9 ms·

That's not what I mean. On that page (http://www.newyorker.com/strongbox/ http://www.newyorker.com/strongbox/, no SSL, no hashing, etc.) is an onion link. I s

by reeses 13y ago

That's not what I mean. On that page (http://www.newyorker.com/strongbox/ http://www.newyorker.com/strongbox/, no SSL, no hashing, etc.) is an onion link. I see it as http://tnysbtbxsf356hiy.onion http://tnysbtbxsf356hiy.onion. An adversary with sufficient access (whether to the server, or to the network between the New Yorker site and your browser) can rewrite that link without your ever knowing. Then you are legitimately directing your browser, once on Tor, to a spoofed site.

sneak 13y ago
True, but you can bookmark it, and compare it against the one used by others. They're also short - you can write them down and communicate them offline. To compare, ssh uses no PKI, but is relatively resistant to MITM as it stores public key fingerprints for a given service on first access.
- reeses 13y ago
  bookmark...others...offline. Be more paranoid.
  - deleted 13y ago
    [deleted]
  - jlgreco 13y ago
    Yes, what if someone MiTM's your offline communication... /s If the Feds (or whoever) were swapping out this address at a large scale, then the NYTs would notice and communicate to the public that this was happening. If the NYT was muzzled and every computer that you or anyone you know has it's connection being tampered with, then you are basically fucked anyway and this is the least of your concerns. At this level of paranoia you shouldn't be trusting the NYT anyway... If they are not MiTM'ing this at a large scale, then quick verifications on other networks with other peoples' computers will work just fine.
    - reeses 13y ago
      Let's take a simple example. A soldier deployed overseas sees this link, sets up Tor, and sends some confidential information that includes evidence that the US government is up to some shenanigans. After Manning and some other fun, the military is not really a fan of this happening, but realizes that it would provide an excellent way to identify seditious elements who don't have other channels to work out their moral dilemmas (or just their annoyance at being an expendable cog in the bureaucracy). MilInTheMiddle proxy rewrites the page, replaces just that link with one that is under their control, then waits. People outside the military see the normal link, but a kid in Iraqistan sees the honeypot. When s/he sends secrets to the New Yorker (it's not even the NYT), the operator has a lead not only on what information may be flowing to the media, but is able to stop it and investigate the sender. The same case could be made for financial institutions, government agencies, people in foreign countries with national firewalls, etc. The only reason I'm not particularly concerned about this is that I strongly suspect that a) the organizations don't really have their sh*t together enough to do this in a fashion that wouldn't create immense blowback when (not if) discovered, and b) there are easier methods to get similar information already in place.
      - jlgreco 13y ago
        That scenario is what "offline" is for. That soldier could call up his mum and ask her to read off the link over the phone. There is no way that anything but an utterly game-changing surveillance and censorship system is going to MiTM that in time. Or he could give some local kid a candy bar to look it up at an internet cafe, or hold onto the data until more alternative communication channels open up for him. If this soldier's communication is blacked out to the point that he cannot ask anyone else to verify the link using an internet connection other than his own, then it probably isn't safe for him to be attempting whatever it is that he is doing in the first place.
        reeses 13y ago
        It's not blacked out. It's subtly and near-undetectably changed. Who says the soldier is tech-savvy enough to know to talk on an alternate secure backchannel because s/he can't trust the same Internet that has fantasy football and funny videos on YouTube? Let's reduce this even further. The New Yorker has put up a webpage saying,"Send your secrets here!" Pretend they put up a phone number instead. 1-800-231-2142. The military phone switching system can either automatically redirect calls to that number to a switchboard of impersonators, or they could change the number to one they already have, so that they can also capture military assets using personal phones, mobiles, etc. The New Yorker page does not give any information about "offline" validation. They give a pointer to a supposedly secure dropbox. That dropbox may actually be secure, but there are a number of ways to subvert it.

by reeses 13y ago

sneak 13y ago

True, but you can bookmark it, and compare it against the one used by others. They're also short - you can write them down and communicate them offline. To compare, ssh uses no PKI, but is relatively resistant to MITM as it stores public key fingerprints for a given service on first access.

reeses 13y ago
bookmark...others...offline. Be more paranoid.
- deleted 13y ago
  [deleted]
- jlgreco 13y ago
  Yes, what if someone MiTM's your offline communication... /s If the Feds (or whoever) were swapping out this address at a large scale, then the NYTs would notice and communicate to the public that this was happening. If the NYT was muzzled and every computer that you or anyone you know has it's connection being tampered with, then you are basically fucked anyway and this is the least of your concerns. At this level of paranoia you shouldn't be trusting the NYT anyway... If they are not MiTM'ing this at a large scale, then quick verifications on other networks with other peoples' computers will work just fine.
  - reeses 13y ago
    Let's take a simple example. A soldier deployed overseas sees this link, sets up Tor, and sends some confidential information that includes evidence that the US government is up to some shenanigans. After Manning and some other fun, the military is not really a fan of this happening, but realizes that it would provide an excellent way to identify seditious elements who don't have other channels to work out their moral dilemmas (or just their annoyance at being an expendable cog in the bureaucracy). MilInTheMiddle proxy rewrites the page, replaces just that link with one that is under their control, then waits. People outside the military see the normal link, but a kid in Iraqistan sees the honeypot. When s/he sends secrets to the New Yorker (it's not even the NYT), the operator has a lead not only on what information may be flowing to the media, but is able to stop it and investigate the sender. The same case could be made for financial institutions, government agencies, people in foreign countries with national firewalls, etc. The only reason I'm not particularly concerned about this is that I strongly suspect that a) the organizations don't really have their sh*t together enough to do this in a fashion that wouldn't create immense blowback when (not if) discovered, and b) there are easier methods to get similar information already in place.
    - jlgreco 13y ago
      That scenario is what "offline" is for. That soldier could call up his mum and ask her to read off the link over the phone. There is no way that anything but an utterly game-changing surveillance and censorship system is going to MiTM that in time. Or he could give some local kid a candy bar to look it up at an internet cafe, or hold onto the data until more alternative communication channels open up for him. If this soldier's communication is blacked out to the point that he cannot ask anyone else to verify the link using an internet connection other than his own, then it probably isn't safe for him to be attempting whatever it is that he is doing in the first place.
      - reeses 13y ago
        It's not blacked out. It's subtly and near-undetectably changed. Who says the soldier is tech-savvy enough to know to talk on an alternate secure backchannel because s/he can't trust the same Internet that has fantasy football and funny videos on YouTube? Let's reduce this even further. The New Yorker has put up a webpage saying,"Send your secrets here!" Pretend they put up a phone number instead. 1-800-231-2142. The military phone switching system can either automatically redirect calls to that number to a switchboard of impersonators, or they could change the number to one they already have, so that they can also capture military assets using personal phones, mobiles, etc. The New Yorker page does not give any information about "offline" validation. They give a pointer to a supposedly secure dropbox. That dropbox may actually be secure, but there are a number of ways to subvert it.