8 ms·
Snowden, just remember that Kevin Poulsen and Adrian Lamo helped the US Government in catching Bradley Manning. EDIT: Also, a pretty safe way to carry an inter
by gasull 13y ago
Snowden, just remember that Kevin Poulsen and Adrian Lamo helped the US Government in catching Bradley Manning.
EDIT: Also, a pretty safe way to carry an interview would be VPN + Tor + Bitmessage.
EDIT2: Users sneak and tlb claim Tor isn't safe because of timing attacks. Read below.
- sneak 13y agoThat's not safe at all, considering the organization tracking him.
- tlrobinson 13y agoIf not that, then what? If anything?
- alan_cx 13y agoIf it were me, literally, I go olde skool. Nothing electronic what so ever.
- rfnslyr 13y agoWhat about a pager? Can that somehow lead them to you? I'm not talking about tactics, but about the device in itself.
- alan_cx 13y agoNo idea. I wouldn't dare to risk it. For me, I just have always assumed that electronic communications are easier to compromise than old traditional ones. In the end, you connect to an ISP and packets can be inspected. OK, you might have encryption, but there have been too many schemes cracked or broken. So, why ever think that electronic comms can ever be secure? In the extreme, if the spooks get your encrypted data and they really believe that the data contains the "ticking bomb", they'll just torture you until you give up the key. So, you're still stuffed. Why give them even that much? More over, the one big issue I have to electronic communications, is that it is very hard to know if you are under surveillance. The old methods give you a better chance to discover that you are being watched. It is also easier to hide the fact that you are communicating at all. The clincher for me was that a while ago an "amusing" story appeared in a British news paper. Essentially it "exposed" MI6 spies in Moscow using actual drop boxes to pass along information. Now, if MI6 are still using pre-WWII methods, that has to tell you something, right? They don't trust the electronic methods. So, if secure communications really mattered to me, life or death type mattered, then I'd be looking at things like one time pads, drop boxes, people, etc. Of course a lot of it depends on what you are trying to communicate, how many people are involved, and frankly how much money you have to use. One thing I do know, electronics would be something I would work very hard to avoid. Lastly, if I were going to whistle blow to a journalist on this scale, the first thing I would establish would be several methods of communication. Times, places, codes, etc. I suspect that, given the nature of this exposure, that will have been done, and none of it will be electronic.
- TillE 13y agoThe medium is irrelevant if you're using a OTP that has already been securely exchanged. You can broadcast your message to the world, like number stations do. To anyone without the OTP, it's quite literally impossible to decrypt.
- MacsHeadroom 13y agoSecrecy of the message and secrecy of the source are two different beasts entirely. OTPs solve the easy part of this two part problem.
- alan_cx 13y agoIndeed and, in theory, 100% agreed. But remember my bit about knowing if you are being watched. Electronic, I have no idea, unless, IIRC, we get quantum about it. Old skool, chances are better. I, or a friend can observe my drop box or exchange, and so on. Im not saying there are no good electronic methods, I am saying that ultimately I'd be more comfortable not using them. Remember too, I am talking ultimate paranoia, life and death. In the end of course the weakest link of all is the humans operating any system. I mean, the whole PRISM thing was blown by a human. The other thing in my mind is that these days spooks expect and are geared up for electronic comms, not so human comms. Budgets slashed, less "watchers", and men on the ground. Going olde skool is a sort of curved ball. Also, I know paper. I can verify hiding places. I can watch people move. I am not good enough to review, completely and confidently, code and encryption software. I would have to trust programmers I dont know, in a climate where we believe the likes of GCHQ, NSA, etc have back doors and cracks. We are given to understand that these people are all over electronic comms. As far as I know, they have not penetrated writing paper and hiding holes. They are not invisible either. Maybe you and others are good enough to verify all the software, encryption and networking software and hardware sufficiently enough to trust your life to it. I know I'm not. In short, if my life is on the line, I would go with what I know best. I know paper better than deeply complex mathematics and programming. Besides, given the revelations, why even bother to risk it? Even before all this, I would laugh my nuts off at terrorists who were caught and convicted using electronic evidence. I thought them idiots for even touching a computer to arrange terrorism. I assume that now, they wont be so stupid. It was nice and easy for the authorities to plunder their computers and and electronic trail. Now their job just got harder.
- redthrowaway 13y agoYou could always rent a botnet for an hour and broadcast PGP messages to all nodes. I'm sure there'd be hacker forums in China where you could rent a mostly HK-based net.
- gasull 13y agoWhen using Bitmessage, everybody receives all the messages in the blockchain. How is the timing attack going to identify him? Maybe Bitmessage helps receiving messages anonymously, but the timing attack might still be possible when sending messages. I2P can mitigate the problem, but I don't think Bitmessage has any nodes in I2P. I would say that, if you don't trust Poulsen, don't talk to him.
