4 ms·

If what you are communicating needs to be guaranteed to never be crackable, you only need to use the oldest and most secure way of communicating before the days

by f430 6y ago

If what you are communicating needs to be guaranteed to never be crackable, you only need to use the oldest and most secure way of communicating before the days of internet and computers: short wave transmitted one time pad codes. The reason that number stations continue to operate is that it really is the best way to communicate/order under surveillance which almost certainly is happening in every embassy in non-friendly countries. One time pads are truly unbreakable and it's techniques have been refined for the past 80 years since Cold War began. Luckily you don't need a shortwave radio anymore and the CIA I believe utilizes emoticons. Even if you intercept a bunch of smiley faces followed by a wink, how do you figure out the contents of the message when the medium to decode is completely unknowable? It was only when they captured a few Cuban spies were they able to break the number stations operating out of Havana but this is perhaps the only case in history.

ardy42 6y ago
> If what you are communicating needs to be guaranteed to never be crackable, you only need to use the oldest and most secure way of communicating before the days of internet and computers: short wave transmitted one time pad codes. I'd say using a dead drop is probably even older and more secure. I don't think it'd attract any extra attention unless you're already being followed. A numbers station is really only useful to a particular use case that seems exclusive to nation-state spies: you don't care who knows you're transmitting, but you need the message and the location of the recipient to be absolutely secure.
- f430 6y ago
  > dead drop yes but it really needs to be remote because they caught ppl doing it like that American spy in the 80s. I know in South Korea, dead drop is a popular method of peddling drugs but ppl still get busted. I agree number stations are overkill but perhaps some similar methods...like cartels using email drafts to communicate
  - chb 6y ago
    > because they caught ppl doing it like that American spy in the 80s. > Are you referring to Robert Hanssen? https://en.wikipedia.org/wiki/Robert_Hanssen https://en.wikipedia.org/wiki/Robert_Hanssen
  - ardy42 6y ago
    But the point is using dead drops doesn't attract attention unless you already have it. > I agree number stations are overkill but perhaps some similar methods...like cartels using email drafts to communicate That's basically a digital dead drop, and they've caught people doing that: for instance: https://en.wikipedia.org/wiki/Petraeus_scandal#Summary_and_chronology https://en.wikipedia.org/wiki/Petraeus_scandal#Summary_and_c...
SoSoRoCoCo 6y ago
It's not that I'm a spy. It's that I want to protect myself digitally as much as possible, despite being forced to interface with the internet by large institutions. We can go back and time and argue about the lack of security just four decades ago (George Hayduke[1] had a series of books on how to exfiltrate info in the 60's & 70's through social engineering). However, here we are: in a virtual world that is simultaneously more secure and less secure than ever. Compare: we have evolving security protocols that are being hardend every year by attacker's pushing on them, yet our entire lives are open like never before for the picking-off by one clever blackhat. It is maddening, and I consider myself far more cognizant of the issues than a typical chain-letter sharing, 8-char all-text passwording, facebook user. [1] https://www.amazon.com/Screw-Unto-Others-Revenge-Occasions/dp/0873644050 https://www.amazon.com/Screw-Unto-Others-Revenge-Occasions/d...
- f430 6y ago
  I would like to have read that book before I made peace and decided that spectacular success is THE best revenge. Like the old Jewish saying: "Living a good happy life is the best revenge" Still, it needs a read but for pure entertainment. I will add it to my wish list
- jorblumesea 6y ago
  > protect myself digitally as much as possible From whom? Understanding the threat model is incredibly important to understanding how and what to defend against. It sounds like you're just chucking "security ideas" over the fence in the hopes that one might protect you. Protection against cyber criminals and other net denizens? You're probably overkill and also not helpful in some circumstances. Tor is generally for anonymizing internet traffic, but using a financial institution is the exact opposite of anonymity. ISP? Maybe? Depends on what you're doing and why. With DPI and other tools it's not clear cut. Nation state? Not much you can do. Very little can protect you if Russia decides you're a person of interest.
  - SoSoRoCoCo 6y ago
    > It sounds like you're just chucking "security ideas" over the fence in the hopes that one might protect you. Precisely my point! You describe a situation where "buyer beware" means staying up to date with the latest netsec and tech rags. That is simply unfeasible for the vast majority of people, including me. But you know what: I can't get simjacked anymore because I read about that. I have stronger passwords because of hard tokens, because I read about that. What next 50 things do I need to read about to stay "safe", and what even IS "safe"? This is nontrivial and our identities literally depend on it. The fall-off costs are astonishingly high.
