11 ms·

Wikileaks Releases New 'Insurance' Files

187 points by jlgreco 13y ago

deleted 13y ago
[deleted]
hayksaakian 13y ago
This seems like a good plan to me, but can any crypto pros poke holes in it?
- rubbingalcohol 13y ago
  Sure. I'll get back to you in a few trillion years.
  - cheald 13y ago
    Psh, everyone knows that it only takes the span of a commercial break to crack military-grade double-layered crypto if you use a logic bomb.
    - marcamillion 13y ago
      So why don't you do it then? You would be famous for sure.
      - cheald 13y ago
        I would, but I don't know how to write a GUI interface in Visual Basic :(
        raverbashing 13y ago
        Decrypting [====______]
    - Keyframe 13y ago
      I don't know VB though. On a serious note I wonder if there are guys out there that treat this tease as a challenge and try to poke holes themselves. Must be a thrill.
    - SimHacker 13y ago
      Hey guys and gals, I just found an FTP server FULL of secret NSA files! Its IP address is 127.0.0.1 -- check it out!!! http://www.cryonet.org/cgi-bin/dsp.cgi?msg=6289 http://www.cryonet.org/cgi-bin/dsp.cgi?msg=6289
- nwh 13y ago
  When you're up against the US government with all of their cracking hardware, your passphrase won't be simple.
  - jlgreco 13y ago
    Unless the insurance files are bluffs, you may as well give the US government the keys yourself so that they know you are not bluffing. The threat that makes the insurance files work is that the public/press and/or foreign governments may get the keys.
    - kaolinite 13y ago
      The problem with doing that is that the US government might release the information themselves, just dampened a bit with some PR, so the insurance files aren't worth anything and so WikiLeaks don't get the credit.
      - XorNot 13y ago
        Which would generally imply that they're not very good insurance files. I had the last one for a bit, and deleted it just now because I'm seriously doubtful these things are anything more then /dev/urandom piped into a file.
        nwh 13y ago
        What gives you any indication of that? There's no way of telling a ciphertext from random bytes.
        gwern 13y ago
        Well, obviously, there's no way of telling or he'd simply crack the file and say it was random. His point is based more on softer considerations like "they never used the previous insurance file yet, have they?" and "Wikileaks pulls a lot of stunts" and "this is just the sort of thing that would appeal to a cryptogeek like Assange whose avowed purpose is to throw sand into the gears of secretive organizations" and "so how did they get 300GB+ of leaked stuff since the site has been half-inactive for years and Assange completely distracted by his legal issues? Who would trust them with it? eg. Snowden didn't go to Wikileaks".
- JoachimSchipper 13y ago
  Clearly, just use a standard solution (PGP). Don't do this with a weak passphrase, and use key-strengthening (bcrypt etc.) just in case. Assange is pretty good at crypto, so I'd expect Wikileaks to broadly get this right. Also, they already got in trouble for reusing a password (http://boingboing.net/2011/08/31/wikileaks-guardian-journalist-negligently-published-password-to-unredacted-cables.html http://boingboing.net/2011/08/31/wikileaks-guardian-journali...), so I'm pretty sure they won't do that again...
  - raverbashing 13y ago
    No, the key strengthening is probably built-in. Also, most likely it doesn't use a passphrase, but a big generated gpg key (with a passphrase protecting it, of course)
    - JoachimSchipper 13y ago
      At least for symmetric encryption, gpg defaults (defaulted?) to SHA-1'ing the passphrase 2^16 times, which is not a very large number - http://passwords12.at.ifi.uio.no/Jeremi_Gosney_Password_Cracking_HPC_Passwords12.pdf http://passwords12.at.ifi.uio.no/Jeremi_Gosney_Password_Crac... [pdf] talks of ~2^36 operations per second. This isn't the worst thing ever, but using GPG for passphrase-protected encryption is not as strong as you might expect - just use a slightly longer/better one. (Obviously, don't switch to another tool if you can't evaluate it in depth - GPG isn't perfect, but picking a random other tool won't be an improvement.)