- Sami_Lehtinen 13y agoWhen user receives message, delivery confirmation is sent back.
- MysticFear 13y agoHe publicly stated he isn't trying to hide from authorities.
- Mithrandir 13y agoThis seemed relevant from Wikipedia (https://en.wikipedia.org/wiki/Adrian_Lamo#Greenwald.2C_Lamo.2C_Wired_magazine https://en.wikipedia.org/wiki/Adrian_Lamo#Greenwald.2C_Lamo....): Lamo's role in the Manning case drew the ire of Glenn Greenwald, of Salon Magazine. An ardent supporter of WikiLeaks, Greenwald has been a passionate critic of Lamo, suggesting that Lamo lied to Manning by turning him in, and also lied after the fact to cover up the circumstances of Manning's confessions. Greenwald places the incident in the context of what he calls "the Obama administration's unprecedented war on whistle-blowers". Greenwald's critique of Wired Magazine has drawn a response from that magazine which suggests that Greenwald is writing disingenuously: "At his most reasonable, Greenwald impugns our motives, attacks the character of our staff and carefully selects his facts and sources to misrepresent the truth and generate outrage in his readership." In an article about the Bradley Manning case, Greenwald mentions Wired reporter Kevin Poulsen's 1994 felony conviction for computer hacking, suggesting that "over the years, Poulsen has served more or less as Lamo's personal media voice." Greenwald is skeptical of an earlier story written by Poulsen about Lamo's institutionalization on psychiatric grounds, writing: "Lamo claimed he was diagnosed with Asperger's Syndrome, a somewhat fashionable autism diagnosis which many stars in the computer world have also claimed." In his response, Poulsen accused Greenwald of "name-calling, bizarre conspiracy theories and ad hominem attacks".
- Glyptodon 13y agoCount me among those suspicious of Lamo and Poulsen. I don't care for them.
- justin66 13y ago> Greenwald has been a passionate critic of Lamo, suggesting that Lamo lied to Manning by turning him in, and also lied after the fact to cover up the circumstances of Manning's confessions. Not sure about the second part, but the fact that Lamo lied to Manning isn't controversial. He's talked about it in a few interviews. This one was a little odd: http://www.guardian.co.uk/world/2013/jan/03/adrian-lamo-bradley-manning-q-and-a http://www.guardian.co.uk/world/2013/jan/03/adrian-lamo-brad...
- 13y ago
- tlb 13y agoNot safe at all. Timing analysis can detect correlations between data arriving at the interviewers computer with data sent by the suspect's computer. Encryption is good at keeping the contents secret, but not the source of traffic.
- gasull 13y agoI2P has protection against timing attacks. Bitmessage has deniability, but if the receiver end is compromised or untrustworthy, then the deniability is gone, and the timing attack might be possible. Combining Bitmessage and I2P would be solution, I think, but I don't know of any Bitmessage nodes on I2P.
- foobarqux 13y agoBitmessage doesn't have forward secrecy.
- tlb 13y agoNot really. From the I2P FAQ: Without protocol scrubbing or higher latency, global active adversaries can gain substantial information. As such, people concerned with these attacks could increase the latency (using nontrivial delays or batching strategies), include protocol scrubbing, or other advanced tunnel routing techniques, but these are unimplemented in I2P Bitmessage is only plausibly deniable, meaning a traffic analysis is likely to narrow down the list of senders to a few, which is good enough in a manhunt.
- enoch-root 13y ago> isn't safe because of timing attacks What about that it isn't safe because of who is running many of the exit nodes?
- ohazi 13y agoIt has more to do with the structure of the public internet. A fully passive observer in a few key locations has a surprisingly high probability of being able to perform correlation attacks. This is a pretty interesting "where do I start?" paper if you want to know more but don't have much background on the subject: http://www.syverson.org/tor-vulnerabilities-iccs.pdf http://www.syverson.org/tor-vulnerabilities-iccs.pdf
- foobarqux 13y agoPond would be the thing to use if it were ready. https://github.com/agl/pond https://github.com/agl/pond
- fnordfnordfnord 13y ago>Snowden, just remember that Kevin Poulsen and Adrian Lamo helped the US Government in catching Bradley Manning. I posted something to that effect in the article's comments. It was moderated and comments are now closed (at least for me).
- gasull 13y agoI did too. All comments are gone right now, including mine. "Commenting has been disabled for this article"
- stackedmidgets 13y ago'Please stop pointing out that our staffer is a dumb collaborator.'
- deleted 13y ago[deleted]
- klpwired 13y agoThis is Kevin Poulsen. Just popping in to correct this. Adrian Lamo turned in Bradley Manning. All I did (being a reporter) is break the news. http://www.wired.com/threatlevel/2010/06/leak/ http://www.wired.com/threatlevel/2010/06/leak/ http://www.wired.com/threatlevel/2010/06/conscience/ http://www.wired.com/threatlevel/2010/06/conscience/
- humanspecies 13y agoMy guess is more people liked you when you were just a hacker that almost got in Bradley Manning's shoes.