cortesoft 6y ago
You can't operate a number station in someone else's country.... they might not be able to crack the code, but they can sure track down the number station and turn it off/arrest the operator.
- mhh__ 6y ago
  You can trivially find the listeners too if you use a bad/old radio https://en.wikipedia.org/wiki/Operation_RAFTER https://en.wikipedia.org/wiki/Operation_RAFTER
- f430 6y ago
  Oh yes absolutely. There's a reason why both Korea's broadcast numbers in their respective borders. I remember when I first discovered number station....it kept me obsessed for days https://swling.com/blog/2016/08/numbers-stations-and-the-two-koreas/ https://swling.com/blog/2016/08/numbers-stations-and-the-two...
- DaedPsyker 6y ago
  I guess but if it is for cross border communications then you could just run it digitally on twitter or like website.
mhh__ 6y ago
> It was only when they captured a few Cuban spies were they able to break the number stations operating out of Havana but this is perhaps the only case in history Bad OPSEC (Reuse of pads) allowed the West to extremely painfully decrypt chunks of soviet communications - finding just how bad communist infiltration was in the process. https://en.wikipedia.org/wiki/Venona_project https://en.wikipedia.org/wiki/Venona_project
- f430 6y ago
  now THIS is why I love text based communities like HN and Redit. You just get rewarded these small nuggests of rabbit holes.
  - mhh__ 6y ago
    Read "Spycatcher" by Peter Wright. It's one of not many books on spying like this (Wright was cleaning up the mess Venona revealed for years) actually written by an intelligence officer, in clear breach of the official secrets act, and even better he was an engineer too so there are lots of tales of him reverse engineering soviet bugs like "The thing" and tracking down spurious radio emissions to find spies. His theory about Roger Hollis is probably lost to time although MI5's complete failure to address it is probably a hint.
opportune 6y ago
Let’s take a step back here. Everybody has a different standard of privacy they want. There are different levels of trade offs they can make as they become more secure. What you’re describing is the top level of security but it’s not very convenient to use. It also uses private keys which makes establishing a new connection challenging. There are as I see it a few main security modes: stopping automated surveillance and hacking, stopping low effort surveillance and hacking, and being “perfectly” secure from the most motivated adversary. Being perfectly secure on a networked computer is basically impossible. Governments likely have access to back doors and 0days that can compromise anyone (and keep in mind if the person on the other end has bad opsec, you’ve already lost). But they’re probably not going to unleash the fire and fury on Joe Schmo, and would probably be reluctant to target someone security-minded who might identify how they got pwned and publicize the vulnerability unless they have a damned good reason. Most people don’t need never-crackable, they just need to be reasonably assured that only a very motivated adversary could crack them.
- ethbr0 6y ago
  > Governments likely have access to back doors and 0days that can compromise anyone * anyone running a certain configuration Bugs don't exist in a vacuum. They exist in a specific piece of software, which usually supports a specific feature (e.g. Flash, Microsoft Word, or TCP/IP). Curious in more informed opinions, but it seems unlikely there's a large universe of zero days applicable to every configuration out there. Consequently, a huge part of security is (and has always been!) limiting unnecessary code. Specifically, code accepting input from network connections. Parent's point about crypto algorithms is a form of this: one reason they're so secure, and proveably so, is because they have extremely limited attack surfaces. They take this input, they produce this output.
  - opportune 6y ago
    What I first replied to is about a specific private key algorithm that doesn’t have any patterns, and using it over something that can’t be backdoored. Using OTP is not just using crypto, it is pretty much the only “uncrackable” encryption if used properly. My point is that using something like PGP to communicate over TOR (or even OTP over TOR) doesn’t matter if whoever you are trying to hide from has a backdoor to your OS or has the ability to exploit a vulnerability in your OS (which only requires something trivial like you having loaded some random JS in the past year). And there is no way to protect against an undocumented bug in some software you depend on other than to not use it. You can only hope that a government or criminal doesn’t care enough to burn a 0day on you. (Of course you can still airgap a computer with the private PGP key and manually copy the encrypted data over but the question then is whether that is worth the minuscule chance of it mattering)

