14 ms·
Crooks’ mistaken bet on encrypted phones
- adventured 4y agohttps://archive.ph/DOA8y https://archive.ph/DOA8y
- the_jeremy 4y ago"Crooks' mistaken bet on false marketing claiming end-to-end encryption and offshore hosting by 2 different European communication networks that ended up shutting down due to police raids in 2020-2021" is a better title (or I guess just summary at that point).
- MuffinFlavored 4y agoThis is a dumb slightly unrelated question by me. Say I was a "crook"/bad guy. Why doesn't "well done" AES/RSA/ECC encryption stop law enforcement from being able to "snoop" on what one crook says to another crook?
- upofadown 4y agoNone of these busts involved breaking encryption. They all involved trusting a third party which later became known to be untrustworthy.
- ed_elliott_asc 4y agoAlso when they arrested people the phones were often unlocked (I watched a documentary and saw the police capture phones and state they were unlocked) Also they didn’t use disappearing messages or delete them so the full history was available without breaking any encryption
- bboygravity 4y agoSounds like they catched a bunch of n00bs to me.
- coldtea 4y agoThat's what a n00b would think!
- dist-epoch 4y agoThat's an almost impossible task. The Pegasus malware for example was able to infect and spy any phone.
- deleted 4y ago[deleted]
- e12e 4y agoThe missing part is often the "well done" part. Other than that - traditional bugs/listening devices, malware (recording the sound before encryption/after decryption)? Then there's traffic analysis (a talk to b, b kill c, b talk to a). See also: "well done".
- forgotmypw17 4y agoI think the main reason is that LE basically has root on the entire stack up to the encryption.
- deleted 4y ago[deleted]
- onion2k 4y agoIt does. The problem is that crooks aren't generally trustworthy, and selling you out is leverage they're very willing to use should the cops ever catch them. The same applies to every part of the illicit communications network you rely on - if any part of the trusted chain breaks down in a way that enables the cops to subvert your encryption you're screwed, right down to installing an OS update on your device. Good opsec is exceptionally hard. If you aren't building it from scratch it probably isn't secure. And even if you are, if you're a big enough target for nation states to be looking you're still going to have a hard time.
- vkou 4y ago> If you aren't building it from scratch it probably isn't secure. And if you are building it from scratch, it is definitely not secure.
- FormerBandmate 4y agoIt's essentially a larger scale, legal version of https://xkcd.com/538/ https://xkcd.com/538/
- er4hn 4y agoIf crooks were proficient at using FOSS to write their own encryption apps that obey best practices... working as an SWE would probably pay better and have less downsides.
- asdfman123 4y agoCrimie movies make us think criminals are bright subversives, when the vast majority of them are dumb thugs. There are much more lucrative paths for intelligent psychopaths in the professional world.
- sofixa 4y agoBut that doesn't stop them from hiring a bunch of capable software engineers from e.g. the Western Balkans to build stuff for them for crazy money (6 figures EUR is crazy money for the Western Balkans). Like the guy who created a phone network for the Colombian cartels in the 1990s.
- fiksie 4y agoMovie stereotyping whole region as aside, 6 figures EUR is not crazy money for western Balkans.
- sofixa 4y ago6 figures EUR is bordering on crazy money for Eastern Balkans, which are in the EU, let alone Western Balkans. For reference, in Bosnia and Herzegovina, the median salary for a software engineer is 3650 BAM (1867 EUR at today's rate), per month, making a yearly 43800 BAM / 22404 EUR, and that's gross, before taxes and stuff. 6 figures EUR, even assuming low 6 figures like 300k, is the equivalent of more than 13 yearly salaries, and is of course untaxed, so even more with that. One can comfortably retire with 300k EUR in Bosnia.
- tough 4y agoSame guy snitched 'em once caught by the FBI tho They'd need to kill those SWE to be -safe- after PS: I wouldn't take a job that can get me killed, there's a reason I like working with computers
- sbierwagen 4y agoIt does. The standard playbook for rolling up criminal conspiracies is to arrest a low level member, offer him a reduced sentence in return for testimony, arrest the next guy higher up based on that testimony, etc. (The only way to prevent that would be a fully trustless "cell" structure where none of conspirators know each other, which has never been done in real life.) You will notice none of this requires communications intercepts. This is because the feds are simply lying when they say encryption prevents law enforcement operations.