  - stefantalpalaru 13y ago
    > Assange is pretty good at crypto Not really. He gave a moron the password to a publicly distributed insurance file instead of making a new encrypted file just for him.
    - JoachimSchipper 13y ago
      Are you aware of http://en.wikipedia.org/wiki/Rubberhose_(file_system) http://en.wikipedia.org/wiki/Rubberhose_(file_system)?
hnha 13y ago
why on earth is this a link to Facebook of all things?
- hack37 13y ago
  because it may be the source of the news ?
- buster 13y ago
  I don't understand why they don't post it on their own site.. but well.. here is twitter: https://twitter.com/wikileaks/status/368426845735120896 https://twitter.com/wikileaks/status/368426845735120896
  - brokenparser 13y ago
    Thanks, I can't access Facebook from here. Might as well post the direct torrent URLs: 3,6GiB (20130815-A): http://wlstorage.net/torrent/wlinsurance-20130815-A.aes256.torrent magnet:?xt=urn:btih:e0a092ac0f9b56c886c41335ca36f34aaed6b80c&dn=wlinsurance-20130815-A.aes256&tr=udp%3A%2F%2Ftracker.publicbt.com%3A80%2Fannounce&tr=udp%3A%2F%2Ftracker.openbittorrent.com%3A80%2Fannounce&tr=udp%3A%2F%2Ftracker.istole.it%3A80%2Fannounce&tr=udp%3A%2F%2Ftracker.ccc.de%3A80%2Fannounce 49GiB (20130815-B): http://wlstorage.net/torrent/wlinsurance-20130815-B.aes256.torrent magnet:?xt=urn:btih:95381785c3fb446df35c5b4a8e5ef167dcb72011&dn=wlinsurance-20130815-B.aes256&tr=udp%3A%2F%2Ftracker.publicbt.com%3A80%2Fannounce&tr=udp%3A%2F%2Ftracker.openbittorrent.com%3A80%2Fannounce&tr=udp%3A%2F%2Ftracker.istole.it%3A80%2Fannounce&tr=udp%3A%2F%2Ftracker.ccc.de%3A80%2Fannounce 349GiB (20130815-C): http://wlstorage.net/torrent/wlinsurance-20130815-C.aes256.torrent magnet:?xt=urn:btih:091eed7793fdb48c5bd8488431e888dde41a889f&dn=wlinsurance-20130815-C.aes256&tr=udp%3A%2F%2Ftracker.publicbt.com%3A80%2Fannounce&tr=udp%3A%2F%2Ftracker.openbittorrent.com%3A80%2Fannounce&tr=udp%3A%2F%2Ftracker.istole.it%3A80%2Fannounce&tr=udp%3A%2F%2Ftracker.ccc.de%3A80%2Fannounce
    - deleted 13y ago
      [deleted]
    - deleted 13y ago
      [deleted]
adamnemecek 13y ago
I wonder what could be 349GB worth of data. Probably not text. Video?
- hijackson 13y ago
  My roomate's mother makes $87 hourly on the laptop. She has been fired for 7 months but last month her pay was $21739 just working on the laptop for a few hours. Read more here=====>>>>>=====www.jobs34.com
  - jacquesm 13y ago
    If you want that domain to die please continue to spam this forum. Of all the places on the web this is probably the least smart to pull stunts like this.
    - thewarrior 13y ago
      Does anyone actually fall for this stuff ?
      - jacquesm 13y ago
        ROI: if nobody would fall for it they wouldn't do it...
        RDeckard 13y ago
        That's funny hijackson, because My roomate's mother makes $87 hourly on the laptop. She has been fired for 7 months but last month her pay was $21739 just working on the laptop for a few hours. Read more here=====>>>>>=====www.jobs34.com
        kintamanimatt 13y ago
        I almost thought this comment was going to be a parody of the other! I'm kinda curious though. At $87/hour, she worked about 250 hours, which works out to be about 57 hours a week. If she only works a few hours at her laptop, the fuck is she doing the rest of the time?
crdoconnor 13y ago
I wonder what specific eventuality they're actually insuring against. Capture of Julian Assange?
- nwh 13y ago
  I would expect that they are going to be releasing something big in the next couple of weeks/months.
- atmosx 13y ago
  Can be related to both Snowden and Assange or even Manning. Sure thing is that these documents must be a sort of time-bombs: 10 years from now even if we crack them, won't have a meaning, but now... apparently they do.
Renaud 13y ago
I wonder what are the risks associated with downloading and sharing such torrents. Evidently, anyone getting them becomes a highly visible target and once the content of these torrents is known, you could become involved in the distribution of classified data. Even if the content is not known, it could be viewed as an 'unfriendly' act and could make you become a "target of interest" to some zealous 3-letter agency... Maybe I'm too paranoid. On the other hand, maybe not enough. Hard to know these days.
