4 ms·

You're misunderstanding how this works. You can't be blackmailed by someone who has no plausible evidence.

by mthoms 6y ago

beagle3 6y ago
They don’t have plausible evidence anyway. Gmail has had bugs before with SPF/DKIM and will have some again for sure. Some google employees have direct and indirect access to signing keys or writing emails. Not many, and they have good controls, but still many people with the ability to sign messages. Not to mention a Trojan infiltration or account takeover, of which thousands (if not millions) a day occur. The DKIM evidence is, for legal purposes, a good hint but far from proof.
- mthoms 6y ago
  In the court of public opinion, the standard is not "100% proven beyond any reasonable doubt". Hence, blackmail can still be very effective if an accusation is highly plausible.
  - beagle3 6y ago
    Yes, but it’s not DKIM or not DKIM that will make it plausible in the court of public opinion.
    - mthoms 6y ago
      Current events prove otherwise. See Hunter Biden.
      - beagle3 6y ago
        I have not seen a single mention of DKIM w.r.t to Hunter Biden. Did you? Was any evidence presented? I couldn’t find any. I fail to see how admissibility or lack of it, in a court of law or of public opinion, has anything to do with DKIM+Hunter Biden. Can you elaborate?
        legolas2412 6y ago
        I saw this news (https://www.washingtonexaminer.com/news/cybersecurity-expert-says-hunter-biden-email-about-former-vp-meeting-burisma-official-is-authentic https://www.washingtonexaminer.com/news/cybersecurity-expert...) a few days before the election. There is also a github repo. I am not sure why the DKIM for all emails were not released, or why this did not catch more media coverage by other news organizations I consider more reliable (like NYT).
        beagle3 6y ago
        Thank you for this link, this did not come across my radar. From your link: > The only way the email could have been faked is if someone hacked into Google's servers, found the private key, and used it to reverse engineer the email's DKIM signature, Graham, said. https://www.zdnet.com/article/google-fixes-major-gmail-bug-seven-hours-after-exploit-details-go-public/ https://www.zdnet.com/article/google-fixes-major-gmail-bug-s... is from Aug 2020 and discusses an SPF/DMARC vulnerability that was in Google since forever (and though reported 4 months before public disclosure, was fixed only 7 hours after public disclosure). The last google DKIM bug I'm aware of was in 2012, so I can't counter the specific claim about DKIM with evidence, but the assertion that "the only way to spoof x is to hack and get the private key" is not any absolute truth. (P.S: I have seen no denial nor confirmation about the authenticity of the Hunter Biden data - only claims of Russian involvement. Make of that what you will. The DKIM is circumstantial data until there is confirmation or denial - especially, as you say, it's not all released).
        legolas2412 6y ago
        Sure, you raise very important points. I just found it weird that NYPost was happy just releasing the emails and not the DKIM, and when one was validated, it received literally no coverage. I thought it might catch steam after the election, but the literal silence is surprising to me. I am not insinuating any wrongdoing from anyone, just bringing it to your attention, as you claimed to not know about it.
        6y ago
hashtagmarkup 6y ago
You're misunderstanding how destruction of evidence works.
- mthoms 6y ago
  Huh? No one (including yourself), have mentioned anything about "destruction of evidence" so far. If you care to enlighten me about how it's relevant I'm happy to listen.
  - hashtagmarkup 6y ago
    By making the DKIM keys public, you are converting solid evidence of something that was said into something that was either really said, or someone else pretended that they said. Evidence was destroyed.
    - mthoms 6y ago
      This describes all encrypted and short lived messages. Edit: Removed the word "literally" because it was incorrect and caused distraction from the actual argument.
      - hashtagmarkup 6y ago
        It doesn't at all. You're misunderstanding. Or, are you using the word "literally" in the modern sense of "not literally"?
        mthoms 6y ago
        Are you just nitpicking my choice of words or are you going to explain how auto-disappearing messages aren't potentially destroying evidence in the exact same way you've described? As for encrypted messaging, yes it is not the same as "literally" destroying evidence. But it is hiding evidence (based on your logic). The end result is the same in the context of the claims you previously made. That is: justice is potentially being subverted.
drdaeman 6y ago
I'm afraid there's also a misunderstanding how the real world works. Cryptographic and real-world plausibility are two entirely different things. People get blackmailed, shamed, hurt and even killed over mere rumors, speculations and suspicions. As long as people believe in something (because something merely look plausible), there's no need for a fancy crypto to prove some machine sent some email. I'd dare to say most people don't even understand what cryptography is and what digital signatures really are (who signs what and what exactly this means). I'm yet to hear a story of, let's say, a brave dissident who got out of jail because of cryptographic plausible deniability property making their oppressors unable to prove authenticity of some leaked or intercepted correspondence.
- mthoms 6y ago
  Read up on the Hunter Biden emails. After a DKIM signature was verified, the perception of a large number of people (including right here on HN) went from "this cache of email is probably total fiction" to "they likely do have access to at least some of his emails".

