3 ms·

I absolutely agree with you, but I was addressing the potentially misleading title of the article, not the current dragnet observation (which is why I quoted th

I absolutely agree with you, but I was addressing the potentially misleading title of the article, not the current dragnet observation (which is why I quoted the title of the article). Many people that may not be experienced in cryptography may think that these techniques would protect them from law enforcement, or that their encryption would actually be "NSA proof." Your description of secure communication (Tor, anonymous XMPP, etc.) is totally accurate and a great explanation for those who may not be quite as familiar with security and OPSEC. Unfortunately, with great enough amounts of metadata and computing power, this could theoretically be correlated as well. DNS requests or Tor connections correlated with encrypted messages timed between two individuals seems like it would be too hard to make meaningful, but it's not impossible. There's precedence for this when the FBI suspected Jeremy Hammond of being a certain identity on IRC, and correlated his sign-ons with connections to Tor. You're absolutely, 100% correct, though, that this data (even correlated), must be part of some sort of targeted surveillance. I wasn't trying to counter the dragnet argument as much as provide clarity on what these security measures would or would not do. Thanks for providing even more clarity in the areas I didn't address :)

tedks 13y ago
You're quite welcome. I'm glad you liked the description. The title of the article is indeed misleading; a better one would be "PRISM-proof." With a total record of the entire Internet (global passive adversary), you could definitely defeat anything using Tor, but I wonder if you could make it significantly harder still by randomly generating XMPP accounts every time. There's a potentially infinite space, and you can do XMPP registration in-band. Of course, you could also just run XMPP servers locally as chat endpoints, and never have subpoena-able records. These could be Tor hidden services, which would give you the added bonus of global reachability. I think this eliminates most correlation attacks you could do; all you'd see on Alice and Bob's endpoints would be Tor circuits. All this will make for a really interesting Wire reboot, if/when that happens.

tedks 13y ago

You're quite welcome. I'm glad you liked the description. The title of the article is indeed misleading; a better one would be "PRISM-proof." With a total record of the entire Internet (global passive adversary), you could definitely defeat anything using Tor, but I wonder if you could make it significantly harder still by randomly generating XMPP accounts every time. There's a potentially infinite space, and you can do XMPP registration in-band. Of course, you could also just run XMPP servers locally as chat endpoints, and never have subpoena-able records. These could be Tor hidden services, which would give you the added bonus of global reachability. I think this eliminates most correlation attacks you could do; all you'd see on Alice and Bob's endpoints would be Tor circuits. All this will make for a really interesting Wire reboot, if/when that happens.