- pvnick 13y agoI'm sorry you've found yourself in the crossfire. How do you feel about Snowden?
- klpwired 13y agoHe's a whistleblower of historic importance. That Verizon FISA order alone has exposed deception at the highest levels of government. Proof that an Ars Technica reader can amount to something.
- TillE 13y ago> Proof that an Ars Technica reader can amount to something. Cute. I'm sure he read Dilbert a few times too. It takes quite an astonishing level of arrogance to suggest that being an "Ars Technica reader" was an important part of his identity, as that article did. Internet nerd makes a few comments on tech website, huge shock there.
- meowface 13y agoI'm pretty sure he was being sarcastic, playing on the fact that Wired and Ars Technica are sort of competitors.
- 13y ago
- einhverfr 13y agoI think he will keep things to sporadic in-person interviews and frequent changes of where he stays. But I don't think he will stay hidden. I bet as soon as an indictment is handed down, he will turn himself in to the Hong Kong authorities and start fighting extradition.
- rdl 13y agoIt's reasonable to not trust Lamo, and maybe even Kevin Poulsen (although IMO he's just reported the news in the PFC Manning case; it's Adrian who turned PFC Manning in. OTOH, if I'd been in Lamo's position (convicted felon!), I probably would have turned him in, too, thinking the whole thing was a sting or otherwise a setup since it was so fucking brazen. The only other safe option is "I HAVE NO IDEA WHAT YOU ARE SAYING, NEITHER AGREE NOR UNDERSTAND, AND DON'T EVER CONTACT ME AGAIN."). However, I'd trust Declan McCullagh more than any other journalist I know. He also writes for Wired. He's not uncritical of the PRISM story, but I'd trust him to be fair, and he wouldn't himself become part of the story.
- dfc 13y agoI miss politechbot. I will never understand why so many discussion venues transitioned to forums from mailing lists.
- rdl 13y agoAd revenue. :( liberationtech seems good; p2p-hackers was ok for a while. the old cryptography list was ok in a couple of the incarnations. cypherpunks before the great decline is still my gold standard, though. (remops has been ok at times; some of the digital gold lists were also interesting).
- dfc 13y agoThe p2p-hackers channel was also interesting around the same time. The fact that you have to differentiate between the "old cryptography list" and its newer incarnations is sad. I think with each move the list went down hill. It seems half the posts to cryptography are either cc'ed to cpunks and a bunch of other lists or the message is a conference announcement.
- dfc 13y agoWhen I get bored/nostalgic I will search gmane for one of the prolific mailing list subscribers like Eugen Leitl or that Vladis dude from VT. I found liberationtech via Eugene.
- teeja 13y agoA couple of days ago I read that 'As of 2012, 80% of the Tor Project's $2M annual budget comes from the United States government.' http://online.wsj.com/article/SB10001424127887324677204578185382377144280.html?mod=googlenews_wsj http://online.wsj.com/article/SB1000142412788732467720457818... That might be another reason that TOR isn't safe. You don't ever know who any of the other servers belong to ... and the staff at the Exit Node can (and has) read anything. I wouldn't bet my life on software 'originally sponsored by the U.S. Naval Research Laboratory'.
- hnha 13y agoyou can simply run a node yourself and make your client use it.
- tekromancr 13y agoSo that they could conduct cyberwarfare ops and maintain deniability. Math is math. All of the cards are on the table, the code is entirely open. The protocol is designed in such a way that any of the in-transit nodes know fuckall about the messages source, destination, or content. There is no "the" exit node, anyone can operate one. Not to mention that there is nothing stopping you from encrypting the data going into the network in the first place. And If you think for a second that the military has some magical insight into information-theory that allowed them to hide a backdoor in a god damn protocol spec, then shit, they can probably factor large primes too, in which case modern crypto is broken.
- crdoconnor 13y ago>There is no "the" exit node, anyone can operate one. From what I understand an awful lot of them are run by the US government.
- tekromancr 13y agoThere is one way to fix that, but it involves you having to explain why your IP address has been accessing CP honeypots.
- 13y ago
- deleted 13y ago[deleted]
- peripetylabs 13y agoI hope Snowden realizes that none of this matters if an FBI agent is sitting beside the reporter as they communicate.
- im3w1l 13y agoPresumably the contents of the conversation will not be secret. Only the location of Snowden.
- fckthensa 13y agoI am not sure about Bitmessage. It is a very new project and has not been subject to any deep security test. Also, VPNs are as safe as long as the VPN provider is on your side. Tor is your best option.
- gasull 13y agoI was talking about combining all them three: Bitmessage through Tor through VPN.