6 ms·

For those of you who don't know what GCHQ is, it's the UK's NSA with all the problems that entails - https://en.wikipedia.org/wiki/Government_Communications_He

by yarrel 10y ago

For those of you who don't know what GCHQ is, it's the UK's NSA with all the problems that entails - https://en.wikipedia.org/wiki/Government_Communications_Headquarters https://en.wikipedia.org/wiki/Government_Communications_Head... "In 2013, GCHQ received considerable media attention when the former National Security Agency contractor Edward Snowden revealed that the agency was in the process of collecting all online and telephone data in the UK via the Tempora programme."

dimino 10y ago
I was a little blown away that it was that GCHQ. That said, how could they possibly collect or intercept this, isn't it a bunch of client side scripts, all hosted on GitHub?
- matt4077 10y ago
  Theoretically, they could sabotage the crypto algorithms, hope that someone uses it, intercept that communication, and decrypt it using the sneaky weakness they introduced. Or the right circumstances could cause the library to make requests to their secret government hacking command-and-control server. Seeing that they released this at github.com/gchq/..., I'd keep my eyes open for requests to secret-hacked-data-backchannel.open-exploit-project.gchq.co.uk (Or, with less sarcasm: this is probably the project on github with the lowest possibility of containing government backdoors). (or maybe that's just what they want you to believe) (or maybe that's just what /we/ want you to believe) (or maybe that's just what /I/ want you to believe)
- _coldfire 10y ago
  You should probably read the manual before using a webapp for your encryption needs. From the Readme: >it should be noted that the analyst is not a professional developer and the code has not been peer-reviewed for compliance with a formal specification >Cryptographic operations in CyberChef should not be relied upon to provide security in any situation. No guarantee is offered for their correctness.
  - dimino 10y ago
    I did read that, and I don't believe it provides any clarity related to what I wrote.
mgalka 10y ago
Other than the anachronistic name (thought "cyber" wend out in the 90's), I'm extremely impressed to see such an awesome tool come out of the public sector. Kudos to GCHQ!
- dfc 10y ago
  > "cyber" wend out in the 90's I take it you have no exposure to the public sector? Referring to "Cyber" as "IT/Info/Computer/Network Security" will immediately identify you as an outsider in man public sector positions.
  - schoen 10y ago
    And vice versa outside of government!
- omouse 10y ago
  It would be better if we knew they weren't using it for evil.
- raesene9 10y ago
  Nah, "Cyber Security" is becoming the defacto term for referring to what I would have called IT Security in the past (some interesting reading on the topic here http://cyber.uk/cyber/ http://cyber.uk/cyber/)
  - mgalka 10y ago
    The other day someone was telling me they used to run a website called CyberHomes. All I could think of was how weird that would sound today.
- samwilliams 10y ago
  > thought "cyber" wend out in the 90's A year ago someone in my research group claimed that they were 'getting into cyber'. I looked around the room and almost every other member of the group looked confused and a little concerned. Apparently 'cyber' has become a byword for 'cyber security'. I hope that this does not last.
rxbudian 10y ago
Shouldn't it be called Cyber UK Army knife instead of Cyber Swiss Army Knife, then?
omouse 10y ago
Proof that technology is neutral and isn't all about freedom and ethics; will be avoiding anything published by them.
- readme 10y ago
  Why? You admit yourself technology is neutral.
  - omouse 10y ago
    Yes which means I have to apply my own reasoning and ethical thinking.
    - readme 10y ago
      So does your chain of reasoning go like this: GHCQ made the application. GHCQ is a spy agency. Therefore, GHCQ must have planted a backdoor in the application? Because that would be a logical fallacy.
- deleted 10y ago
  [deleted]
dct 10y ago
All the contributors have rather cryptic usernames: https://github.com/orgs/gchq/people https://github.com/orgs/gchq/people
- notyourwork 10y ago
  And then there is james257.
- Demcox 10y ago
  Haha, I would never have noticed that if you hadn't written it!
- corv 10y ago
  Take a hint

by yarrel 10y ago

dimino 10y ago

I was a little blown away that it was that GCHQ. That said, how could they possibly collect or intercept this, isn't it a bunch of client side scripts, all hosted on GitHub?

matt4077 10y ago
Theoretically, they could sabotage the crypto algorithms, hope that someone uses it, intercept that communication, and decrypt it using the sneaky weakness they introduced. Or the right circumstances could cause the library to make requests to their secret government hacking command-and-control server. Seeing that they released this at github.com/gchq/..., I'd keep my eyes open for requests to secret-hacked-data-backchannel.open-exploit-project.gchq.co.uk (Or, with less sarcasm: this is probably the project on github with the lowest possibility of containing government backdoors). (or maybe that's just what they want you to believe) (or maybe that's just what /we/ want you to believe) (or maybe that's just what /I/ want you to believe)
_coldfire 10y ago
You should probably read the manual before using a webapp for your encryption needs. From the Readme: >it should be noted that the analyst is not a professional developer and the code has not been peer-reviewed for compliance with a formal specification >Cryptographic operations in CyberChef should not be relied upon to provide security in any situation. No guarantee is offered for their correctness.
- dimino 10y ago
  I did read that, and I don't believe it provides any clarity related to what I wrote.

mgalka 10y ago

Other than the anachronistic name (thought "cyber" wend out in the 90's), I'm extremely impressed to see such an awesome tool come out of the public sector. Kudos to GCHQ!

dfc 10y ago
> "cyber" wend out in the 90's I take it you have no exposure to the public sector? Referring to "Cyber" as "IT/Info/Computer/Network Security" will immediately identify you as an outsider in man public sector positions.
- schoen 10y ago
  And vice versa outside of government!
omouse 10y ago
It would be better if we knew they weren't using it for evil.
raesene9 10y ago
Nah, "Cyber Security" is becoming the defacto term for referring to what I would have called IT Security in the past (some interesting reading on the topic here http://cyber.uk/cyber/ http://cyber.uk/cyber/)
- mgalka 10y ago
  The other day someone was telling me they used to run a website called CyberHomes. All I could think of was how weird that would sound today.
samwilliams 10y ago
> thought "cyber" wend out in the 90's A year ago someone in my research group claimed that they were 'getting into cyber'. I looked around the room and almost every other member of the group looked confused and a little concerned. Apparently 'cyber' has become a byword for 'cyber security'. I hope that this does not last.

rxbudian 10y ago

Shouldn't it be called Cyber UK Army knife instead of Cyber Swiss Army Knife, then?

omouse 10y ago

Proof that technology is neutral and isn't all about freedom and ethics; will be avoiding anything published by them.

readme 10y ago
Why? You admit yourself technology is neutral.
- omouse 10y ago
  Yes which means I have to apply my own reasoning and ethical thinking.
  - readme 10y ago
    So does your chain of reasoning go like this: GHCQ made the application. GHCQ is a spy agency. Therefore, GHCQ must have planted a backdoor in the application? Because that would be a logical fallacy.
deleted 10y ago
[deleted]

dct 10y ago

All the contributors have rather cryptic usernames: https://github.com/orgs/gchq/people https://github.com/orgs/gchq/people

notyourwork 10y ago
And then there is james257.
Demcox 10y ago
Haha, I would never have noticed that if you hadn't written it!
corv 10y ago
Take a hint