6 ms·

1) The blame lays squarely with the guardian who think that PGP offers some sort of 'temporary' changeable password. 2) From the whistle-blowers perspective al

by derrida 15y ago

1) The blame lays squarely with the guardian who think that PGP offers some sort of 'temporary' changeable password. 2) From the whistle-blowers perspective all documents have been released. Sure if Wikileaks hung onto them it would have a greater impact.

ugh 15y ago
I’m talking about the kindergarten surrounding the whole issue. I cannot trust Wikileaks any more. I don’t know how anyone else could either.
- lhnz 15y ago
  Kindergarten? Aren't you the one waving your arms in outrage? DDB has stolen their data; Assange has been dealt some serious allegations; and the Guardian has made an understandable technical mistake. It's quite irrational to conflate that with the Wikileaks brand. Most of this was out of their control.
  - ugh 15y ago
    I’m not outraged, more amused. Wikileaks has to take responsibility and communicate better. Especially their communication has been a disaster. If they want to be a respected whistleblower website they have to show that they are competent. I’m sorry, but I just cannot see how Wikileaks has done that during the last few weeks and months. Based on that I personally wouldn’t trust them with anything. I wouldn’t be surprised if many other people (who, unlike me, actually have something important to leak) think the same way. (I don’t even want to say anything about DDB.) But I guess saying something critical about Wikileaks (even if you support the idea of a place for anyone to safely leak stuff) isn’t very popular around these parts. Ah, well.
  - tptacek 15y ago
    If Domscheit-Berg wasn't meant to have access to the data, why did he have access to the data? The way both parties relate the story, Domscheit-Berg's exposure to the data appears to have been "accidental": Assange left the unredacted data set on a Wikileaks-owned server that Domscheit-Berg managed, trusting a obscured directory name to protect them. By Der Spiegel's recounting, it hardly matters what Domscheit-Berg's intentions were, because the files were unknowingly swept up in Wikileaks BitTorrent disaster recovery process. At that point, it became simply a matter of time before the contents of the data set became public, with or without Domscheit-Berg's promotion. The personality conflicts here between Domscheit-Berg and Assange and Rusbridger and Leigh are probably a red herring. The evidence we have now strongly suggests that Wikileaks was not a careful steward of the data they had; that Wikileaks own convenience trumped tradecraft and security. That's fine and human and normal for most types of data. But most of the time, we're not dealing with the names of informants and whistleblowers in the world's most repressive countries.
  - cookiecaper 15y ago
    Wikileaks was the source of the data, and not only distributed extremely sensitive information in a permanently retrievable form to a person who did not understand the implications related to handling that data, but they also (lazily) left the file available online, in a place where it was accidentally included in at least some of the WL archives circulating BitTorrent. Wikileaks certainly holds the larger portion of the blame, though the publication of the password was ridiculously reckless.
tptacek 15y ago
The Guardian isn't saying PGP passwords are temporary. They're saying they had assumed the PGP-encrypted file they were provided was single-use, intended only for them and removed after they copied it. That's a reasonable assumption. Why wasn't it single-use? Aren't people's lives presumably at stake here? How many lives do you need to risk before it becomes worth it to re-encrypt a data set? Why, after disclosing the encryption key to a journalist, did Assange retain the (now tainted) file?
- jhancock 15y ago
  Even if those at the Guardian believed the password only applied to their copy, publishing the password amounts to the Guardian making their copy a target to be copied/stolen. Why should the Guardian think they have better protection against copying their copy than the U.S. gov did in not allowing the cables to be copied in the first place?
  - tptacek 15y ago
    This is a good reason for not simply giving The Guardian a giant encrypted dump of all the data. Either way, The Guardian's lack of opsec doesn't set the bar for Wikileaks. Wasn't the whole idea behind Wikileaks supposed to be that it was run by people with the greatest possible opsec/tradecraft crediblity? How does it make sense for that group to literally delegate all their security to a news publishing organization? And having done that, by their own admission, how does pointing the finger at The Guardian's lack of opsec capability exonerate Wikileaks?
    - jhancock 15y ago
      It doesn't exonerate WL. It simply shows the Gaurdian to be foolish and/or complicit in WL's agenda to distribute the data.