- jstarfish 4y agoThere was a Chinese drug lord operating out of Canada who did successfully pull off the cell structure. Amazon of Drugs or something. Somehow they managed perfect forward secrecy. For a while.
- spitfire 4y agoHere he is. https://torontolife.com/city/this-man-is-the-jeff-bezos-of-the-international-drug-trade/ https://torontolife.com/city/this-man-is-the-jeff-bezos-of-t...
- more_corn 4y agoIt has never been discovered to exist. If it’s actually good it’ll defeat attempts to uncover it. An even better cell structure would be one where the cells don’t even know that other cells exist.
- dragonwriter 4y ago> An even better cell structure would be one where the cells don’t even know that other cells exist. You can’t have a network with more than one cell where no one outside of the cell knows that it exists, and without those people using a communication method to people in the cell that at least one person in the cell knows exists. And when you minimize down to the minimum contact, the network is very much non-resilient: its hard to discover and roll-up, but (especially if the cells are doing high-risk functions, which is probably why you want to do it) its also easy to disintegrate accidentally, even without being discovered and rolled-up.
- wmf 4y agoThe real problem is that most people cannot tell whether they're buying proper encryption or snake oil.
- lordnacho 4y agoExactly this. If your core competence is crime and not cryptography, what have you got other than reputation to base your decision on? Just like all of us in whatever sphere we're in.
- bsder 4y agoIt does. But how do you prove you have a "well done" cryptosystem? Very few "crypto" exploits are ever the issue. It's almost always easier to break some other part of the system than the crypto. To be honest, if someone were trying to sell me a cryptosystem for a criminal enterprise and I were in the market for one, I'd happily start tracing everybody in that company as they are almost certainly part of the Feds. If you are the target of a nation state actor, you're pretty much fucked. Once a nation decides to put down that much resource to get you, you're getting gotten. Crypto is only valuable in the sense of "I don't have to outrun the hungry tiger. I just have to outrun you so the tiger stops chasing me to eat." If you, specifically, are a target, crypto won't help you much.
- newZWhoDis 4y agoSounds to me like the best criminals become nations.
- toss1 4y agoYup, Russia, China, North Korea, all authoritarian states
- Earw0rm 4y agoWinners write the history books. Real winners write the law books. Whether that's European colonial settlers, or William of Normandy. (Not known as "William the Negotiator", or "William the all-around nice guy"). Descendants of the local warlords he installed still own huge (well, by British standards, the entire country isn't much bigger than New York State) tracts of land, a thousand years later.
- toss1 4y agoAre you trying to somehow claim that the well-established fact that the Russian govt is indistinguishable from the Russian Mob, or that North Korea is not counterfeiting currency, running drugs, and hacking networks for currency, all indistinguishable from a criminal gang, and definitely not the purview of legitimate governments?
- bawolff 4y agoYou know the saying don't roll your own crypto, well that is because almost everyone does it wrong. AES/RSA/ECC can't protect you from using it incorrectly.
- blarghyblarg 4y agoYou can have perfect crypto on your devices, and great operations, and your messages can still be intercepted several ways. The feds are almost never in a rush. If they want you, they'll get you. If they want you enough, they'll sit in a coffee shop they know you frequent with a high zoom camera ready to read your encrypted texts from across the room. Or they'll bug your car and listen in to your properly encrypted phone calls. Or they'll intercept a package and add some spy gear. They won't do this to bust some street level meth dealer. But, if you're suspected of something like posting state secrets in a Minecraft server? You betcha. They'll follow you everywhere.
- kube-system 4y ago> But, if you're suspected of something like posting state secrets in a Minecraft server? You betcha. They'll follow you everywhere. Or they just call up discord and ask for the name and billing address on the account.
- FredPret 4y agoPresumably a criminal mastermind would know to fake that
- mrguyorama 4y agoSeeing as anybody who takes a credit card on the internet has to do some fraud prevention, that's pretty likely to be very difficult. Hell, depending on how paranoid things have been set up, even having uBlock can prevent you from using a credit card somewhere!
- moremetadata 4y ago
- asdfman123 4y agoThe article addresses this: it’s because it’s almost never well done. They claim it’s super secure, and then apparently implement whatever with no oversight.