by f430 6y ago

ardy42 6y ago

> If what you are communicating needs to be guaranteed to never be crackable, you only need to use the oldest and most secure way of communicating before the days of internet and computers: short wave transmitted one time pad codes. I'd say using a dead drop is probably even older and more secure. I don't think it'd attract any extra attention unless you're already being followed. A numbers station is really only useful to a particular use case that seems exclusive to nation-state spies: you don't care who knows you're transmitting, but you need the message and the location of the recipient to be absolutely secure.

f430 6y ago
> dead drop yes but it really needs to be remote because they caught ppl doing it like that American spy in the 80s. I know in South Korea, dead drop is a popular method of peddling drugs but ppl still get busted. I agree number stations are overkill but perhaps some similar methods...like cartels using email drafts to communicate
- chb 6y ago
  > because they caught ppl doing it like that American spy in the 80s. > Are you referring to Robert Hanssen? https://en.wikipedia.org/wiki/Robert_Hanssen https://en.wikipedia.org/wiki/Robert_Hanssen
- ardy42 6y ago
  But the point is using dead drops doesn't attract attention unless you already have it. > I agree number stations are overkill but perhaps some similar methods...like cartels using email drafts to communicate That's basically a digital dead drop, and they've caught people doing that: for instance: https://en.wikipedia.org/wiki/Petraeus_scandal#Summary_and_chronology https://en.wikipedia.org/wiki/Petraeus_scandal#Summary_and_c...

SoSoRoCoCo 6y ago

It's not that I'm a spy. It's that I want to protect myself digitally as much as possible, despite being forced to interface with the internet by large institutions. We can go back and time and argue about the lack of security just four decades ago (George Hayduke[1] had a series of books on how to exfiltrate info in the 60's & 70's through social engineering). However, here we are: in a virtual world that is simultaneously more secure and less secure than ever. Compare: we have evolving security protocols that are being hardend every year by attacker's pushing on them, yet our entire lives are open like never before for the picking-off by one clever blackhat. It is maddening, and I consider myself far more cognizant of the issues than a typical chain-letter sharing, 8-char all-text passwording, facebook user. [1] https://www.amazon.com/Screw-Unto-Others-Revenge-Occasions/dp/0873644050 https://www.amazon.com/Screw-Unto-Others-Revenge-Occasions/d...

f430 6y ago
I would like to have read that book before I made peace and decided that spectacular success is THE best revenge. Like the old Jewish saying: "Living a good happy life is the best revenge" Still, it needs a read but for pure entertainment. I will add it to my wish list
jorblumesea 6y ago
> protect myself digitally as much as possible From whom? Understanding the threat model is incredibly important to understanding how and what to defend against. It sounds like you're just chucking "security ideas" over the fence in the hopes that one might protect you. Protection against cyber criminals and other net denizens? You're probably overkill and also not helpful in some circumstances. Tor is generally for anonymizing internet traffic, but using a financial institution is the exact opposite of anonymity. ISP? Maybe? Depends on what you're doing and why. With DPI and other tools it's not clear cut. Nation state? Not much you can do. Very little can protect you if Russia decides you're a person of interest.
- SoSoRoCoCo 6y ago
  > It sounds like you're just chucking "security ideas" over the fence in the hopes that one might protect you. Precisely my point! You describe a situation where "buyer beware" means staying up to date with the latest netsec and tech rags. That is simply unfeasible for the vast majority of people, including me. But you know what: I can't get simjacked anymore because I read about that. I have stronger passwords because of hard tokens, because I read about that. What next 50 things do I need to read about to stay "safe", and what even IS "safe"? This is nontrivial and our identities literally depend on it. The fall-off costs are astonishingly high.

