5 ms·
So Krebs has no conclusive proof for anything? As he himself admits: > It is possible that Zu is instead a white hat security researcher or confidential infor
by lawl 11y ago
So Krebs has no conclusive proof for anything?
As he himself admits:
> It is possible that Zu is instead a white hat security researcher or confidential informant
Jeez, how about talking to the police and let them do their job, or at the very least censor the name.
This is just a witch hunt.
- watty 11y agoWhy do they need to censor an alias account for someone connected to the hack? There is no "Zu", the photos of Zu and his locations are copied from the internet.
- lawl 11y agoFor the same reason I don't go around and post an article how "watty" did $x. It doesn't matter if this is a pseudonym and what kind of avatar you use. If watty might be implicated in something illegal I should go talk to the police and not publicly witch hunt your handle, no?
- watty 11y agoI still don't see the problem. If this handle was directly connected with $x I would fully expect people to be discussing my handle in blogs/forums. Going to the cops is fine and dandy too of course. Krebs even clarifies "If Zu wasn’t involved in the hack, he almost certainly knows who was.".
- deleted 11y ago[deleted]
- Nadya 11y agoSo I'm 85% sure that ${User} is connected to a CP ring in some way. Should I publicly out ${User} even though I could be wrong and let them suffer the ramifications that it causes? If they lose their job, spouse, shunned by family, receive death threats, and have an internet hate mob trying to find where they live because the evidence was "leaning towards them" does that make it okay for me to call them out as being connected? "Oops, I was wrong. They aren't connected after all." doesn't fix ${User}'s life. Even if it opens up a defamation lawsuit, it won't fix their life - and the lawsuit will be expensive - and even when they win they'll hardly see any money because I'm some nobody who doesn't have any money for them to sue for to begin with. Do you still not see the problem? Edit: Not to mention I may not even be in their country.
- ChuckMcM 11y agounclear if its a witch hunt or if Krebs wants to be on record with his reasoning in order to secure some of that $500K bounty if it turns out to be this guy? I've never figured out how they actually decide who gets what if they have to split that up.
- lawl 11y agoHe could have not posted the twitter handle but a hash instead? echo "The Twitter handle Brian Krebs anonymized in this blog post is..." | sha256sum There you go, you can prove it to anyone at any point in time.
- dougk16 11y agoNot familiar with Twitter, but if you can easily get all or most handles through their API or scraping then wouldn't it be easy to brute-force reverse the hash? Edit: Maybe add a private salt? Edit again: Oh, missed that "The Twitter handle Brian Krebs..." is effectively the private salt, nevermind.
- slig 11y agoProbably one should do something similar to this: echo "The Twitter handle Brian Krebs anonymized in this blog post is @user and this a random salt qF7KKAUxtrEtQbnj4LPkUZM4." | sha256sum
- biot 11y agoThe inclusion of a salt only protects against precomputed hashes. It makes almost no difference to how many millions of hashes one can perform per second.
- Ded7xSEoPKYNsDd 11y agoI think the idea is not to publicize the salt. The proof still works (after both user name and salt are publicly known), but a dictionary attack with all twitter handles won't work.
- exelius 11y agoBecause the account is obviously a pseudonym?