by derrida 15y ago

ugh 15y ago

I’m talking about the kindergarten surrounding the whole issue. I cannot trust Wikileaks any more. I don’t know how anyone else could either.

lhnz 15y ago
Kindergarten? Aren't you the one waving your arms in outrage? DDB has stolen their data; Assange has been dealt some serious allegations; and the Guardian has made an understandable technical mistake. It's quite irrational to conflate that with the Wikileaks brand. Most of this was out of their control.
- ugh 15y ago
  I’m not outraged, more amused. Wikileaks has to take responsibility and communicate better. Especially their communication has been a disaster. If they want to be a respected whistleblower website they have to show that they are competent. I’m sorry, but I just cannot see how Wikileaks has done that during the last few weeks and months. Based on that I personally wouldn’t trust them with anything. I wouldn’t be surprised if many other people (who, unlike me, actually have something important to leak) think the same way. (I don’t even want to say anything about DDB.) But I guess saying something critical about Wikileaks (even if you support the idea of a place for anyone to safely leak stuff) isn’t very popular around these parts. Ah, well.
- tptacek 15y ago
  If Domscheit-Berg wasn't meant to have access to the data, why did he have access to the data? The way both parties relate the story, Domscheit-Berg's exposure to the data appears to have been "accidental": Assange left the unredacted data set on a Wikileaks-owned server that Domscheit-Berg managed, trusting a obscured directory name to protect them. By Der Spiegel's recounting, it hardly matters what Domscheit-Berg's intentions were, because the files were unknowingly swept up in Wikileaks BitTorrent disaster recovery process. At that point, it became simply a matter of time before the contents of the data set became public, with or without Domscheit-Berg's promotion. The personality conflicts here between Domscheit-Berg and Assange and Rusbridger and Leigh are probably a red herring. The evidence we have now strongly suggests that Wikileaks was not a careful steward of the data they had; that Wikileaks own convenience trumped tradecraft and security. That's fine and human and normal for most types of data. But most of the time, we're not dealing with the names of informants and whistleblowers in the world's most repressive countries.
- cookiecaper 15y ago
  Wikileaks was the source of the data, and not only distributed extremely sensitive information in a permanently retrievable form to a person who did not understand the implications related to handling that data, but they also (lazily) left the file available online, in a place where it was accidentally included in at least some of the WL archives circulating BitTorrent. Wikileaks certainly holds the larger portion of the blame, though the publication of the password was ridiculously reckless.

tptacek 15y ago

The Guardian isn't saying PGP passwords are temporary. They're saying they had assumed the PGP-encrypted file they were provided was single-use, intended only for them and removed after they copied it. That's a reasonable assumption. Why wasn't it single-use? Aren't people's lives presumably at stake here? How many lives do you need to risk before it becomes worth it to re-encrypt a data set? Why, after disclosing the encryption key to a journalist, did Assange retain the (now tainted) file?

jhancock 15y ago
Even if those at the Guardian believed the password only applied to their copy, publishing the password amounts to the Guardian making their copy a target to be copied/stolen. Why should the Guardian think they have better protection against copying their copy than the U.S. gov did in not allowing the cables to be copied in the first place?
- tptacek 15y ago
  This is a good reason for not simply giving The Guardian a giant encrypted dump of all the data. Either way, The Guardian's lack of opsec doesn't set the bar for Wikileaks. Wasn't the whole idea behind Wikileaks supposed to be that it was run by people with the greatest possible opsec/tradecraft crediblity? How does it make sense for that group to literally delegate all their security to a news publishing organization? And having done that, by their own admission, how does pointing the finger at The Guardian's lack of opsec capability exonerate Wikileaks?
  - jhancock 15y ago
    It doesn't exonerate WL. It simply shows the Gaurdian to be foolish and/or complicit in WL's agenda to distribute the data.