cortesoft 6y ago

You can't operate a number station in someone else's country.... they might not be able to crack the code, but they can sure track down the number station and turn it off/arrest the operator.

mhh__ 6y ago
You can trivially find the listeners too if you use a bad/old radio https://en.wikipedia.org/wiki/Operation_RAFTER https://en.wikipedia.org/wiki/Operation_RAFTER
f430 6y ago
Oh yes absolutely. There's a reason why both Korea's broadcast numbers in their respective borders. I remember when I first discovered number station....it kept me obsessed for days https://swling.com/blog/2016/08/numbers-stations-and-the-two-koreas/ https://swling.com/blog/2016/08/numbers-stations-and-the-two...
DaedPsyker 6y ago
I guess but if it is for cross border communications then you could just run it digitally on twitter or like website.

mhh__ 6y ago

> It was only when they captured a few Cuban spies were they able to break the number stations operating out of Havana but this is perhaps the only case in history Bad OPSEC (Reuse of pads) allowed the West to extremely painfully decrypt chunks of soviet communications - finding just how bad communist infiltration was in the process. https://en.wikipedia.org/wiki/Venona_project https://en.wikipedia.org/wiki/Venona_project

f430 6y ago
now THIS is why I love text based communities like HN and Redit. You just get rewarded these small nuggests of rabbit holes.
- mhh__ 6y ago
  Read "Spycatcher" by Peter Wright. It's one of not many books on spying like this (Wright was cleaning up the mess Venona revealed for years) actually written by an intelligence officer, in clear breach of the official secrets act, and even better he was an engineer too so there are lots of tales of him reverse engineering soviet bugs like "The thing" and tracking down spurious radio emissions to find spies. His theory about Roger Hollis is probably lost to time although MI5's complete failure to address it is probably a hint.

opportune 6y ago

Let’s take a step back here. Everybody has a different standard of privacy they want. There are different levels of trade offs they can make as they become more secure. What you’re describing is the top level of security but it’s not very convenient to use. It also uses private keys which makes establishing a new connection challenging. There are as I see it a few main security modes: stopping automated surveillance and hacking, stopping low effort surveillance and hacking, and being “perfectly” secure from the most motivated adversary. Being perfectly secure on a networked computer is basically impossible. Governments likely have access to back doors and 0days that can compromise anyone (and keep in mind if the person on the other end has bad opsec, you’ve already lost). But they’re probably not going to unleash the fire and fury on Joe Schmo, and would probably be reluctant to target someone security-minded who might identify how they got pwned and publicize the vulnerability unless they have a damned good reason. Most people don’t need never-crackable, they just need to be reasonably assured that only a very motivated adversary could crack them.

ethbr0 6y ago
> Governments likely have access to back doors and 0days that can compromise anyone * anyone running a certain configuration Bugs don't exist in a vacuum. They exist in a specific piece of software, which usually supports a specific feature (e.g. Flash, Microsoft Word, or TCP/IP). Curious in more informed opinions, but it seems unlikely there's a large universe of zero days applicable to every configuration out there. Consequently, a huge part of security is (and has always been!) limiting unnecessary code. Specifically, code accepting input from network connections. Parent's point about crypto algorithms is a form of this: one reason they're so secure, and proveably so, is because they have extremely limited attack surfaces. They take this input, they produce this output.
- opportune 6y ago
  What I first replied to is about a specific private key algorithm that doesn’t have any patterns, and using it over something that can’t be backdoored. Using OTP is not just using crypto, it is pretty much the only “uncrackable” encryption if used properly. My point is that using something like PGP to communicate over TOR (or even OTP over TOR) doesn’t matter if whoever you are trying to hide from has a backdoor to your OS or has the ability to exploit a vulnerability in your OS (which only requires something trivial like you having loaded some random JS in the past year). And there is no way to protect against an undocumented bug in some software you depend on other than to not use it. You can only hope that a government or criminal doesn’t care enough to burn a 0day on you. (Of course you can still airgap a computer with the private PGP key and manually copy the encrypted data over but the question then is whether that is worth the minuscule chance of it mattering)