You're misunderstanding how this works. You can't be blackmailed by someone who has no plausible evidence.

by mthoms 6y ago

You're misunderstanding how this works. You can't be blackmailed by someone who has no plausible evidence.

They don’t have plausible evidence anyway. Gmail has had bugs before with SPF/DKIM and will have some again for sure. Some google employees have direct and indirect access to signing keys or writing emails. Not many, and they have good controls, but still many people with the ability to sign messages. Not to mention a Trojan infiltration or account takeover, of which thousands (if not millions) a day occur. The DKIM evidence is, for legal purposes, a good hint but far from proof.

mthoms 6y ago
In the court of public opinion, the standard is not "100% proven beyond any reasonable doubt". Hence, blackmail can still be very effective if an accusation is highly plausible.
- beagle3 6y ago
  Yes, but it’s not DKIM or not DKIM that will make it plausible in the court of public opinion.
  - mthoms 6y ago
    Current events prove otherwise. See Hunter Biden.
    - beagle3 6y ago
      I have not seen a single mention of DKIM w.r.t to Hunter Biden. Did you? Was any evidence presented? I couldn’t find any. I fail to see how admissibility or lack of it, in a court of law or of public opinion, has anything to do with DKIM+Hunter Biden. Can you elaborate?
      - legolas2412 6y ago
        I saw this news (https://www.washingtonexaminer.com/news/cybersecurity-expert-says-hunter-biden-email-about-former-vp-meeting-burisma-official-is-authentic https://www.washingtonexaminer.com/news/cybersecurity-expert...) a few days before the election. There is also a github repo. I am not sure why the DKIM for all emails were not released, or why this did not catch more media coverage by other news organizations I consider more reliable (like NYT).
        beagle3 6y ago
        Thank you for this link, this did not come across my radar. From your link: > The only way the email could have been faked is if someone hacked into Google's servers, found the private key, and used it to reverse engineer the email's DKIM signature, Graham, said. https://www.zdnet.com/article/google-fixes-major-gmail-bug-seven-hours-after-exploit-details-go-public/ https://www.zdnet.com/article/google-fixes-major-gmail-bug-s... is from Aug 2020 and discusses an SPF/DMARC vulnerability that was in Google since forever (and though reported 4 months before public disclosure, was fixed only 7 hours after public disclosure). The last google DKIM bug I'm aware of was in 2012, so I can't counter the specific claim about DKIM with evidence, but the assertion that "the only way to spoof x is to hack and get the private key" is not any absolute truth. (P.S: I have seen no denial nor confirmation about the authenticity of the Hunter Biden data - only claims of Russian involvement. Make of that what you will. The DKIM is circumstantial data until there is confirmation or denial - especially, as you say, it's not all released).
        legolas2412 6y ago
        Sure, you raise very important points. I just found it weird that NYPost was happy just releasing the emails and not the DKIM, and when one was validated, it received literally no coverage. I thought it might catch steam after the election, but the literal silence is surprising to me. I am not insinuating any wrongdoing from anyone, just bringing it to your attention, as you claimed to not know about it.
        6y ago

hashtagmarkup 6y ago

You're misunderstanding how destruction of evidence works.

mthoms 6y ago
Huh? No one (including yourself), have mentioned anything about "destruction of evidence" so far. If you care to enlighten me about how it's relevant I'm happy to listen.
- hashtagmarkup 6y ago
  By making the DKIM keys public, you are converting solid evidence of something that was said into something that was either really said, or someone else pretended that they said. Evidence was destroyed.
  - mthoms 6y ago
    This describes all encrypted and short lived messages. Edit: Removed the word "literally" because it was incorrect and caused distraction from the actual argument.
    - hashtagmarkup 6y ago
      It doesn't at all. You're misunderstanding. Or, are you using the word "literally" in the modern sense of "not literally"?
      - mthoms 6y ago
        Are you just nitpicking my choice of words or are you going to explain how auto-disappearing messages aren't potentially destroying evidence in the exact same way you've described? As for encrypted messaging, yes it is not the same as "literally" destroying evidence. But it is hiding evidence (based on your logic). The end result is the same in the context of the claims you previously made. That is: justice is potentially being subverted.

drdaeman 6y ago

I'm afraid there's also a misunderstanding how the real world works. Cryptographic and real-world plausibility are two entirely different things. People get blackmailed, shamed, hurt and even killed over mere rumors, speculations and suspicions. As long as people believe in something (because something merely look plausible), there's no need for a fancy crypto to prove some machine sent some email. I'd dare to say most people don't even understand what cryptography is and what digital signatures really are (who signs what and what exactly this means). I'm yet to hear a story of, let's say, a brave dissident who got out of jail because of cryptographic plausible deniability property making their oppressors unable to prove authenticity of some leaked or intercepted correspondence.

mthoms 6y ago
Read up on the Hunter Biden emails. After a DKIM signature was verified, the perception of a large number of people (including right here on HN) went from "this cache of email is probably total fiction" to "they likely do have access to at least some of his emails".