4 ms·

I wonder why they're not doing that.

sliverstorm 16y ago
It's far less visible to normal, ordinary people, who they need to reach. The success of WikiLeaks depends in part on being highly visible and accessible by anyone and everyone- ironically, much the same as terrorism. (Not that I believe they are a terrorist organization, but they definitely function kind of like one, at least superficially) I imagine the day somebody figures out how to make a HTTP-compatible P2P network that allows you to browse web pages hosted on bittorrent will be the day WikiLeaks moves to P2P.
- ars 16y ago
  > It's far less visible to normal, ordinary people, who they need to reach. There's no reason they can't do both.
  - eneveu 16y ago
    I think there is more to it than a desire to space the releases to get better PR. They may want to verify the authenticity of the documents to avoid fake leaks. They may also want to edit some documents to remove data that would put individual persons at risk, like they did with Cablegate. Doing this takes time, and may not be short-circuited easily. They can't simply encrypt the files, release them using P2P, and then edit them / check them for authenticity. I guess it would be useful as an insurance, though.
ergo98 16y ago
Even better, they should encrypt with a method that is reasonably, large-scale crackable around the window of their planned release. That would bring a lot of attention to cryptography (and the vulnerability of the same) as every media organization rents out massive AWS GPU clusters to try to crack it. That would be pretty entertaining. And if something happened to them...well it's going to be discovered anyways.
- JoachimSchipper 16y ago
  > the vulnerability of [cryptography] Well, no. Competently done crypto is uncrackable for all practical purposes without side-channel attacks. Or, maybe, quantum computers (RSA; but why would you use RSA for this?)
  - ergo98 16y ago
    Well, yes, of course. Competently done. Competently done crypotgraphy is rare, and most common cryptography is not competently done. Which is exactly the point of my post.
    - JoachimSchipper 16y ago
      Most crypto implementations are vulnerable, yes, but the percentage of vulnerable deployed crypto implementations as a fraction of all deployed implementations looks much better. Note that I'm talking crypto: the OpenSSL people seem quite able to make all sorts of mistakes, but it's almost never the crypto itself that is at fault. (Today's news: a workaround for Netscape's stupidities apparently allows attackers to downgrade to a worse protocol suite in certain cases. Stupid bug, but not crypto per se.) So yes, there are errors, but publishing something AES-encrypted and giving away, say, half the key doesn't tell us anything about those.
  - arethuza 16y ago
    Are there any forms of encryption which take a predictable and precisely defined amount of computing power to decrypt? e.g. Some asymmetric so that I could encrypt something easily but then require someone who wants to decrypt the message to perform 100 Trillion operations to decrypt it?
    - JoachimSchipper 16y ago
      It's almost always probabilistic - someone guessing the right key the first time could break it very quickly. It may be possible to reduce variance in cracking times by requiring multiple cracks (use a secret sharing scheme to break up the "real" key in chunks; encrypt each chunk in a crackable way.)
MikeCapone 16y ago
I know we all assume that because something seems obvious that people must have though of it, but history has shown that it isn't the case. It could be simply that they haven't though of it. Maybe send them a email? As for the visibility of Wikileaks, I think that what matters is that journalists get the files. That's how most people hear of them. So it wouldn't really matter if they were released in a distributed P2P fashion, as long as the files are easy to find and recognize (f.ex. Wikileaks-01-01-2010-003.PGP or whatever).
JoachimSchipper 16y ago
There was a insurance.zip floating around a while ago. I don't think they've released the keys yet...
crocowhile 16y ago
They have actually released some big so-called "insurance" files via torrent in the past. They are AES256 encrypted. http://thepiratebay.org/torrent/5728614/Wikileaks__insurance__file http://thepiratebay.org/torrent/5728614/Wikileaks__insurance...

It's far less visible to normal, ordinary people, who they need to reach. The success of WikiLeaks depends in part on being highly visible and accessible by anyone and everyone- ironically, much the same as terrorism. (Not that I believe they are a terrorist organization, but they definitely function kind of like one, at least superficially) I imagine the day somebody figures out how to make a HTTP-compatible P2P network that allows you to browse web pages hosted on bittorrent will be the day WikiLeaks moves to P2P.

ars 16y ago
> It's far less visible to normal, ordinary people, who they need to reach. There's no reason they can't do both.
- eneveu 16y ago
  I think there is more to it than a desire to space the releases to get better PR. They may want to verify the authenticity of the documents to avoid fake leaks. They may also want to edit some documents to remove data that would put individual persons at risk, like they did with Cablegate. Doing this takes time, and may not be short-circuited easily. They can't simply encrypt the files, release them using P2P, and then edit them / check them for authenticity. I guess it would be useful as an insurance, though.

ergo98 16y ago

Even better, they should encrypt with a method that is reasonably, large-scale crackable around the window of their planned release. That would bring a lot of attention to cryptography (and the vulnerability of the same) as every media organization rents out massive AWS GPU clusters to try to crack it. That would be pretty entertaining. And if something happened to them...well it's going to be discovered anyways.

JoachimSchipper 16y ago
> the vulnerability of [cryptography] Well, no. Competently done crypto is uncrackable for all practical purposes without side-channel attacks. Or, maybe, quantum computers (RSA; but why would you use RSA for this?)
- ergo98 16y ago
  Well, yes, of course. Competently done. Competently done crypotgraphy is rare, and most common cryptography is not competently done. Which is exactly the point of my post.
  - JoachimSchipper 16y ago
    Most crypto implementations are vulnerable, yes, but the percentage of vulnerable deployed crypto implementations as a fraction of all deployed implementations looks much better. Note that I'm talking crypto: the OpenSSL people seem quite able to make all sorts of mistakes, but it's almost never the crypto itself that is at fault. (Today's news: a workaround for Netscape's stupidities apparently allows attackers to downgrade to a worse protocol suite in certain cases. Stupid bug, but not crypto per se.) So yes, there are errors, but publishing something AES-encrypted and giving away, say, half the key doesn't tell us anything about those.
- arethuza 16y ago
  Are there any forms of encryption which take a predictable and precisely defined amount of computing power to decrypt? e.g. Some asymmetric so that I could encrypt something easily but then require someone who wants to decrypt the message to perform 100 Trillion operations to decrypt it?
  - JoachimSchipper 16y ago
    It's almost always probabilistic - someone guessing the right key the first time could break it very quickly. It may be possible to reduce variance in cracking times by requiring multiple cracks (use a secret sharing scheme to break up the "real" key in chunks; encrypt each chunk in a crackable way.)

MikeCapone 16y ago

I know we all assume that because something seems obvious that people must have though of it, but history has shown that it isn't the case. It could be simply that they haven't though of it. Maybe send them a email? As for the visibility of Wikileaks, I think that what matters is that journalists get the files. That's how most people hear of them. So it wouldn't really matter if they were released in a distributed P2P fashion, as long as the files are easy to find and recognize (f.ex. Wikileaks-01-01-2010-003.PGP or whatever).

JoachimSchipper 16y ago

There was a insurance.zip floating around a while ago. I don't think they've released the keys yet...

crocowhile 16y ago

They have actually released some big so-called "insurance" files via torrent in the past. They are AES256 encrypted. http://thepiratebay.org/torrent/5728614/Wikileaks__insurance__file http://thepiratebay.org/torrent/5728614/Wikileaks__insurance...