you have to store the one-time pad. It is usually too big to memorize. You have to…

IF you want to send arbitrary data. Usually people don't need that. For something like coke smuggling you just need to know its on the way, get ready. So the OTP could be something as lame as "if you get a phone call from some rando who says 'Taste the Feeling'" then the next boat is full of coke, or if not, then the next boat is not full of coke". Actually terrible idea as taste the feeling was a coke company slogan…

You generally need more information flow than that to successfully coordinate a big logistics move like this though which is where you need arbitrary messages.

Re: ‘Every message was copied to the police’

#54

Post by unnouinceput »

Y_Y wrote: post #38
Buttons840 wrote: post #27

Earlier quoted context omitted.

Why not both? Encrypt your message with your home grown encryption, then send it through standard TLS. Both would have to fail for the message to be revealed. Sometimes when I'm wearing my tinfoil hat I wonder if the advice to avoid rolling your own crypto is a conspiracy. The powers that be want to maintain their backdoors, maybe? Probably not. Of course, it's definitely true that there are more attack vectors out t…

I think that this isn't strictly true. If you naïvely apply bad encryption before good you may weaken the entire system. For a silly example, imagine your "homegrown" crypto adds a publicly known plaintext to the start of the cyphertext. I think this is discussed in Schneier's textbook.

So? https it adds a publicly known header at beginning of any connection anyway and I don't see public key encryption being cracked anyway. Or blockchains do that too, are wallets being emptied by the ones that don't have the private key?

And since you mentioned Schneier textbook, he also said that a good safe is the one that you give to your adversaries with the blue print of how it's made and still is uncracked, not the one that you dump in the middle of the ocean and ask your adversaries to crack it (security through obscurity).

PGP is still uncracked, if I'd become a criminal then public PGP with at least 8k bits key would be my choice.

Re: ‘Every message was copied to the police’

#55

Post by TeMPOraL »

generalizations wrote: post #31
Buttons840 wrote: post #27

Earlier quoted context omitted.

Why not both? Encrypt your message with your home grown encryption, then send it through standard TLS. Both would have to fail for the message to be revealed. Sometimes when I'm wearing my tinfoil hat I wonder if the advice to avoid rolling your own crypto is a conspiracy. The powers that be want to maintain their backdoors, maybe? Probably not. Of course, it's definitely true that there are more attack vectors out t…

I also wonder why there's such a pushback against one-time-pads. The common critiques don't seem to be any greater of a risk than the holes we've already encountered (e.g. heartbleed). I think I remember a scifi story that mentioned some character who worked in the one-time-pad shipping business. I guess a spacecraft full of data storage can hold enough random data to last for a long time. Seems like we should at lea…

Is there a pushback against one-time-pads? I thought they are the perfect, unbreakable encryption scheme - just that they come with extreme logistical problems.

> I think I remember a scifi story that mentioned some character who worked in the one-time-pad shipping business.

A Fire Upon the Deep, by Vernor Vinge.

Re: ‘Every message was copied to the police’

#57

Post by monocasa »

VLM wrote: post #50
monocasa wrote: post #40

Earlier quoted context omitted.

The easier way to attack this is by instituting a know your customer law for phone systems including prepaid SIMs, combined with accomplice charges for anyone who's SIM is used in connection with criminal acts.

People are too free with their phones. Just walk into a bar and say you're too drunk to drive and could the bartender call my wife to pick me up? Not knowing its actually picking up $60M worth of coke instead of picking up me. Or pull off to the side of the road, walk in well dressed, wave a dead iphone in front of them, ask the receptionist "hey my car broke down and my battery is dead, could you call this number an…

That's a function of there not being penalties. You'd see that change if the laws changed.

Re: ‘Every message was copied to the police’

#58

Post by shoto_io »

dredmorbius wrote: post #25

There've been a number of earlier HN discusions of this story: 5 days ago, 31 points, 5 comments: The story of An0m Chat, Run by the Police https://news.ycombinator.com/item?id=28490871 https://www.theguardian.com/australia-news/2021/sep/11/insid... 3 months ago, 130 points, 62 comments: Why no-one in America was arrested as part of Operation Ironside https://news.ycombinator.com/item?id=27509550 https://www.abc.net.…

This is an interesting feature idea for HN!

Can someone please build this? Restrictions: You may only use Rust and sparkle some AI on it.

Re: ‘Every message was copied to the police’

#60

Post by dredmorbius »

sharklazer wrote: post #5

Never outsource security if you actually want security...

I think that's the wrong lesson here.

An0m created two vulnerabilities to its users:

- It was specifically marketed to criminal entities. That is, it sharply reduced the search space. In a 33 bit world, An0m is 14 bits.

- It was specifically back-doored.

"Roll your own" avoids the 2nd case but not the first. By definition, rolling your own already reduces search space to the domain of interest. (Other means of evidence gathering may be needed, but should be reasonably viablle.)

Instead, what you want is:

- Blend in with the crowd.

- Utilise widely-shared communications protocols, implementations, and tools.

- Ensure that these have secure cryptographic methods and implementations.

- Audit the hell out of these and offer bounties for any vulnerabilities which can be demonstrated.

If at all possible, see to it that widely-used, generally-available communications tools themselves offer secure cryptographic methods and implemntations. And school your minions in their proper and effective use and limits.

Post reply on HN