- Sven7 13y ago
  Well thank god for college kids.
- atmosx 13y ago
  And what if I'm not a USA citizens, they are watching me anyway. Anyway, if I were on the NSA's office, watching everyday comments on Hacker-News I'd already have targeted half it's crowd potentially dangerous to the security of the country, just for being so interested in national security matters. Those Geeks!!!
  - a3n 13y ago
    "Anyway, if I were on the NSA's office, watching everyday comments on Hacker-News ..." Wait, wait. You're saying there's a way to get paid to read HN all day? Where do I sign?
    - stefantalpalaru 13y ago
      > Where do I sign? Follow the path to the dark side [1]. They have cookies. [1]: https://www.nsa.gov/psp/applyonline/EMPLOYEE/HRMS/c/HRS_HRAM.HRS_CE.GBL?Page=HRS_CE_HM_PRE&Action=A&SiteId=1 https://www.nsa.gov/psp/applyonline/EMPLOYEE/HRMS/c/HRS_HRAM...
    - gugol 13y ago
      And for watching porn...
runn1ng 13y ago
Frankly, given what is going on, I would bet on this being the Snowden's NSA data
0x45696e6172 13y ago
Part of Wikileaks' manifest is a promise to the leakers to release the information eventually, and they have proven track record of doing so. Aware of this, I wonder if new insurance files will have any influence on the actions of their enemies.
- thirstywhimbrel 13y ago
  | I wonder if new insurance files will have any influence on the actions of their enemies. Even without that, no effect. Blackmailing a bureaucracy... it's not like dealing with a single rational actor. That's the Hollywood version of Washington. It's like coming upon a traffic jam and deciding you should bribe those responsible so you can go on your way.
  - saraid216 13y ago
    > It's like coming upon a traffic jam and deciding you should bribe those responsible so you can go on your way. This is officially my new favoritest analogy.
ChuckMcM 13y ago
So what is the chance they put out an insurance file that they know can be decrypted by the NSA and has really damaging documents in it? I mean it would be a way of showing the NSA what you have, having it already in the hands of a bunch of other people. I wonder if that would be a useful strategy. It could give the NSA time to build a counter story (parallel construction :-) which would be mitigate some of the impact, but it could also be construed as a form of "responsible disclosure" letting them know before the world knows so they can "patch their systems." I hope some creative writer is out there doing some exploration out there in a novel. Lots of interesting questions to think about with regard to the mechanics of this whole story.
- tjohns 13y ago
  If they're releasing something that they could reasonably expect the NSA to be able to crack, there's a non-zero chance other governments would be able to read it as well. That's not really "responsible disclosure" anymore. It would be safer to just send the decryption key directly to the NSA on a CD. ;)
  - ChuckMcM 13y ago
    Fair enough.
  - chimeracoder 13y ago
    Well, that also lets the NSA (or anybody who intercepts the CD) release the key to try and make it look like it came from Wikileaks. Depending on how an adversary times that, it could be damaging for Wikileaks.
    - gizmo686 13y ago
      They could encrypt it using a pre-existing NSA public key.
- SimHacker 13y ago
  "Due to its incessant work, NSA is the largest electricity consumer in Maryland." - http://en.wikipedia.org/wiki/National_Security_Agency http://en.wikipedia.org/wiki/National_Security_Agency So what would the carbon footprint be of WikiLeaks releasing 50 gigabytes of encrypted random data?
msantos 13y ago
Glenn Greenwald (@ggreenwald) tweeted at 1:00 AM on Sun, Aug 18, 2013: For those asking, @MikeGrunwald's now-deleted tweet: "I can't wait to write a defense of the drone strike that takes out Julian Assange" (https://twitter.com/ggreenwald/status/368885133803143168 https://twitter.com/ggreenwald/status/368885133803143168)
- notdrunkatall 13y ago
  That's just horrible.
Sami_Lehtinen 13y ago
Reading those comments on that Facebook page make me cry. Where is this thing called humanity heading to?