- kevin_thibedeau 4y agoEncryption only works if the endpoints are secure. Zero day one of them and you have all the access you need without cracking anything.
- kube-system 4y agoThe biggest endpoint vulnerabilities are human in nature.
- Drblessing 4y agoThe NSA quantum computers.
- noirscape 4y agoAt its simplest - they attack the middleman. Most crooks aren't tech nerds, they're not a lot smarter with technical devices than your average user. So all the cops need to do is go after the central server and then quietly hijack it. After that the choices are pretty much endless. If they used non-standard encryption, ggez, they're probably not smarter than the police. If they did, chances are that the server has an OTA mechanism to update the message application on the phone, so just push out a malicious update that quietly just resends every message to a police controlled server and uploads all messages still stored on the device. Less useful (not as much access to historical messages) but still very useful for tracking criminal activity if you run the tracking net for long enough.
- dexterdog 4y agoI would disagree with your assumption on their intelligence wrt knowledge of the tech. No matter how poor your technical education is, you are likely to learn details about the thing that is central to the secrecy of your organization if you have any sense of self-preservation.
- WeylandYutani 4y agoThe reality is that when you start to endanger society the State comes after you. See Escobar and Noriega. The companies offering encrypted phones were infiltrated. Servers hacked. Employees intimidated with prosecution. Bank accounts seized.
- draw_down 4y ago[dead]
- dsfyu404ed 4y agoA reality inspired title doesn't scratch the confirmation bias itch quite the way that a title closer to the "criminals dumb" end of the spectrum does though.
- DogTweezers 4y ago[flagged]
- pton_xd 4y agoDoesn't reflect poorly on the crooks as much as the government. You have no right to privacy. The government can and will spy on everything you do.
- yieldcrv 4y agoanybody that’s tried to do a commodities trade over whatsapp can tell you there are just a lot of dumb crooks out there but especially in Europe
- harvey9 4y agoIf the adversary had been another gang of crooks it's still bad security.
- tantalor 4y agoYou do have a right to privacy by default, but the government can spy if it has a good enough reason. If you thought being spied on was bad, wait til you hear what the government does when it thinks you're guilty of a crime.
- remram 4y agoIt seems that "suspecting it might have a good reason later" or "you're using the same service as other people it has a good reason to spy on" are sufficient reasons now.
- ViVr 4y ago> "The network, owned by a Dutchman named Danny Manupassa, had made a spectacular bungle: it had stored the private keys for the system on the same server as the network’s messages. Analysts in the Netherlands obtained the private keys and then used them to decrypt Ennetcom texts." Not your keys not your comms. But even then then, apply defense in depth. > "Sky’s messages ran on a different system than EncroChat’s, and it was more difficult to infect the network with bulk malware. Instead, someone with knowledge of the investigation told me, analysts seem to have launched a “protocol attack” that deceived handsets into revealing their private keys."
- joebiden2 4y agoIf "crooks" as a category would be so stupid, we wouldn't have crime at all. While good, this is fishing the ocean with a fishing rod to me. The comfiest, surface-nearest and most trusting fish get arrested, which ironically could well be strengthening the real underground.
- c7DJTLrn 4y agoThe smart crooks use Signal on iOS with backups off. Maybe a VPN for good measure.
- joebiden2 4y agoI think the real crooks do the old-fashioned stuff. Like, not use a smartphone at all for criminal things. Just use expendable workers over two or three layers of hierarchy :)
- account-5 4y agoIs signal on iOS safer than signal on Android?
- wmf 4y agoYes, just because iOS itself is harder to hack. For example there are trivial evil maid style attacks against Android: https://www.tiktok.com/@android_infosecurity/video/7185907898814352645 https://www.tiktok.com/@android_infosecurity/video/718590789...
- CommitSyn 4y agoSecurity 101: Physical compromise is full compromise. If someone with the means has access to your unlocked iPhone, it's game over as quickly as Android. Remember JailbreakMe? That was the NiceGuy™ version of iPhone hacking. Now companies bill governments millions of dollars for iPhone jailbreaks and you can't even sideload apps after.
