4 ms·
Not safe at all. Timing analysis can detect correlations between data arriving at the interviewers computer with data sent by the suspect's computer. Encryptio
by tlb 13y ago
Not safe at all. Timing analysis can detect correlations between data arriving at the interviewers computer with data sent by the suspect's computer.
Encryption is good at keeping the contents secret, but not the source of traffic.
- gasull 13y agoI2P has protection against timing attacks. Bitmessage has deniability, but if the receiver end is compromised or untrustworthy, then the deniability is gone, and the timing attack might be possible. Combining Bitmessage and I2P would be solution, I think, but I don't know of any Bitmessage nodes on I2P.
- foobarqux 13y agoBitmessage doesn't have forward secrecy.
- tlb 13y agoNot really. From the I2P FAQ: Without protocol scrubbing or higher latency, global active adversaries can gain substantial information. As such, people concerned with these attacks could increase the latency (using nontrivial delays or batching strategies), include protocol scrubbing, or other advanced tunnel routing techniques, but these are unimplemented in I2P Bitmessage is only plausibly deniable, meaning a traffic analysis is likely to narrow down the list of senders to a few, which is good enough in a manhunt.
- rdl 13y agoSnowden isn't "in hiding" from intelligence agencies, only from the news media. I assess with virtually nil probability that US and Chinese/HK intelligence don't know where he is right now (the only way one intelligence service wouldn't know details is if the other has already taken him into protection or custody). He doesn't need to use anonymity systems now; he just needs to use a service which doesn't report IP address to the other end. A simple VPN or whatever would be fine. If I were seriously on the run, I'd be using a system with days of latency (variable over 1-5 days), which blended in with a widespread current system. Essentially Len Sassaman's old mixmaster remailer system, which interfaces with the world over SMTP. The problem is there aren't enough mixmaster nodes to be really enough now, so you'd want to use a fairly anonymous sender too, and the old "USENET message pool" style systems don't work now that "USENET" basically means "http access to one of a few big providers", too. Kind of a step back from where we were in 1999, which is bullshit :(
- ljf 13y agoAnother anonymous form of communication he could use that would he an lot simpler and hard to track would be old fashioned mail. No need to use a sledgehammer and all that.