187 points by jlgreco 13y ago

deleted 13y ago

[deleted]

hayksaakian 13y ago

This seems like a good plan to me, but can any crypto pros poke holes in it?

rubbingalcohol 13y ago
Sure. I'll get back to you in a few trillion years.
- cheald 13y ago
  Psh, everyone knows that it only takes the span of a commercial break to crack military-grade double-layered crypto if you use a logic bomb.
  - marcamillion 13y ago
    So why don't you do it then? You would be famous for sure.
    - cheald 13y ago
      I would, but I don't know how to write a GUI interface in Visual Basic :(
      - raverbashing 13y ago
        Decrypting [====______]
  - Keyframe 13y ago
    I don't know VB though. On a serious note I wonder if there are guys out there that treat this tease as a challenge and try to poke holes themselves. Must be a thrill.
  - SimHacker 13y ago
    Hey guys and gals, I just found an FTP server FULL of secret NSA files! Its IP address is 127.0.0.1 -- check it out!!! http://www.cryonet.org/cgi-bin/dsp.cgi?msg=6289 http://www.cryonet.org/cgi-bin/dsp.cgi?msg=6289
nwh 13y ago
When you're up against the US government with all of their cracking hardware, your passphrase won't be simple.
- jlgreco 13y ago
  Unless the insurance files are bluffs, you may as well give the US government the keys yourself so that they know you are not bluffing. The threat that makes the insurance files work is that the public/press and/or foreign governments may get the keys.
  - kaolinite 13y ago
    The problem with doing that is that the US government might release the information themselves, just dampened a bit with some PR, so the insurance files aren't worth anything and so WikiLeaks don't get the credit.
    - XorNot 13y ago
      Which would generally imply that they're not very good insurance files. I had the last one for a bit, and deleted it just now because I'm seriously doubtful these things are anything more then /dev/urandom piped into a file.
      - nwh 13y ago
        What gives you any indication of that? There's no way of telling a ciphertext from random bytes.
        gwern 13y ago
        Well, obviously, there's no way of telling or he'd simply crack the file and say it was random. His point is based more on softer considerations like "they never used the previous insurance file yet, have they?" and "Wikileaks pulls a lot of stunts" and "this is just the sort of thing that would appeal to a cryptogeek like Assange whose avowed purpose is to throw sand into the gears of secretive organizations" and "so how did they get 300GB+ of leaked stuff since the site has been half-inactive for years and Assange completely distracted by his legal issues? Who would trust them with it? eg. Snowden didn't go to Wikileaks".
JoachimSchipper 13y ago
Clearly, just use a standard solution (PGP). Don't do this with a weak passphrase, and use key-strengthening (bcrypt etc.) just in case. Assange is pretty good at crypto, so I'd expect Wikileaks to broadly get this right. Also, they already got in trouble for reusing a password (http://boingboing.net/2011/08/31/wikileaks-guardian-journalist-negligently-published-password-to-unredacted-cables.html http://boingboing.net/2011/08/31/wikileaks-guardian-journali...), so I'm pretty sure they won't do that again...
- raverbashing 13y ago
  No, the key strengthening is probably built-in. Also, most likely it doesn't use a passphrase, but a big generated gpg key (with a passphrase protecting it, of course)
  - JoachimSchipper 13y ago
    At least for symmetric encryption, gpg defaults (defaulted?) to SHA-1'ing the passphrase 2^16 times, which is not a very large number - http://passwords12.at.ifi.uio.no/Jeremi_Gosney_Password_Cracking_HPC_Passwords12.pdf http://passwords12.at.ifi.uio.no/Jeremi_Gosney_Password_Crac... [pdf] talks of ~2^36 operations per second. This isn't the worst thing ever, but using GPG for passphrase-protected encryption is not as strong as you might expect - just use a slightly longer/better one. (Obviously, don't switch to another tool if you can't evaluate it in depth - GPG isn't perfect, but picking a random other tool won't be an improvement.)
- stefantalpalaru 13y ago
  > Assange is pretty good at crypto Not really. He gave a moron the password to a publicly distributed insurance file instead of making a new encrypted file just for him.
  - JoachimSchipper 13y ago
    Are you aware of http://en.wikipedia.org/wiki/Rubberhose_(file_system) http://en.wikipedia.org/wiki/Rubberhose_(file_system)?

