3 ms·

They get an easy pass. The idea of this ever going to Amazon in the first place just seems extraordinarily ill-conceived: There was no way it was going to stay

by ergo98 16y ago

They get an easy pass. The idea of this ever going to Amazon in the first place just seems extraordinarily ill-conceived: There was no way it was going to stay up. Wikileaks is pursuing a remarkably old-school method of releasing these, with the whole centralized distribution point. They should release the entire set via P2P with collections symmetrically encrypted. They could then -- via the most rudimentary methods -- release individual keys at chosen intervals to still obtain the same throttled response. And one day when the feds are kicking in the doors, just drop the entire key collection.

glhaynes 16y ago
I wonder why they're not doing that.
- sliverstorm 16y ago
  It's far less visible to normal, ordinary people, who they need to reach. The success of WikiLeaks depends in part on being highly visible and accessible by anyone and everyone- ironically, much the same as terrorism. (Not that I believe they are a terrorist organization, but they definitely function kind of like one, at least superficially) I imagine the day somebody figures out how to make a HTTP-compatible P2P network that allows you to browse web pages hosted on bittorrent will be the day WikiLeaks moves to P2P.
  - ars 16y ago
    > It's far less visible to normal, ordinary people, who they need to reach. There's no reason they can't do both.
    - eneveu 16y ago
      I think there is more to it than a desire to space the releases to get better PR. They may want to verify the authenticity of the documents to avoid fake leaks. They may also want to edit some documents to remove data that would put individual persons at risk, like they did with Cablegate. Doing this takes time, and may not be short-circuited easily. They can't simply encrypt the files, release them using P2P, and then edit them / check them for authenticity. I guess it would be useful as an insurance, though.
- ergo98 16y ago
  Even better, they should encrypt with a method that is reasonably, large-scale crackable around the window of their planned release. That would bring a lot of attention to cryptography (and the vulnerability of the same) as every media organization rents out massive AWS GPU clusters to try to crack it. That would be pretty entertaining. And if something happened to them...well it's going to be discovered anyways.
  - JoachimSchipper 16y ago
    > the vulnerability of [cryptography] Well, no. Competently done crypto is uncrackable for all practical purposes without side-channel attacks. Or, maybe, quantum computers (RSA; but why would you use RSA for this?)
    - ergo98 16y ago
      Well, yes, of course. Competently done. Competently done crypotgraphy is rare, and most common cryptography is not competently done. Which is exactly the point of my post.
      - JoachimSchipper 16y ago
        Most crypto implementations are vulnerable, yes, but the percentage of vulnerable deployed crypto implementations as a fraction of all deployed implementations looks much better. Note that I'm talking crypto: the OpenSSL people seem quite able to make all sorts of mistakes, but it's almost never the crypto itself that is at fault. (Today's news: a workaround for Netscape's stupidities apparently allows attackers to downgrade to a worse protocol suite in certain cases. Stupid bug, but not crypto per se.) So yes, there are errors, but publishing something AES-encrypted and giving away, say, half the key doesn't tell us anything about those.
    - arethuza 16y ago
      Are there any forms of encryption which take a predictable and precisely defined amount of computing power to decrypt? e.g. Some asymmetric so that I could encrypt something easily but then require someone who wants to decrypt the message to perform 100 Trillion operations to decrypt it?
- MikeCapone 16y ago
  I know we all assume that because something seems obvious that people must have though of it, but history has shown that it isn't the case. It could be simply that they haven't though of it. Maybe send them a email? As for the visibility of Wikileaks, I think that what matters is that journalists get the files. That's how most people hear of them. So it wouldn't really matter if they were released in a distributed P2P fashion, as long as the files are easy to find and recognize (f.ex. Wikileaks-01-01-2010-003.PGP or whatever).
- JoachimSchipper 16y ago
  There was a insurance.zip floating around a while ago. I don't think they've released the keys yet...
- crocowhile 16y ago
  They have actually released some big so-called "insurance" files via torrent in the past. They are AES256 encrypted. http://thepiratebay.org/torrent/5728614/Wikileaks__insurance__file http://thepiratebay.org/torrent/5728614/Wikileaks__insurance...
nochiel 16y ago
"Wikileaks is pursuing a remarkably old-school method of releasing these, with the whole centralized distribution point." Please could you clarify what you mean. According to cablegate.wikileaks.org the distribution is being done via torrent (with an increasingly large number of seeds becoming available quickly). http://file.wikileaks.org/torrent/cablegate/cablegate-201012021301.7z.torrent http://file.wikileaks.org/torrent/cablegate/cablegate-201012...