- deleted 4y ago
- pffft8888 4y agoThe propaganda against encryption is in full swing. My expectation is that all NSA CNSA[1] encryption standards are backdoored at the implementation level (by the NSA who uses Suite A for its own communication and I suspect military communications outside of that in weapons systems that can fall into enemy hands) I guess the propaganda is driven by FBI and law enforcement agencies. 1. https://en.wikipedia.org/wiki/Commercial_National_Security_Algorithm_Suite https://en.wikipedia.org/wiki/Commercial_National_Security_A... 2. https://en.wikipedia.org/wiki/NSA_Suite_A_Cryptography https://en.wikipedia.org/wiki/NSA_Suite_A_Cryptography
- jmclnx 4y agoIt was an interesting read, moral to me is not to use Cell Phones for anything illegal. If you do not control the keys, you might as well not bother with encryption.
- mschuster91 4y agoEven if you control the keys, it does not protect you from vulnerabilities somewhere in the stack. Stuff like thumbnail generation provided by the OS has been used by cyber-criminals in the past to compromise phones by sending MMSes or even third-party messenger apps, and I'd take a guess and bet that at least the Five Eyes government agencies all have a sizeable cache of baseband vulnerabilities. Technology simply has become far too complex to be reasonably secure, even if you have the financial firepower of being Apple, Sony, Microsoft, Nintendo or Amazon.
- __MatrixMan__ 4y agoAgreed. If it installs updates without requiring you to specify the desired updates explicitly (i.e. by cryptographic hash), it should not be considered "your" device from a security perspective.
- CTDOCodebases 4y agoThis 100%.
- boomboomsubban 4y agoOne warrant let the Gendarmerie copy all data on EncroChat phones indefinitely, and seemingly let them then use that data for any number of charges. That is kind of messed up. Burying it in "but we have to stop the drugs" doesn't change anything.
- tantalor 4y agoWhat are you complaining about? Are you implying that there should have been additional warrants required? Because the article doesn't say there weren't. All it says is, > Gendarmerie executed a warrant to secretly copy EncroChat’s servers Yes, there was initially one warrant. But there could have been many others. And even if there weren't, why is that a bad thing? What is your actual complaint?
- from 4y agoThat the message contents of every user of a service were indiscriminately read without doing any investigation to see which were criminals first? Imagine if the FBI just seized the Yahoo! mail database and started reading messages because some of the users were criminals.
- masfuerte 4y agoThe FBI did do this with safety deposit boxes. And a judge ruled they did nothing wrong! https://www.latimes.com/california/story/2022-09-30/judge-backs-fbi-beverly-hills-safe-deposit-box-raid https://www.latimes.com/california/story/2022-09-30/judge-ba...
- from 4y agoI think that's being appealed and in that case all the IJ was asking for was for people who had their stuff seized to have their names removed from some government database. Basically anyone who asked for their money ended up getting it back. > It went on to return everything in about 180 of those boxes after failing to produce evidence to support the allegations, court documents show. Those box holders retrieved more than $27 million. Attorneys for other customers say they recovered close to $25 million more through private negotiations with the U.S. attorney’s office. https://www.latimes.com/california/story/2022-09-23/fbi-beverly-hills-safe-deposit-box-raid-forfeiture-judge https://www.latimes.com/california/story/2022-09-23/fbi-beve... That's $52 million and that's just from the attorneys they talked to - I think another LA Times article mentioned that around 5% of boxholders didn't even claim anything. They seized a few million from Poliak the owner but they had him talking about being a professional criminal for hours and hours. Still messed up but maybe if another judge sees it goes another way.
- mschuster91 4y ago> He told me that, although there were measures a government could take to combat organized crime—better scanners, more customs officers, improved collaboration between national police forces—the flow of drugs would stop only if there was a change in attitude among Europeans. “Drugs are being normalized in our society,” he said. “Users need to look themselves in the mirror. They are putting our security in danger. I hope they are wise enough to understand that, without demand, there is no supply.” Just how long will it take politicians to finally recognize that prohibition is the problem? It didn't work for alcohol in the US (and created Al Capone in the process), it didn't work for cannabis, it didn't work for sex work, it didn't work for porn, it didn't work for any other kind of drug. All it ever created was senseless suffering on all levels, from governments whose budgets were and are drained by the cost of prosecuting all the drug crime, over the users who literally die like flies from contaminated products or accidental overdoses, to society which can't rely on not being shot in a drive-by gang fight or walking home without stepping over feces and heroin needles. The only place where prohibition somehow works halfway is CSAM and pedophilia, but only because everyone but the pedos hates the pedos and agrees it's inacceptable - and even there, with this worldwide unity, there's still more than enough pedos that corrupt local officials in poor countries where pedos from all over the world exploit the utter poverty that leads people to send their children into human trafficking.