hnha 13y ago

why on earth is this a link to Facebook of all things?

hack37 13y ago
because it may be the source of the news ?
buster 13y ago
I don't understand why they don't post it on their own site.. but well.. here is twitter: https://twitter.com/wikileaks/status/368426845735120896 https://twitter.com/wikileaks/status/368426845735120896
- brokenparser 13y ago
  Thanks, I can't access Facebook from here. Might as well post the direct torrent URLs: 3,6GiB (20130815-A): http://wlstorage.net/torrent/wlinsurance-20130815-A.aes256.torrent magnet:?xt=urn:btih:e0a092ac0f9b56c886c41335ca36f34aaed6b80c&dn=wlinsurance-20130815-A.aes256&tr=udp%3A%2F%2Ftracker.publicbt.com%3A80%2Fannounce&tr=udp%3A%2F%2Ftracker.openbittorrent.com%3A80%2Fannounce&tr=udp%3A%2F%2Ftracker.istole.it%3A80%2Fannounce&tr=udp%3A%2F%2Ftracker.ccc.de%3A80%2Fannounce 49GiB (20130815-B): http://wlstorage.net/torrent/wlinsurance-20130815-B.aes256.torrent magnet:?xt=urn:btih:95381785c3fb446df35c5b4a8e5ef167dcb72011&dn=wlinsurance-20130815-B.aes256&tr=udp%3A%2F%2Ftracker.publicbt.com%3A80%2Fannounce&tr=udp%3A%2F%2Ftracker.openbittorrent.com%3A80%2Fannounce&tr=udp%3A%2F%2Ftracker.istole.it%3A80%2Fannounce&tr=udp%3A%2F%2Ftracker.ccc.de%3A80%2Fannounce 349GiB (20130815-C): http://wlstorage.net/torrent/wlinsurance-20130815-C.aes256.torrent magnet:?xt=urn:btih:091eed7793fdb48c5bd8488431e888dde41a889f&dn=wlinsurance-20130815-C.aes256&tr=udp%3A%2F%2Ftracker.publicbt.com%3A80%2Fannounce&tr=udp%3A%2F%2Ftracker.openbittorrent.com%3A80%2Fannounce&tr=udp%3A%2F%2Ftracker.istole.it%3A80%2Fannounce&tr=udp%3A%2F%2Ftracker.ccc.de%3A80%2Fannounce
  - deleted 13y ago
    [deleted]
  - deleted 13y ago
    [deleted]

adamnemecek 13y ago

I wonder what could be 349GB worth of data. Probably not text. Video?

hijackson 13y ago
My roomate's mother makes $87 hourly on the laptop. She has been fired for 7 months but last month her pay was $21739 just working on the laptop for a few hours. Read more here=====>>>>>=====www.jobs34.com
- jacquesm 13y ago
  If you want that domain to die please continue to spam this forum. Of all the places on the web this is probably the least smart to pull stunts like this.
  - thewarrior 13y ago
    Does anyone actually fall for this stuff ?
    - jacquesm 13y ago
      ROI: if nobody would fall for it they wouldn't do it...
      - RDeckard 13y ago
        That's funny hijackson, because My roomate's mother makes $87 hourly on the laptop. She has been fired for 7 months but last month her pay was $21739 just working on the laptop for a few hours. Read more here=====>>>>>=====www.jobs34.com
        kintamanimatt 13y ago
        I almost thought this comment was going to be a parody of the other! I'm kinda curious though. At $87/hour, she worked about 250 hours, which works out to be about 57 hours a week. If she only works a few hours at her laptop, the fuck is she doing the rest of the time?

crdoconnor 13y ago

I wonder what specific eventuality they're actually insuring against. Capture of Julian Assange?

nwh 13y ago
I would expect that they are going to be releasing something big in the next couple of weeks/months.
atmosx 13y ago
Can be related to both Snowden and Assange or even Manning. Sure thing is that these documents must be a sort of time-bombs: 10 years from now even if we crack them, won't have a meaning, but now... apparently they do.