by ergo98 16y ago

glhaynes 16y ago

I wonder why they're not doing that.

sliverstorm 16y ago
It's far less visible to normal, ordinary people, who they need to reach. The success of WikiLeaks depends in part on being highly visible and accessible by anyone and everyone- ironically, much the same as terrorism. (Not that I believe they are a terrorist organization, but they definitely function kind of like one, at least superficially) I imagine the day somebody figures out how to make a HTTP-compatible P2P network that allows you to browse web pages hosted on bittorrent will be the day WikiLeaks moves to P2P.
- ars 16y ago
  > It's far less visible to normal, ordinary people, who they need to reach. There's no reason they can't do both.
  - eneveu 16y ago
    I think there is more to it than a desire to space the releases to get better PR. They may want to verify the authenticity of the documents to avoid fake leaks. They may also want to edit some documents to remove data that would put individual persons at risk, like they did with Cablegate. Doing this takes time, and may not be short-circuited easily. They can't simply encrypt the files, release them using P2P, and then edit them / check them for authenticity. I guess it would be useful as an insurance, though.
ergo98 16y ago
Even better, they should encrypt with a method that is reasonably, large-scale crackable around the window of their planned release. That would bring a lot of attention to cryptography (and the vulnerability of the same) as every media organization rents out massive AWS GPU clusters to try to crack it. That would be pretty entertaining. And if something happened to them...well it's going to be discovered anyways.
- JoachimSchipper 16y ago
  > the vulnerability of [cryptography] Well, no. Competently done crypto is uncrackable for all practical purposes without side-channel attacks. Or, maybe, quantum computers (RSA; but why would you use RSA for this?)
  - ergo98 16y ago
    Well, yes, of course. Competently done. Competently done crypotgraphy is rare, and most common cryptography is not competently done. Which is exactly the point of my post.
    - JoachimSchipper 16y ago
      Most crypto implementations are vulnerable, yes, but the percentage of vulnerable deployed crypto implementations as a fraction of all deployed implementations looks much better. Note that I'm talking crypto: the OpenSSL people seem quite able to make all sorts of mistakes, but it's almost never the crypto itself that is at fault. (Today's news: a workaround for Netscape's stupidities apparently allows attackers to downgrade to a worse protocol suite in certain cases. Stupid bug, but not crypto per se.) So yes, there are errors, but publishing something AES-encrypted and giving away, say, half the key doesn't tell us anything about those.
  - arethuza 16y ago
    Are there any forms of encryption which take a predictable and precisely defined amount of computing power to decrypt? e.g. Some asymmetric so that I could encrypt something easily but then require someone who wants to decrypt the message to perform 100 Trillion operations to decrypt it?
MikeCapone 16y ago
I know we all assume that because something seems obvious that people must have though of it, but history has shown that it isn't the case. It could be simply that they haven't though of it. Maybe send them a email? As for the visibility of Wikileaks, I think that what matters is that journalists get the files. That's how most people hear of them. So it wouldn't really matter if they were released in a distributed P2P fashion, as long as the files are easy to find and recognize (f.ex. Wikileaks-01-01-2010-003.PGP or whatever).
JoachimSchipper 16y ago
There was a insurance.zip floating around a while ago. I don't think they've released the keys yet...
crocowhile 16y ago
They have actually released some big so-called "insurance" files via torrent in the past. They are AES256 encrypted. http://thepiratebay.org/torrent/5728614/Wikileaks__insurance__file http://thepiratebay.org/torrent/5728614/Wikileaks__insurance...

nochiel 16y ago

"Wikileaks is pursuing a remarkably old-school method of releasing these, with the whole centralized distribution point." Please could you clarify what you mean. According to cablegate.wikileaks.org the distribution is being done via torrent (with an increasingly large number of seeds becoming available quickly). http://file.wikileaks.org/torrent/cablegate/cablegate-201012021301.7z.torrent http://file.wikileaks.org/torrent/cablegate/cablegate-201012...