- itsthecourier 4y agoIt does work. Check Lee Kuan Yee and Singapore. but it needs to be strong willed not weak.
- mschuster91 4y agoAnd yet, even Singapore is not drug free. They have black markets as well, it's just stupidly expensive due to the risk involved for the mules.
- aziaziazi 4y ago> I hope they are wise enough to understand that, without demand, there is no supply I hope the executives of our society stops one day for “hoping” the wall will move while keeping on bouncing on it. As peer commenter said, prohibition never really worked to combat crimes outside in real world. What does work is legalization of production and sells. Not as giving up but as controlling the market. Would you try meth of it where legal ? Probably not and neither does your folks. On the cultural and health side we have the clear exemple of tobacco marketing legislations that have a strong effect on consommation. How will be one (non Islamic) country if it stop advertising alcool ? While it’s mitigated with internet ads, my bet is less alcool will be consumed > better health. And on the working side, c’mon we surely can find or create jobs for our wine-yard workers that will be helpful for our society as a whole.
- JCharante 4y agoWhy don’t criminals just meet in person to swap public keys and use email to mail each other encrypted messages?
- notRobot 4y agoBecause that requires technical skills most laypeople don't have.
- Gigachad 4y agoBecause no one will ever do that. Even if they risk being arrested
- boring_twenties 4y agoCriminals have gone soft then, and deserve to be arrested! All the classic mob movies have something about never talk business on the phone, always meeting in person in some dark waterfront or warehouse location. Here, they would only be required to meet in person once! If someone is too lazy even for that, well then, enjoy prison I guess
- antibasilisk 4y agoBecause depending on your threat model, meeting in person may be undesirable.
- chefandy 4y agoThe convenience and knowledge barriers are too high for most people. It's pretty straightforward for folks with tech subject matter expertise, but for most others, it's just not worth figuring out what they need to know, then getting all of the prerequisite knowledge that lets them learn that, then worrying about screwing it up, or maybe relying on someone else for basic operations, etc. It's often tough for developers to see this for the same reason it's tough to write documentation-- reasoning about a beginner's perspective is a specific skill that takes study and practice. That's why software companies that need financially stable products hire technical writers and interface designers, and it's a place where FOSS really struggles. For example, Mastodon's active userbase has dropped 50% since its peak during the beginning of the Musk/Twitter debacle... even for the ones brave enough to plunge in head-first, it was too much technical resistance compared to the more straightforward alternatives that they had already abandoned. I think it was a missed opportunity.
- from 4y agoReally interesting article. I get the impression the Sky ECC bust was bigger than all of the previous ones but maybe that's just cause there was more reporting on it. It's kind of confusing to me why the CEO is wanted in the US because it doesn't seem like there's any evidence he facilitated drug trafficking or at least facilitated it anymore than say Signal does.
- BlueTemplar 4y agoMurder, torture, drug trafficking... but by far the worst is abbreviating Lord of the Rings as Lor rather than LotR !
- KineticLensman 4y agoBut then the 'Lor and Order' joke wouldn't have worked.
- skatanski 4y agoIf anyone is interested. There's a pretty good Darknet Diaries episode that covers some of this and other cases: https://darknetdiaries.com/transcript/105/ https://darknetdiaries.com/transcript/105/
- upofadown 4y ago>At Europol, Lecouffe has explained that, although he was of course unsurprised to find that criminals used violence, he was shocked at “the level of violence” in Europe. It isn't like they can settle their differences in drug court. Black markets and the associated attempts to shut them down naturally generate violence. The people involved literally have no other choice.
- vasco 4y agoThey have plenty of choices, like not doing crime or participate in black markets, what are you talking about.
- tsimionescu 4y agoI don't think GP was making a bleeding heart argument for the poor drug cartel enforcers, they were simply pointing out that a drug cartel can only use violence to respond to any perceived injustice (or ignore it and eventually dissolve, of course), there are no non-violent means to solve disputea between cartels.
