5 ms·

bookmark...others...offline. Be more paranoid.

by reeses 13y ago

deleted 13y ago
[deleted]
jlgreco 13y ago
Yes, what if someone MiTM's your offline communication... /s If the Feds (or whoever) were swapping out this address at a large scale, then the NYTs would notice and communicate to the public that this was happening. If the NYT was muzzled and every computer that you or anyone you know has it's connection being tampered with, then you are basically fucked anyway and this is the least of your concerns. At this level of paranoia you shouldn't be trusting the NYT anyway... If they are not MiTM'ing this at a large scale, then quick verifications on other networks with other peoples' computers will work just fine.
- reeses 13y ago
  Let's take a simple example. A soldier deployed overseas sees this link, sets up Tor, and sends some confidential information that includes evidence that the US government is up to some shenanigans. After Manning and some other fun, the military is not really a fan of this happening, but realizes that it would provide an excellent way to identify seditious elements who don't have other channels to work out their moral dilemmas (or just their annoyance at being an expendable cog in the bureaucracy). MilInTheMiddle proxy rewrites the page, replaces just that link with one that is under their control, then waits. People outside the military see the normal link, but a kid in Iraqistan sees the honeypot. When s/he sends secrets to the New Yorker (it's not even the NYT), the operator has a lead not only on what information may be flowing to the media, but is able to stop it and investigate the sender. The same case could be made for financial institutions, government agencies, people in foreign countries with national firewalls, etc. The only reason I'm not particularly concerned about this is that I strongly suspect that a) the organizations don't really have their sh*t together enough to do this in a fashion that wouldn't create immense blowback when (not if) discovered, and b) there are easier methods to get similar information already in place.
  - jlgreco 13y ago
    That scenario is what "offline" is for. That soldier could call up his mum and ask her to read off the link over the phone. There is no way that anything but an utterly game-changing surveillance and censorship system is going to MiTM that in time. Or he could give some local kid a candy bar to look it up at an internet cafe, or hold onto the data until more alternative communication channels open up for him. If this soldier's communication is blacked out to the point that he cannot ask anyone else to verify the link using an internet connection other than his own, then it probably isn't safe for him to be attempting whatever it is that he is doing in the first place.
    - reeses 13y ago
      It's not blacked out. It's subtly and near-undetectably changed. Who says the soldier is tech-savvy enough to know to talk on an alternate secure backchannel because s/he can't trust the same Internet that has fantasy football and funny videos on YouTube? Let's reduce this even further. The New Yorker has put up a webpage saying,"Send your secrets here!" Pretend they put up a phone number instead. 1-800-231-2142. The military phone switching system can either automatically redirect calls to that number to a switchboard of impersonators, or they could change the number to one they already have, so that they can also capture military assets using personal phones, mobiles, etc. The New Yorker page does not give any information about "offline" validation. They give a pointer to a supposedly secure dropbox. That dropbox may actually be secure, but there are a number of ways to subvert it.
      - jlgreco 13y ago
        Any information that they gave about offline validation could just be stripped out though! What exactly are you proposing that they do that could not be subverted by the very things you are concerned about? Offline verification would work, but if we are assuming extensive MiTMing and meatspace impersonation then offline verification is just something the whistleblower needs to figure out themselves.
        13y ago

bookmark...others...offline. Be more paranoid.

by reeses 13y ago

bookmark...others...offline. Be more paranoid.

deleted 13y ago

[deleted]

jlgreco 13y ago

Yes, what if someone MiTM's your offline communication... /s If the Feds (or whoever) were swapping out this address at a large scale, then the NYTs would notice and communicate to the public that this was happening. If the NYT was muzzled and every computer that you or anyone you know has it's connection being tampered with, then you are basically fucked anyway and this is the least of your concerns. At this level of paranoia you shouldn't be trusting the NYT anyway... If they are not MiTM'ing this at a large scale, then quick verifications on other networks with other peoples' computers will work just fine.

reeses 13y ago
Let's take a simple example. A soldier deployed overseas sees this link, sets up Tor, and sends some confidential information that includes evidence that the US government is up to some shenanigans. After Manning and some other fun, the military is not really a fan of this happening, but realizes that it would provide an excellent way to identify seditious elements who don't have other channels to work out their moral dilemmas (or just their annoyance at being an expendable cog in the bureaucracy). MilInTheMiddle proxy rewrites the page, replaces just that link with one that is under their control, then waits. People outside the military see the normal link, but a kid in Iraqistan sees the honeypot. When s/he sends secrets to the New Yorker (it's not even the NYT), the operator has a lead not only on what information may be flowing to the media, but is able to stop it and investigate the sender. The same case could be made for financial institutions, government agencies, people in foreign countries with national firewalls, etc. The only reason I'm not particularly concerned about this is that I strongly suspect that a) the organizations don't really have their sh*t together enough to do this in a fashion that wouldn't create immense blowback when (not if) discovered, and b) there are easier methods to get similar information already in place.
- jlgreco 13y ago
  That scenario is what "offline" is for. That soldier could call up his mum and ask her to read off the link over the phone. There is no way that anything but an utterly game-changing surveillance and censorship system is going to MiTM that in time. Or he could give some local kid a candy bar to look it up at an internet cafe, or hold onto the data until more alternative communication channels open up for him. If this soldier's communication is blacked out to the point that he cannot ask anyone else to verify the link using an internet connection other than his own, then it probably isn't safe for him to be attempting whatever it is that he is doing in the first place.
  - reeses 13y ago
    It's not blacked out. It's subtly and near-undetectably changed. Who says the soldier is tech-savvy enough to know to talk on an alternate secure backchannel because s/he can't trust the same Internet that has fantasy football and funny videos on YouTube? Let's reduce this even further. The New Yorker has put up a webpage saying,"Send your secrets here!" Pretend they put up a phone number instead. 1-800-231-2142. The military phone switching system can either automatically redirect calls to that number to a switchboard of impersonators, or they could change the number to one they already have, so that they can also capture military assets using personal phones, mobiles, etc. The New Yorker page does not give any information about "offline" validation. They give a pointer to a supposedly secure dropbox. That dropbox may actually be secure, but there are a number of ways to subvert it.
    - jlgreco 13y ago
      Any information that they gave about offline validation could just be stripped out though! What exactly are you proposing that they do that could not be subverted by the very things you are concerned about? Offline verification would work, but if we are assuming extensive MiTMing and meatspace impersonation then offline verification is just something the whistleblower needs to figure out themselves.
      - 13y ago