5 ms·

Is itthat this means that the steganography tools they were using did not prove effective? Or did the FBI discover their use by other means?

btilly 16y ago
According to http://www.networkworld.com/news/2010/063010-russian-spy-ring.html?hpg1=bn http://www.networkworld.com/news/2010/063010-russian-spy-rin... law enforcement officers found a 27-character password written on a piece of paper at one suspect's house, and then used that to get into the stenography program that the suspect had, which then let them extract the hidden messages from the images. Therefore the cryptography does not seem to have been the weak link. (In truth, it seldom is.)
- Groxx 16y ago
  So... the flaw in their security model is that they wrote down their password. If people can memorize hundreds of digits of Pi (I personally got past ~80 out of boredom (before I found programming), though I've since forgotten most), they could memorize 27 characters to protect everyone else in the system. Were I russia, and if these are their spies, I don't think I'd be too sad to lose that pair.
  - btilly 16y ago
    You can make a secure enough password that is much lower than 27 characters pretty easily. Let me give an example. My brother is named Aaron. First I think of a memorable sentence about him. "Aaron got me to take money from a wishing well when I was 8." OK, that's memorable to me and not many people know that story. Now I'll just take first letters and make a few obvious substitutions. "Agm2t$fWW@8" That's 11 characters. It includes capitals, small letters, numbers and punctuation. It would be easy for me to remember. And would be a pretty hard password to break. If they had passwords like that, I doubt that the FBI would have ever broken into the program. (Though there must have been some other reason to be suspicious.) (For the record I just made that up. It has no relation to any password I have ever used.)
    - Groxx 16y ago
      Or you could've just used that whole sentence as a password. I'd be willing to bet it's significantly more secure than those 11 characters, even if a dictionary-based attacker used ideal grammar rules and a bit of knowledge about you (say, family + pet names, ages, etc; only public knowledge).
      - btilly 16y ago
        True, but typing the whole sentence gets very, very annoying, quite quickly. Plus the short version will eventually become muscle memory. It is counter-intuitive, but frequently making security more convenient makes it more likely to happen, which improves security. Conversely measures that should increase security cause users to work around the annoyance, which reduces security. (For instance in this case the users could just leave a session running.)
        marbu 16y ago
        That's not true if you do touch typing. Since you are using ordinary words you can type it quickly almost immediatelly without need to wait for muscle memory to develop. This way you get password which is both easy to remember and easy to type and at the same time is long enough. See Diceware method (http://world.std.com/~reinhold/diceware.html http://world.std.com/~reinhold/diceware.html) if you are interested in this scheme.
        btilly 16y ago
        I disbelieve. I touch type at about 60 wpm. (Where your top is depends on your coordination, but for lots of people that is about the top.) Therefore it takes 5-6 seconds to type in an 11 word password. By contrast a frequently typed 11 character password typed from muscle memory takes no more than a second or two. That's substantially faster. In fact even when I'm still learning the password, I type it faster than I can type the original sentence.

btilly 16y ago

According to http://www.networkworld.com/news/2010/063010-russian-spy-ring.html?hpg1=bn http://www.networkworld.com/news/2010/063010-russian-spy-rin... law enforcement officers found a 27-character password written on a piece of paper at one suspect's house, and then used that to get into the stenography program that the suspect had, which then let them extract the hidden messages from the images. Therefore the cryptography does not seem to have been the weak link. (In truth, it seldom is.)

Groxx 16y ago
So... the flaw in their security model is that they wrote down their password. If people can memorize hundreds of digits of Pi (I personally got past ~80 out of boredom (before I found programming), though I've since forgotten most), they could memorize 27 characters to protect everyone else in the system. Were I russia, and if these are their spies, I don't think I'd be too sad to lose that pair.
- btilly 16y ago
  You can make a secure enough password that is much lower than 27 characters pretty easily. Let me give an example. My brother is named Aaron. First I think of a memorable sentence about him. "Aaron got me to take money from a wishing well when I was 8." OK, that's memorable to me and not many people know that story. Now I'll just take first letters and make a few obvious substitutions. "Agm2t$fWW@8" That's 11 characters. It includes capitals, small letters, numbers and punctuation. It would be easy for me to remember. And would be a pretty hard password to break. If they had passwords like that, I doubt that the FBI would have ever broken into the program. (Though there must have been some other reason to be suspicious.) (For the record I just made that up. It has no relation to any password I have ever used.)
  - Groxx 16y ago
    Or you could've just used that whole sentence as a password. I'd be willing to bet it's significantly more secure than those 11 characters, even if a dictionary-based attacker used ideal grammar rules and a bit of knowledge about you (say, family + pet names, ages, etc; only public knowledge).
    - btilly 16y ago
      True, but typing the whole sentence gets very, very annoying, quite quickly. Plus the short version will eventually become muscle memory. It is counter-intuitive, but frequently making security more convenient makes it more likely to happen, which improves security. Conversely measures that should increase security cause users to work around the annoyance, which reduces security. (For instance in this case the users could just leave a session running.)
      - marbu 16y ago
        That's not true if you do touch typing. Since you are using ordinary words you can type it quickly almost immediatelly without need to wait for muscle memory to develop. This way you get password which is both easy to remember and easy to type and at the same time is long enough. See Diceware method (http://world.std.com/~reinhold/diceware.html http://world.std.com/~reinhold/diceware.html) if you are interested in this scheme.
        btilly 16y ago
        I disbelieve. I touch type at about 60 wpm. (Where your top is depends on your coordination, but for lots of people that is about the top.) Therefore it takes 5-6 seconds to type in an 11 word password. By contrast a frequently typed 11 character password typed from muscle memory takes no more than a second or two. That's substantially faster. In fact even when I'm still learning the password, I type it faster than I can type the original sentence.