Renaud 13y ago

I wonder what are the risks associated with downloading and sharing such torrents. Evidently, anyone getting them becomes a highly visible target and once the content of these torrents is known, you could become involved in the distribution of classified data. Even if the content is not known, it could be viewed as an 'unfriendly' act and could make you become a "target of interest" to some zealous 3-letter agency... Maybe I'm too paranoid. On the other hand, maybe not enough. Hard to know these days.

Sven7 13y ago
Well thank god for college kids.
atmosx 13y ago
And what if I'm not a USA citizens, they are watching me anyway. Anyway, if I were on the NSA's office, watching everyday comments on Hacker-News I'd already have targeted half it's crowd potentially dangerous to the security of the country, just for being so interested in national security matters. Those Geeks!!!
- a3n 13y ago
  "Anyway, if I were on the NSA's office, watching everyday comments on Hacker-News ..." Wait, wait. You're saying there's a way to get paid to read HN all day? Where do I sign?
  - stefantalpalaru 13y ago
    > Where do I sign? Follow the path to the dark side [1]. They have cookies. [1]: https://www.nsa.gov/psp/applyonline/EMPLOYEE/HRMS/c/HRS_HRAM.HRS_CE.GBL?Page=HRS_CE_HM_PRE&Action=A&SiteId=1 https://www.nsa.gov/psp/applyonline/EMPLOYEE/HRMS/c/HRS_HRAM...
  - gugol 13y ago
    And for watching porn...

runn1ng 13y ago

Frankly, given what is going on, I would bet on this being the Snowden's NSA data

0x45696e6172 13y ago

Part of Wikileaks' manifest is a promise to the leakers to release the information eventually, and they have proven track record of doing so. Aware of this, I wonder if new insurance files will have any influence on the actions of their enemies.

thirstywhimbrel 13y ago
| I wonder if new insurance files will have any influence on the actions of their enemies. Even without that, no effect. Blackmailing a bureaucracy... it's not like dealing with a single rational actor. That's the Hollywood version of Washington. It's like coming upon a traffic jam and deciding you should bribe those responsible so you can go on your way.
- saraid216 13y ago
  > It's like coming upon a traffic jam and deciding you should bribe those responsible so you can go on your way. This is officially my new favoritest analogy.

ChuckMcM 13y ago

So what is the chance they put out an insurance file that they know can be decrypted by the NSA and has really damaging documents in it? I mean it would be a way of showing the NSA what you have, having it already in the hands of a bunch of other people. I wonder if that would be a useful strategy. It could give the NSA time to build a counter story (parallel construction :-) which would be mitigate some of the impact, but it could also be construed as a form of "responsible disclosure" letting them know before the world knows so they can "patch their systems." I hope some creative writer is out there doing some exploration out there in a novel. Lots of interesting questions to think about with regard to the mechanics of this whole story.

tjohns 13y ago
If they're releasing something that they could reasonably expect the NSA to be able to crack, there's a non-zero chance other governments would be able to read it as well. That's not really "responsible disclosure" anymore. It would be safer to just send the decryption key directly to the NSA on a CD. ;)
- ChuckMcM 13y ago
  Fair enough.
- chimeracoder 13y ago
  Well, that also lets the NSA (or anybody who intercepts the CD) release the key to try and make it look like it came from Wikileaks. Depending on how an adversary times that, it could be damaging for Wikileaks.
  - gizmo686 13y ago
    They could encrypt it using a pre-existing NSA public key.
SimHacker 13y ago
"Due to its incessant work, NSA is the largest electricity consumer in Maryland." - http://en.wikipedia.org/wiki/National_Security_Agency http://en.wikipedia.org/wiki/National_Security_Agency So what would the carbon footprint be of WikiLeaks releasing 50 gigabytes of encrypted random data?

msantos 13y ago

Glenn Greenwald (@ggreenwald) tweeted at 1:00 AM on Sun, Aug 18, 2013: For those asking, @MikeGrunwald's now-deleted tweet: "I can't wait to write a defense of the drone strike that takes out Julian Assange" (https://twitter.com/ggreenwald/status/368885133803143168 https://twitter.com/ggreenwald/status/368885133803143168)

notdrunkatall 13y ago
That's just horrible.

Sami_Lehtinen 13y ago

Reading those comments on that Facebook page make me cry. Where is this thing called humanity heading to?