- vasco 4y agoEven that isn't true, there's history of cooperation and sharing markets by delineating borders among criminal groups. But ultimately they simply can do a normal job instead of crime. It's not like they're born and "all I can do is kill because I'm in a cartel", oopsie.
- abigail95 4y agoIt's so dumb - think about the signals you are sending out just by having such a device. Let alone trusting someone else to harden it for you. Think about Monero - it's a lot more suspicious to be dealing with that than regular bitcoin. For privacy advocates it's fine, you aren't doing anything wrong by using e2e and monero, any govt looking at you won't be able to get past reasonable suspicion. But if you're a criminal you're basically glowing in the dark by doing this stuff. Regular phones are also encrypted! Facetime is e2e? What was the point of the "AN0M" phones. What did they give you except a supply chain risk and a 100x SIGINT interest factor than a normal person.
- Gene_Parmesan 4y agoI simultaneously agree with you (tor being another prime example of this -- they may not be able to see which tor sites you're visiting [unless they control the exit node] but they sure as hell can see you're using tor), and also think that at some level, the "what have YOU got to hide?" attitude is purposefully encouraged by the intelligence agencies as a way to slowly erode privacy expectations. "Good people don't need an expectation of privacy" is the start of a really dark path.
- prox 4y agoPeople will willfully and joyfully will vote for a would-be dictator, so I don’t privacy is really the main thing that brings us on a really dark path. There are far bigger fish to fry to protecting our basic rights and values. The balance between privacy and the authority is just that. We outsourced the rule of law to the state in order to have a fair and just society. Ipso facto the government should be fair and just to have the right to invade some amount of privacy in order to keep a society free, fair and just. That’s why the judicial branch exist: to see if what the government (or anyone) did was playing by the rules. Which brings us back to politics being a danger to a society if people vote in unjust or unfair people.
- tsimionescu 4y agoI don't think this is what the GP was arguing. They were not discussing whether what the court system did was right and justified, nor whether people who know they have done nothing wrong/illegal should be expected not to use privacy technology. Instead, they were pointing out that it's hard to imagine why the people who knew they were engaging in criminal activity and were hoping to hide it thought it would be a good idea to have specialized equipment/services rather than blending in the crowd with normal phones and apps.
- wolverine876 4y ago> one of the goals of the sting was to “dismantle the business model” of encrypted phones as a tool of organized crime Why would law enforcement do that? They are self-made honeypots, evidence-collectors, and tracking devices all rolled into one. And these people can't seem to muster the self-discipline to lay off the sweet stuff.
- Kostchei 4y agobecause some of these networks- not the one you read about in the news, are LE resistant (servers in Panama etc). One or 2 are so tight that we (LE) can see use of the network as a marker of organised crime but not the messages. Reducing trust in such networks is a way of slowing their spread, use, infra and effectiveness. And that has been effective. These networks are being used for drugs, fraud, sex trafficking. But almost nothing legal. Encrypted hardened phone with specialist app in one pocket, iPhone for facebook/instagram in the other The primary take away from most of what you see in the news (a failed LE investigation of "encryption" or darkweb almost never makes it to the news) ... opsec is hard.
- karaterobot 4y agoRemember: even if you're on what you believe is a fully encrypted device, don't send a text message with specific details of a crime in it.
- dist-epoch 4y agoHow are you supposed to coordinate the cocaine shipment then if you can't send any specific details. That's the whole point of these phones.
- karaterobot 4y agoOver voice, in person, or without listing incriminating details, presumably. That would be my recommendation. I do know that listing specific details in text messages is how they got caught, however convenient it may have been until that point.
- wolverine876 4y agoThe criminals were fooled by cons: false confidence and bravado. I know almost nothing about criminal culture (if there is such a thing), but I'm not surprised that people engaged in crime would be accustomed to evaluating others based on those signals. What is surprising is that such cons - such signalling and trust in it - as spread to legitimate business at the highest levels. It's run SV and much more for awhile now. Really, the criminals made the same mistake that all the celebrated investors did make, and continue to make, with the endless parade of SV fraud.
- kgeist 4y agoI still regularly visit an old IRC server, which is largely abandoned except by a few friends, and sometimes I wonder, what if it's the best way to have secure communication in 2023, it's an outdated protocol most people including the police probably forgot even exists, i.e. won't look there at all :) Everyone is mostly paying attention to modern shiny messengers
- jjulius 4y agoUntil they single out specific targets, begin monitoring their traffic and notice IRC usage.
- deleted 4y ago[deleted]
- nl 4y agoApparently you can share Top Secret documents for months on Discord and no one notices....
- Broken_Hippo 4y agoWhich shouldn't be a surprise. If you aren't suspected of doing such things, you are just a number in the void.
- manv1 4y agoAny network of users that is large will leak, whether encrypted or not. People are social, and when push comes to shove they're more than willing to throw someone else under the bus. The question is, why hasn't anyone designed a standard cell-like structure for an encrypted communication app? Cell-based structures have been known for a long time. How do you verify + vouch for a new user in a way that's secure yet anonymous? How do you handle anonymous + secure + directed communication?
- lesuorac 4y ago> How do you verify + vouch for a new user in a way that's secure yet anonymous? > How do you handle anonymous + secure + directed communication? I believe the answer is PGP key meet-ups.
- manv1 4y agoFor a criminal enterprise, FTF authentication is probably fine. You might use PGP keys hidden behind a QR code or something that's user-friendly. But then you have the other operational issues with the cells, like what do you do when your cell is compromised, or how does a cell reattach to the network if an upper level point-of-contact is compromised. And there are administrative issues...like a shared calendar. Payroll. Inventory. Logistics alone makes a cell structure difficult, because logistics means coordination among many people. It would be an interesting project to make for sure.
- lesuorac 4y agoI think if you make an actual concerted effort behind FTF it'll work fine due to 6* of separation [1] as well as I would assume once you have the FTF setup working you can just piggy-back on existing systems (i.e. the internet). I assume for a compromise you can just do the same set-up as pre-compromise except at level+1 and level-1 instead of level+1 and level. Figuring out who is compromised is non-trivial but that was the case without a cell structure anyways. Cell structures should make logistics easier. Thing about MergeSort vs BubbleSort. The amount of comparisons needed by MergeSort is less because of the cell structure. If you're trying to make a master calendar, it's going to be easier to have the cells create their own calendar and then merge them at the cell level and then merge those at the next level and etc until they're all merged than have everybody make their own calendar and talk to everybody else to resolve conflicts. IIUC, payroll works this way for the federal government. Treasury has a big pile of money it lumps out to various departments which lump it out to divisions which goes out to actual employees. [1]: https://en.wikipedia.org/wiki/Six_degrees_of_separation https://en.wikipedia.org/wiki/Six_degrees_of_separation
- ufmace 4y agoI always wonder why these guys are using such broken stuff. Surely they can find someone to fire up a private Matrix server for them all to do business on.
- fnordpiglet 4y agoThere almost certainly are criminals doing this, or better. For instance, Tor and “dark web” stuff are fairly widely used, along with crypto. These things capture the other side of the curve from lex Luthor.
- rubychill 4y agoThere are currently hearings being held around the legality of the collection from the AN0M app. https://www.abc.net.au/news/2023-04-18/accused-criminals-challenge-an0m-app-evidence-in-supreme-court/102107344 https://www.abc.net.au/news/2023-04-18/accused-criminals-cha...
- RedComet 4y agoTldr?
- fyloraspit 4y agoA bunch of prominent independently produced and maintained 'secure' communications networks marketed to black markets were intercepted by global law enforcement networks, shutdown, and many criminal cases were made off the back of those takedown operations.
- frankfrankfrank 4y agoIt depends on which crooks one is talking about, the crooks in government seem to enjoy all kinds of advantages that come from encrypted devices, as wet know, even setting up honey pots.
- latchkey 4y agoI was curious about the Gates quote, since I had never heard it before. https://www.washingtonpost.com/archive/opinions/1999/06/28/opening-the-lines-for-criminal-conversation/60140165-ed71-48ac-9e37-1397d4cde1db/ https://www.washingtonpost.com/archive/opinions/1999/06/28/o... It didn't seem to have been archived before either: https://archive.is/2IZPk https://archive.is/2IZPk